{"api_version":"1","generated_at":"2026-10-21T21:27:32+00:00","cve":"CVE-2026-100821","urls":{"html":"https://cve.report/CVE-2026-100821","api":"https://cve.report/api/cve/CVE-2026-100821.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-100821","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100821"},"summary":{"title":"Site isolation issue in the Panning and Zooming component","description":"Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.","state":"PUBLISHED","assigner":"mozilla","published_at":"2026-09-29 13:17:47","updated_at":"2026-10-13 17:13:58"},"problem_types":["CWE-346","CWE-346 CWE-346 Origin Validation Error"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"4.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"4.7","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/","name":"https://www.mozilla.org/security/advisories/mfsa2026-102/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-103/","name":"https://www.mozilla.org/security/advisories/mfsa2026-103/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2071784","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=2071784","refsource":"security@mozilla.org","tags":["Permissions Required"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-101/","name":"https://www.mozilla.org/security/advisories/mfsa2026-101/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-97/","name":"https://www.mozilla.org/security/advisories/mfsa2026-97/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-100/","name":"https://www.mozilla.org/security/advisories/mfsa2026-100/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-99/","name":"https://www.mozilla.org/security/advisories/mfsa2026-99/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-98/","name":"https://www.mozilla.org/security/advisories/mfsa2026-98/","refsource":"security@mozilla.org","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100821","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100821","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Mozilla","product":"Firefox","version":"unaffected 115.42 115.* rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Firefox","version":"unaffected 140.17 140.* rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Firefox","version":"unaffected 153.4 153.* rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Firefox","version":"unaffected 157 * rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Thunderbird","version":"unaffected 140.17 140.* rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Thunderbird","version":"unaffected 153.4 153.* rpm","platforms":[]},{"source":"CNA","vendor":"Mozilla","product":"Thunderbird","version":"unaffected 157 * rpm","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Nguyen Thanh Nguyen","lang":"en"}],"nvd_cpes":[{"cve_year":"2026","cve_id":"100821","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"100821","cve":"CVE-2026-100821","epss":"0.001520000","percentile":"0.037560000","score_date":"2026-10-04","updated_at":"2026-10-05 00:09:46"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-100821","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-01T15:55:12.732044Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"CWE-346 Origin Validation Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-01T15:55:15.347Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.42","versionType":"rpm"},{"lessThanOrEqual":"140.*","status":"unaffected","version":"140.17","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.4","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"157","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"140.*","status":"unaffected","version":"140.17","versionType":"rpm"},{"lessThanOrEqual":"153.*","status":"unaffected","version":"153.4","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"157","versionType":"rpm"}]}],"credits":[{"lang":"en","value":"Nguyen Thanh Nguyen"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."}],"value":"Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."}],"providerMetadata":{"dateUpdated":"2026-09-30T17:20:50.356Z","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","shortName":"mozilla"},"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2071784"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-100/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-101/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-102/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-103/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-97/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-98/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-99/"}],"title":"Site isolation issue in the Panning and Zooming component"}},"cveMetadata":{"assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","assignerShortName":"mozilla","cveId":"CVE-2026-100821","datePublished":"2026-09-29T12:36:30.318Z","dateReserved":"2026-09-26T19:18:35.743Z","dateUpdated":"2026-10-01T15:55:15.347Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-29 13:17:47","lastModifiedDate":"2026-10-13 17:13:58","problem_types":["CWE-346","CWE-346 CWE-346 Origin Validation Error"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-01T15:55:12.732044Z","id":"CVE-2026-100821","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"115.42.0","matchCriteriaId":"9D4A8C0D-2E00-4182-A7A2-0F669C935655"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"116.0.0","versionEndExcluding":"140.17.0","matchCriteriaId":"B2668FF6-29A6-4400-B185-11B8EA6A7970"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"141.0.0","versionEndExcluding":"153.4.0","matchCriteriaId":"9BF2C3FF-9747-49D2-90FE-435A4F1B6D6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"154.0.0","versionEndExcluding":"157.0.0","matchCriteriaId":"CC64A654-10B5-4600-9E71-A2B276C5EAC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"140.17.0","matchCriteriaId":"D25C5E0F-CC93-48A0-A656-29450505E8C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionStartIncluding":"141.0","versionEndExcluding":"153.4.0","matchCriteriaId":"90E6FA6F-4AD3-4A75-A02F-5B668644087B"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionStartIncluding":"154.0","versionEndExcluding":"157.0","matchCriteriaId":"8A93E2FC-CEDC-4074-B587-70CD89C5BC2B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"100821","Ordinal":"1","Title":"Site isolation issue in the Panning and Zooming component","CVE":"CVE-2026-100821","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"100821","Ordinal":"1","NoteData":"Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.","Type":"Description","Title":"Site isolation issue in the Panning and Zooming component"}]}}}