CVE-2026-8091 is a high-impact memory safety vulnerability in the Audio/Video Playback component of Mozilla Firefox, caused by incorrect boundary conditions. It affects Firefox versions prior to 150 and related Thunderbird and Firefox ESR versions. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that it can be exploited remotely without privileges or user interaction, potentially leading to full confidentiality, integrity, and availability compromise. The Mozilla advisory confirms the fix and notes that this vulnerability is among several memory safety bugs resolved in the same release cycle. There are no known exploits in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely without any privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability arises from incorrect boundary conditions in the Audio/Video Playback component, which could lead to memory corruption. This is classified as a critical security issue with a CVSS score of 9.8.

An official fix is available. Users and administrators should update affected Mozilla products to Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, or Firefox ESR 115.35.2 or later. Applying these updates fully mitigates the vulnerability. There are no additional vendor-recommended mitigations beyond applying the official patches.