CVE-2026-8973 covers a set of memory safety bugs in Mozilla Firefox 150 that showed evidence of memory corruption, which could be exploited to run arbitrary code. These vulnerabilities were fixed in Firefox 151. The Mozilla advisory (MFSA2026-46) details multiple related vulnerabilities with varying impacts, including sandbox escapes, use-after-free, same-origin policy bypasses, integer overflows, privilege escalations, and information disclosures. The specific CVE-2026-8973 is among the high-impact memory safety bugs fixed in Firefox 151. The vulnerabilities affect Firefox 150 exactly, with no patch or fix available for that version. The vendor advisory confirms the fix availability in Firefox 151 and Thunderbird 151. No known exploits in the wild have been reported.

The vulnerabilities allow potential arbitrary code execution due to memory corruption in Firefox 150. This could lead to full compromise of the affected system if exploited. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. The issues also include sandbox escapes and privilege escalations in related components. No active exploitation has been reported, but the severity and nature of the bugs indicate a significant risk if left unpatched.

Users and administrators should upgrade affected Firefox installations from version 150 to version 151 or later to remediate these vulnerabilities. The vendor advisory confirms that the issues are fixed in Firefox 151. No temporary mitigations or workarounds are indicated. Since this is not a cloud service, patching the client software is required. Check the Mozilla security advisory at https://www.mozilla.org/security/advisories/mfsa2026-46/ for the latest updates and guidance.