CVE-2026-8391 is a security vulnerability affecting the JavaScript Engine component of Mozilla Firefox. The issue is categorized as 'Other issue' in the JavaScript Engine and was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. The CVSS 3.1 base score is 5.3, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. Mozilla's official security advisories (MFSA2026-45 and MFSA2026-47) list this vulnerability among multiple high-impact memory safety bugs that could potentially lead to memory corruption and arbitrary code execution if exploited. The vendor has released official fixes in the specified versions.

The vulnerability could lead to limited confidentiality loss without requiring user interaction or privileges, as indicated by the CVSS vector. Mozilla classifies the impact as high, noting that memory safety bugs fixed in the same releases showed evidence of memory corruption and could potentially be exploited to run arbitrary code. There are no known exploits in the wild at this time.

Official fixes for CVE-2026-8391 are available in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. Users and administrators should update to these versions or later to remediate this vulnerability. No additional mitigation actions are required beyond applying these updates.