Threat database

CVE-2026-8957 is a privilege escalation vulnerability in the Enterprise Policies component of Mozilla Firefox. It was fixed in Firefox 151 and Firefox ESR 140.11. The vulnerability has a high severity with a CVSS score of 8.8. Mozilla has officially addressed this issue in their security advisories dated May 19, 2026. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate this vulnerability.

Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-8955 is a privilege escalation vulnerability in the DOM: Workers component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox 151 and Firefox ESR 140.11. It has a high severity rating with a CVSS score of 8.8, indicating it could allow an attacker to gain elevated privileges. The vendor advisories confirm the issue and the availability of fixes in the specified Firefox versions.

Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-8952 is a privilege escalation vulnerability in the Application Update component of Mozilla Firefox and Thunderbird. This vulnerability has been fixed in Firefox 151 and Thunderbird 151. The issue was reported by Tomoya Nakanishi and is classified with moderate impact by Mozilla. The vulnerability allows an attacker to escalate privileges within the affected application. Mozilla has released security advisories confirming the fix in the specified versions. No known exploits in the wild have been reported. The CVSS score for this vulnerability is 8.8, indicating a high severity level overall, but Mozilla rates the impact of this specific issue as moderate.

Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

Memory safety bugs present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.