CVE-2026-100828

**CVE-2026-100828** is a security vulnerability affecting the Bookmarks & History component of Mozilla Firefox and Thunderbird. Reported by researcher Rintaro Kawasugi, the flaw allows for a mitigation bypass within this specific component. While the underlying technical mechanisms and exact downstream consequences of the bypass are not detailed in public advisories, the vulnerability enables an attacker to circumvent established security mitigations. The issue affects versions of Firefox prior to 157, Firefox ESR prior to 153.4, and Thunderbird prior to versions 157 and 153.4. Mozilla addressed the vulnerability in late September 2026, releasing patches in Firefox 157, Firefox ESR 153.4, and Thunderbird 153.4 and 157. Users are encouraged to update their software to these versions or later to resolve the issue.