CVE-2026-0892 encompasses multiple memory safety vulnerabilities in Firefox 146 and Thunderbird 146. Some of these bugs demonstrated memory corruption, which could allow an attacker to execute arbitrary code with no privileges required and no user interaction. The vulnerabilities are related to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Mozilla fixed these issues in Firefox 147 and Thunderbird 147. The vulnerabilities are part of a broader set of security fixes addressing sandbox escapes, use-after-free, information disclosure, denial-of-service, and spoofing issues in various components. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of these memory safety bugs could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the Firefox or Thunderbird process. The impact includes high confidentiality, integrity, and availability risks. However, no known exploits in the wild have been reported. The vulnerabilities affect Firefox 146 and Thunderbird 146 and their ESR 140.6 versions. The fixes in Firefox 147 and Thunderbird 147 mitigate these risks.

Mozilla has released official fixes for these vulnerabilities in Firefox 147 and Thunderbird 147. Users and administrators should update to these versions immediately to remediate the vulnerabilities. Since the vendor advisory confirms the availability of patches, applying these updates is the primary and recommended mitigation. There is no indication that additional mitigations or workarounds are required or effective.