CVE-2026-100803

高危 8.1CVE-2026-100803 · Published 29/09/2026 · updated 19/10/2026

要点

CVE-2026-100803 是影响 firefox (mozilla), thunderbird (mozilla) 的高危 (CVSS 8.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.17%，高于 5.9% 的漏洞。
修复：升级到 140.17.0, 153.4.0, 157.0.0, 115.42.0 或更高版本。

Package	Affected versions	Patched versions
firefox mozilla	`≥ 116.0, < 140.17.0≥ 141.0, < 153.4.0≥ 154.0.0, < 157.0.0< 115.42.0`	`140.17.0153.4.0157.0.0115.42.0`
thunderbird mozilla	`≥ 141.0, < 153.4.0≥ 154.0, < 157.0< 140.17.0`	`153.4.0157.0140.17.0`

Description

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

References

bugzilla.mozilla.org/show_bug.cgi · Permissions Required
mozilla.org/security/advisories/mfsa2026-100 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-101 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-102 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-103 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-97 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-98 · Vendor Advisory
mozilla.org/security/advisories/mfsa2026-99 · Vendor Advisory

firefox 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

firefox

mozilla

≥ 116.0, < 140.17.0≥ 141.0, < 153.4.0≥ 154.0.0, < 157.0.0< 115.42.0

140.17.0153.4.0157.0.0115.42.0

thunderbird

mozilla

≥ 141.0, < 153.4.0≥ 154.0, < 157.0< 140.17.0

153.4.0157.0140.17.0

firefox 的其他漏洞

查看全部 →