Vulnerability-Lookup

alsa-2026:3361

Vulnerability from osv_almalinux

Published

2026-02-25 00:00

Modified

2026-02-26 10:18

Summary

Important: firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)
firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)
firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)
firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771)
firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)
firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)
firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)
firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)
firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)
firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)
firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)
firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)
firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)
firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)
firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)
firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)
firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)
firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)
firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)
firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)
firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)
firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)
firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)
firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)
firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)
firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)
firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)
firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)
firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)
firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)
firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)
firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)
firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)
firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)
firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-2778)
firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)
firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)
firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:3361	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-2447	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2757	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2758	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2759	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2760	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2761	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2762	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2763	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2764	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2765	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2766	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2767	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2768	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2769	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2770	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2771	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2772	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2773	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2774	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2775	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2776	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2777	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2778	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2779	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2780	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2781	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2782	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2783	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2784	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2785	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2786	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2787	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2788	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2789	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2790	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2791	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2792	REPORT
	https://access.redhat.com/security/cve/CVE-2026-2793	REPORT
	https://bugzilla.redhat.com/2440219	REPORT
	https://bugzilla.redhat.com/2442284	REPORT
	https://bugzilla.redhat.com/2442287	REPORT
	https://bugzilla.redhat.com/2442288	REPORT
	https://bugzilla.redhat.com/2442290	REPORT
	https://bugzilla.redhat.com/2442291	REPORT
	https://bugzilla.redhat.com/2442292	REPORT
	https://bugzilla.redhat.com/2442294	REPORT
	https://bugzilla.redhat.com/2442295	REPORT
	https://bugzilla.redhat.com/2442297	REPORT
	https://bugzilla.redhat.com/2442298	REPORT
	https://bugzilla.redhat.com/2442300	REPORT
	https://bugzilla.redhat.com/2442302	REPORT
	https://bugzilla.redhat.com/2442304	REPORT
	https://bugzilla.redhat.com/2442307	REPORT
	https://bugzilla.redhat.com/2442308	REPORT
	https://bugzilla.redhat.com/2442309	REPORT
	https://bugzilla.redhat.com/2442312	REPORT
	https://bugzilla.redhat.com/2442313	REPORT
	https://bugzilla.redhat.com/2442314	REPORT
	https://bugzilla.redhat.com/2442316	REPORT
	https://bugzilla.redhat.com/2442318	REPORT
	https://bugzilla.redhat.com/2442319	REPORT
	https://bugzilla.redhat.com/2442320	REPORT
	https://bugzilla.redhat.com/2442322	REPORT
	https://bugzilla.redhat.com/2442324	REPORT
	https://bugzilla.redhat.com/2442325	REPORT
	https://bugzilla.redhat.com/2442326	REPORT
	https://bugzilla.redhat.com/2442327	REPORT
	https://bugzilla.redhat.com/2442328	REPORT
	https://bugzilla.redhat.com/2442329	REPORT
	https://bugzilla.redhat.com/2442331	REPORT
	https://bugzilla.redhat.com/2442333	REPORT
	https://bugzilla.redhat.com/2442334	REPORT
	https://bugzilla.redhat.com/2442335	REPORT
	https://bugzilla.redhat.com/2442337	REPORT
	https://bugzilla.redhat.com/2442342	REPORT
	https://bugzilla.redhat.com/2442343	REPORT
	https://errata.almalinux.org/10/ALSA-2026-3361.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:10",
        "name": "firefox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.8.0-2.el10_1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)\n  * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)\n  * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)\n  * firefox: Undefined behavior in the DOM: Core \u0026 HTML component (CVE-2026-2771)\n  * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)\n  * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)\n  * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)\n  * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)\n  * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)\n  * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)\n  * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)\n  * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)\n  * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)\n  * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)\n  * firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)\n  * firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)\n  * firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)\n  * firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)\n  * firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)\n  * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)\n  * firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)\n  * firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)\n  * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)\n  * firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)\n  * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)\n  * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)\n  * firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)\n  * firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)\n  * firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)\n  * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)\n  * firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)\n  * firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component (CVE-2026-2778)\n  * firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)\n  * firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)\n  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:3361",
  "modified": "2026-02-26T10:18:27Z",
  "published": "2026-02-25T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:3361"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2447"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2758"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2759"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2760"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2761"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2762"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2763"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2764"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2765"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2766"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2767"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2768"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2769"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2770"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2771"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2772"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2773"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2774"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2775"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2776"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2777"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2778"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2779"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2780"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2781"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2782"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2783"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2784"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2785"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2786"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2787"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2788"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2789"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2790"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2791"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2792"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2793"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2440219"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442284"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442287"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442288"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442290"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442291"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442292"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442294"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442295"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442297"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442298"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442300"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442302"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442304"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442307"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442309"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442312"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442313"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442314"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442316"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442318"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442319"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442320"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442322"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442324"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442325"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442326"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442327"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442328"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442331"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442333"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442334"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442335"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442337"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442342"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2442343"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/10/ALSA-2026-3361.html"
    }
  ],
  "related": [
    "CVE-2026-2447",
    "CVE-2026-2785",
    "CVE-2026-2793",
    "CVE-2026-2771",
    "CVE-2026-2774",
    "CVE-2026-2776",
    "CVE-2026-2781",
    "CVE-2026-2766",
    "CVE-2026-2769",
    "CVE-2026-2787",
    "CVE-2026-2768",
    "CVE-2026-2783",
    "CVE-2026-2788",
    "CVE-2026-2784",
    "CVE-2026-2759",
    "CVE-2026-2762",
    "CVE-2026-2761",
    "CVE-2026-2777",
    "CVE-2026-2790",
    "CVE-2026-2775",
    "CVE-2026-2763",
    "CVE-2026-2792",
    "CVE-2026-2773",
    "CVE-2026-2786",
    "CVE-2026-2789",
    "CVE-2026-2757",
    "CVE-2026-2760",
    "CVE-2026-2772",
    "CVE-2026-2779",
    "CVE-2026-2767",
    "CVE-2026-2764",
    "CVE-2026-2782",
    "CVE-2026-2765",
    "CVE-2026-2780",
    "CVE-2026-2778",
    "CVE-2026-2758",
    "CVE-2026-2791",
    "CVE-2026-2770"
  ],
  "summary": "Important: firefox security update"
}

CVE-2026-2447 (GCVE-0-2026-2447)

Vulnerability from cvelistv5 – Published: 2026-02-16 14:13 – Updated: 2026-04-13 13:53

Title

Heap buffer overflow in libvpx

Summary

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

Severity ?

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

mozilla

References

3 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2014390
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.32.1 , ≤ 115.* (rpm) Unaffected: 140.7.1 , ≤ 140.* (rpm) Unaffected: 147.0.4 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.7.2 , ≤ 140.* (rpm) Unaffected: 147.0.2 , ≤ * (rpm)

Credits

jayjayjazz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-17T14:52:59.556198Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-122",
                "description": "CWE-122 Heap-based Buffer Overflow",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-17T14:53:32.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-02-22T21:05:42.890Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.32.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.7.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "147.0.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.7.2",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "147.0.2",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "jayjayjazz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2."
            }
          ],
          "value": "Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:57.597Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-10/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-11/"
        }
      ],
      "title": "Heap buffer overflow in libvpx"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2447",
    "datePublished": "2026-02-16T14:13:23.559Z",
    "dateReserved": "2026-02-13T09:28:08.874Z",
    "dateUpdated": "2026-04-13T13:53:57.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2757 (GCVE-0-2026-2757)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-04-14 15:11

Title

Incorrect boundary conditions in the WebRTC: Audio/Video component

Summary

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1384 - Improper Handling of Physical or Environmental Conditions

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2001637
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Igor Morgenstern

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:39:17.644870Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1384",
                "description": "CWE-1384 Improper Handling of Physical or Environmental Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-14T15:11:01.347Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Igor Morgenstern"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:17.175Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2001637"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Incorrect boundary conditions in the WebRTC: Audio/Video component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2757",
    "datePublished": "2026-02-24T13:32:57.740Z",
    "dateReserved": "2026-02-19T15:05:16.301Z",
    "dateUpdated": "2026-04-14T15:11:01.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2758 (GCVE-0-2026-2758)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-04-15 15:37

Title

Use-after-free in the JavaScript: GC component

Summary

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2009608
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Gary Kwong

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2758",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:44:21.619796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:37:39.628Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gary Kwong"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:19.199Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009608"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Use-after-free in the JavaScript: GC component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2758",
    "datePublished": "2026-02-24T13:32:58.501Z",
    "dateReserved": "2026-02-19T15:05:18.397Z",
    "dateUpdated": "2026-04-15T15:37:39.628Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2759 (GCVE-0-2026-2759)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-04-15 15:38

Title

Incorrect boundary conditions in the Graphics: ImageLib component

Summary

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-1384 - Improper Handling of Physical or Environmental Conditions

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2010933
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Steven Julian

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:46:43.395477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1384",
                "description": "CWE-1384 Improper Handling of Physical or Environmental Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:38:00.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Steven Julian"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:21.286Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010933"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Incorrect boundary conditions in the Graphics: ImageLib component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2759",
    "datePublished": "2026-02-24T13:32:59.173Z",
    "dateReserved": "2026-02-19T15:05:20.862Z",
    "dateUpdated": "2026-04-15T15:38:00.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2760 (GCVE-0-2026-2760)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-15 15:38

Title

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Summary

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-1384 - Improper Handling of Physical or Environmental Conditions

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2011062
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:49:35.987873Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1384",
                "description": "CWE-1384 Improper Handling of Physical or Environmental Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:38:19.407Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:23.200Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011062"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2760",
    "datePublished": "2026-02-24T13:33:00.290Z",
    "dateReserved": "2026-02-19T15:05:23.107Z",
    "dateUpdated": "2026-04-15T15:38:19.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2761 (GCVE-0-2026-2761)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-15 15:38

Title

Sandbox escape in the Graphics: WebRender component

Summary

Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-693 - Protection Mechanism Failure

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2011063
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Oskar L

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2761",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T15:52:27.559542Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:38:48.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Oskar L"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:25.428Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011063"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Sandbox escape in the Graphics: WebRender component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2761",
    "datePublished": "2026-02-24T13:33:01.011Z",
    "dateReserved": "2026-02-19T15:05:25.145Z",
    "dateUpdated": "2026-04-15T15:38:48.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2762 (GCVE-0-2026-2762)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-15 15:39

Title

Integer overflow in the JavaScript: Standard Library component

Summary

Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2011649
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

André Bargull

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2762",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T02:24:03.909176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:39:20.955Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Andr\u00e9 Bargull"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:10.269Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011649"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Integer overflow in the JavaScript: Standard Library component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2762",
    "datePublished": "2026-02-24T13:33:01.761Z",
    "dateReserved": "2026-02-19T15:05:27.383Z",
    "dateUpdated": "2026-04-15T15:39:20.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2763 (GCVE-0-2026-2763)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-15 15:39

Title

Use-after-free in the JavaScript Engine component

Summary

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2012018
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2763",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T02:25:44.670526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-15T15:39:44.974Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:27.511Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012018"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Use-after-free in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2763",
    "datePublished": "2026-02-24T13:33:02.514Z",
    "dateReserved": "2026-02-19T15:05:29.821Z",
    "dateUpdated": "2026-04-15T15:39:44.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2764 (GCVE-0-2026-2764)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-16 14:27

Title

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Summary

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2012608
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T02:27:58.171528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:27:18.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:30.063Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012608"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2764",
    "datePublished": "2026-02-24T13:33:03.207Z",
    "dateReserved": "2026-02-19T15:05:32.669Z",
    "dateUpdated": "2026-04-16T14:27:18.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2765 (GCVE-0-2026-2765)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-16 14:27

Title

Use-after-free in the JavaScript Engine component

Summary

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

mozilla

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2013562
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2765",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T02:30:09.342761Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:27:42.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:12.398Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013562"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Use-after-free in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2765",
    "datePublished": "2026-02-24T13:33:03.943Z",
    "dateReserved": "2026-02-19T15:05:35.131Z",
    "dateUpdated": "2026-04-16T14:27:42.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

alsa-2026:3361

Vulnerability from osv_almalinux

CVE-2026-2447 (GCVE-0-2026-2447)

CVE-2026-2757 (GCVE-0-2026-2757)

CVE-2026-2758 (GCVE-0-2026-2758)

CVE-2026-2759 (GCVE-0-2026-2759)

CVE-2026-2760 (GCVE-0-2026-2760)

CVE-2026-2761 (GCVE-0-2026-2761)

CVE-2026-2762 (GCVE-0-2026-2762)

CVE-2026-2763 (GCVE-0-2026-2763)

CVE-2026-2764 (GCVE-0-2026-2764)

CVE-2026-2765 (GCVE-0-2026-2765)

Tags

Sightings

Nomenclature