Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

slackware SSA:2026-273-02: [slackware-security] mozilla-thunderbird (SSA:2026-273-02)

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory.

  - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox     ESR 153.4 and Firefox 157. (CVE-2026-100831)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory.

  - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox     ESR 153.4 and Firefox 157. (CVE-2026-100831)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-103 advisory.

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100832)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 153.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-103 advisory.

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100832)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-102 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-102 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6533 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6533-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     September 30, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2026-96869 CVE-2026-100756 CVE-2026-100757 CVE-2026-100758                      CVE-2026-100759 CVE-2026-100760 CVE-2026-100762 CVE-2026-100765                      CVE-2026-100766 CVE-2026-100767 CVE-2026-100769 CVE-2026-100770                      CVE-2026-100771 CVE-2026-100772 CVE-2026-100773 CVE-2026-100774                      CVE-2026-100775 CVE-2026-100776 CVE-2026-100777 CVE-2026-100778                      CVE-2026-100779 CVE-2026-100780 CVE-2026-100781 CVE-2026-100782                      CVE-2026-100783 CVE-2026-100784 CVE-2026-100785 CVE-2026-100786                      CVE-2026-100787 CVE-2026-100788 CVE-2026-100789 CVE-2026-100790                      CVE-2026-100791 CVE-2026-100792 CVE-2026-100794 CVE-2026-100797                      CVE-2026-100798 CVE-2026-100800 CVE-2026-100801 CVE-2026-100803                      CVE-2026-100806 CVE-2026-100807 CVE-2026-100808 CVE-2026-100809                      CVE-2026-100811 CVE-2026-100812 CVE-2026-100814 CVE-2026-100815                      CVE-2026-100816 CVE-2026-100818 CVE-2026-100819 CVE-2026-100820                      CVE-2026-100821 CVE-2026-100822 CVE-2026-100824 CVE-2026-100825                      CVE-2026-100826 CVE-2026-100828 CVE-2026-100829 CVE-2026-100830                      CVE-2026-100831 CVE-2026-100832

    Multiple security issues have been found in the Mozilla Firefox web     browser, which could potentially result in the execution of arbitrary     code, sandbox escape, information disclosure or privilege escalation.

    Debian follows the extended support releases (ESR) of Firefox. Starting     with this update we're now following the 153.x releases.

    Between 140.x and 153.x, Firefox has seen a number of feature     updates. For more information please refer to     https://www.firefox.com/en-US/firefox/153.0esr/releasenotes/

    For the stable distribution (trixie), these problems have been fixed in     version 153.4.0esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100770)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of mozilla-firefox installed on the remote host is prior to 140.17.0esr / 153.4.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-272-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.42. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-98 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

  - Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR     153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-99 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

  - Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR     153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.42. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-98 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

  - Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR     153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-97 advisory.

  - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and     Firefox 157. (CVE-2026-100824)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-97 advisory.

  - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and     Firefox 157. (CVE-2026-100824)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.17. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-99 advisory.

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was     fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and     Firefox ESR 140.17. (CVE-2026-92035)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

  - Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR     153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100759)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
353287	Mozilla Thunderbird < 157.0	Nessus	MacOS X Local Security Checks	Local	critical
353286	Mozilla Thunderbird < 157.0	Nessus	Windows	Local	critical
353285	Mozilla Thunderbird < 153.4	Nessus	MacOS X Local Security Checks	Local	critical
353284	Mozilla Thunderbird < 153.4	Nessus	Windows	Local	critical
353283	Mozilla Thunderbird < 140.17	Nessus	MacOS X Local Security Checks	Local	critical
353282	Mozilla Thunderbird < 140.17	Nessus	Windows	Local	critical
352262	Debian dsa-6533 : firefox-esr - security update	Nessus	Debian Local Security Checks	Local	critical
351268	Linux Distros Unpatched Vulnerability : CVE-2026-100770	Nessus	Misc.	Local	critical
351218	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-272-01)	Nessus	Slackware Local Security Checks	Local	critical
351123	Mozilla Firefox ESR < 115.42	Nessus	MacOS X Local Security Checks	Local	critical
351122	Mozilla Firefox ESR < 140.17	Nessus	Windows	Local	critical
351121	Mozilla Firefox ESR < 115.42	Nessus	Windows	Local	critical
351120	Mozilla Firefox < 157.0	Nessus	MacOS X Local Security Checks	Local	critical
351119	Mozilla Firefox < 157.0	Nessus	Windows	Local	critical
351118	Mozilla Firefox ESR < 140.17	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-100770

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical