CVE-2026-100811

A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model (DOM) Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code outside the browser's restricted sandbox environment.

An IMPORTANT severity use-after-free flaw was found in the Firefox web browser's Document Object Model (DOM) Core and HTML component. A remote attacker could entice a victim to visit a specially crafted web page to trigger the use-after-free condition and execute arbitrary code outside of the browser's restricted sandbox environment, resulting in a sandbox escape and potential compromise of the victim's user session. The firefox component as shipped in affected Red Hat product streams is affected by this flaw; no affected Red Hat product stream is currently distinguished as not affected. Red Hat Product Security has rated this flaw with a CVSS 3.1 score of 6.1 (moderate) (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which is substantially lower than the 9.6 (critical) score assigned by CISA; the difference is mainly attributable to Red Hat's lower confidentiality and integrity impact assessment (C:L/I:L/A:N versus C:H/I:H/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.