CVE-2026-100824: Privilege escalation in the Places component
Published Sep 29, 2026
·Updated
Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
Affected Software
8 affected componentsFixes available
Mozilla Firefox<157
157
Mozilla Firefox ESR<153.4
153.4
Mozilla Thunderbird<157
157
Mozilla Thunderbird<153.4
153.4
Mozilla Firefox<153.4.0
Mozilla Firefox>=154.0.0<157.0.0
Mozilla Thunderbird<153.4.0
Mozilla Thunderbird>=154.0<157.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 157 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.4 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.4 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 157 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 157 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.4
Event History
Sep 29, 2026
CVE Published
via Mozilla·12:00 AM
Data Sourced
via Mozilla·12:00 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·12:36 PM
Data Sourced
via MITRE·12:36 PM
Description
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-100756
- CVE-2026-100757
- CVE-2026-100758
- CVE-2026-100759
- CVE-2026-100760
- CVE-2026-100761
- CVE-2026-100762
- CVE-2026-100763
- CVE-2026-100764
- CVE-2026-100765
- CVE-2026-100766
- CVE-2026-100767
- CVE-2026-100768
- CVE-2026-100769
- CVE-2026-100770
- CVE-2026-100771
- CVE-2026-100772
- CVE-2026-100773
- CVE-2026-100774
- CVE-2026-100775
- CVE-2026-100776
- CVE-2026-100777
- CVE-2026-100778
- CVE-2026-100779
- CVE-2026-100780
- CVE-2026-100781
- CVE-2026-100782
- CVE-2026-100783
- CVE-2026-100784
- CVE-2026-100785
- CVE-2026-100786
- CVE-2026-100787
- CVE-2026-100788
- CVE-2026-100789
- CVE-2026-100790
- CVE-2026-100791
- CVE-2026-100792
- CVE-2026-100793
- CVE-2026-100794
- CVE-2026-96869
- CVE-2026-100795
- CVE-2026-100796
- CVE-2026-100797
- CVE-2026-100798
- CVE-2026-100799
- CVE-2026-100800
- CVE-2026-100801
- CVE-2026-100802
- CVE-2026-100803
- CVE-2026-100804
- CVE-2026-100805
- CVE-2026-100806
- CVE-2026-100807
- CVE-2026-100808
- CVE-2026-100809
- CVE-2026-100810
- CVE-2026-100811
- CVE-2026-100812
- CVE-2026-100813
- CVE-2026-100814
- CVE-2026-100815
- CVE-2026-100816
- CVE-2026-100817
- CVE-2026-100818
- CVE-2026-100819
- CVE-2026-100820
- CVE-2026-100821
- CVE-2026-100822
- CVE-2026-100823
- CVE-2026-100824
- CVE-2026-100825
- CVE-2026-100826
- CVE-2026-100828
- CVE-2026-100829
- CVE-2026-100830
- CVE-2026-100831
- CVE-2026-100832
- CVE-2026-103500