CVE-2026-8390 is a use-after-free vulnerability in the JavaScript WebAssembly component of Mozilla Firefox. This flaw allows memory to be accessed after it has been freed, which can lead to memory corruption and potentially arbitrary code execution or denial of service. The issue was reported by OpenAI Preparedness and Bill Demirkapi and has been assigned a CVSS v3.1 base score of 7.3, indicating high severity. Mozilla fixed this vulnerability in Firefox version 150.0.3. The vulnerability is publicly documented and detailed in Mozilla's security advisory MFSA 2026-45.

Successful exploitation of this use-after-free vulnerability could lead to limited confidentiality, integrity, and availability impacts, including potential arbitrary code execution or browser crashes. The CVSS score of 7.3 reflects a high impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Mozilla has released an official fix for this vulnerability in Firefox version 150.0.3. Users and administrators should update affected Firefox installations to version 150.0.3 or later to remediate this issue. There are no indications that additional mitigations are required beyond applying this update.