Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0204
Vulnerability from certfr_avis - Published: 2026-02-25 - Updated: 2026-02-25
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox | Firefox pour iOS versions antérieures à 147.4 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 140.8 | ||
| Mozilla | Firefox | Firefox versions antérieures à 148 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.33 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 148 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 140.8 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox pour iOS versions ant\u00e9rieures \u00e0 147.4",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 140.8",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox versions ant\u00e9rieures \u00e0 148",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.33",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 148",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 140.8",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-2777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2777"
},
{
"name": "CVE-2026-2773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2773"
},
{
"name": "CVE-2026-2763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2763"
},
{
"name": "CVE-2026-2783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2783"
},
{
"name": "CVE-2026-2786",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2786"
},
{
"name": "CVE-2026-2778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2778"
},
{
"name": "CVE-2026-2788",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2788"
},
{
"name": "CVE-2026-2758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2758"
},
{
"name": "CVE-2026-2779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2779"
},
{
"name": "CVE-2026-2771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2771"
},
{
"name": "CVE-2026-2769",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2769"
},
{
"name": "CVE-2026-2799",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2799"
},
{
"name": "CVE-2026-2775",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2775"
},
{
"name": "CVE-2026-2790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2790"
},
{
"name": "CVE-2026-2784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2784"
},
{
"name": "CVE-2026-2806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2806"
},
{
"name": "CVE-2026-2760",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2760"
},
{
"name": "CVE-2026-2792",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2792"
},
{
"name": "CVE-2026-2807",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2807"
},
{
"name": "CVE-2026-2781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2781"
},
{
"name": "CVE-2026-2759",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2759"
},
{
"name": "CVE-2026-2776",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2776"
},
{
"name": "CVE-2026-2764",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2764"
},
{
"name": "CVE-2026-2762",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2762"
},
{
"name": "CVE-2026-2791",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2791"
},
{
"name": "CVE-2026-2797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2797"
},
{
"name": "CVE-2026-2794",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2794"
},
{
"name": "CVE-2026-2765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2765"
},
{
"name": "CVE-2026-2770",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2770"
},
{
"name": "CVE-2026-2768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2768"
},
{
"name": "CVE-2026-2802",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2802"
},
{
"name": "CVE-2026-2789",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2789"
},
{
"name": "CVE-2026-2787",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2787"
},
{
"name": "CVE-2026-2772",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2772"
},
{
"name": "CVE-2026-2798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2798"
},
{
"name": "CVE-2026-2803",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2803"
},
{
"name": "CVE-2026-2805",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2805"
},
{
"name": "CVE-2026-2780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2780"
},
{
"name": "CVE-2026-2782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2782"
},
{
"name": "CVE-2026-2766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2766"
},
{
"name": "CVE-2026-2796",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2796"
},
{
"name": "CVE-2026-2800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2800"
},
{
"name": "CVE-2026-2774",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2774"
},
{
"name": "CVE-2026-2801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2801"
},
{
"name": "CVE-2026-2785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2785"
},
{
"name": "CVE-2026-2634",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2634"
},
{
"name": "CVE-2026-2757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2757"
},
{
"name": "CVE-2026-2761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2761"
},
{
"name": "CVE-2026-2793",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2793"
},
{
"name": "CVE-2026-2804",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2804"
},
{
"name": "CVE-2026-2795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2795"
},
{
"name": "CVE-2026-2767",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2767"
}
],
"initial_release_date": "2026-02-25T00:00:00",
"last_revision_date": "2026-02-25T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0204",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-02-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-14",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-14/"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-15",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-15/"
},
{
"published_at": "2026-02-20",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-12",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-12/"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-13",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-13/"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-17",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-17/"
},
{
"published_at": "2026-02-24",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-16",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-16/"
}
]
}
CVE-2026-2789 (GCVE-0-2026-2789)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the Graphics: ImageLib component
Summary
Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:39.046Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2015179"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the Graphics: ImageLib component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2789",
"datePublished": "2026-02-24T13:33:20.961Z",
"dateReserved": "2026-02-19T15:06:31.096Z",
"dateUpdated": "2026-02-24T17:30:39.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2757 (GCVE-0-2026-2757)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Incorrect boundary conditions in the WebRTC: Audio/Video component
Summary
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Igor Morgenstern
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Igor Morgenstern"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:13.158Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2001637"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Incorrect boundary conditions in the WebRTC: Audio/Video component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2757",
"datePublished": "2026-02-24T13:32:57.740Z",
"dateReserved": "2026-02-19T15:05:16.301Z",
"dateUpdated": "2026-02-24T17:30:13.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2759 (GCVE-0-2026-2759)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-02-25 13:43
VLAI?
EPSS
Title
Incorrect boundary conditions in the Graphics: ImageLib component
Summary
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Steven Julian
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Steven Julian"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T13:43:55.454Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010933"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Incorrect boundary conditions in the Graphics: ImageLib component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2759",
"datePublished": "2026-02-24T13:32:59.173Z",
"dateReserved": "2026-02-19T15:05:20.862Z",
"dateUpdated": "2026-02-25T13:43:55.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2763 (GCVE-0-2026-2763)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript Engine component
Summary
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:19.018Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012018"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript Engine component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2763",
"datePublished": "2026-02-24T13:33:02.514Z",
"dateReserved": "2026-02-19T15:05:29.821Z",
"dateUpdated": "2026-02-24T17:30:19.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2760 (GCVE-0-2026-2760)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
Summary
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Oskar L
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Oskar L"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:15.098Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011062"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2760",
"datePublished": "2026-02-24T13:33:00.290Z",
"dateReserved": "2026-02-19T15:05:23.107Z",
"dateUpdated": "2026-02-24T17:30:15.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2782 (GCVE-0-2026-2782)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:18
VLAI?
EPSS
Title
Privilege escalation in the Netmonitor component
Summary
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
8.8 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Cody
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2782",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:55:58.916536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:18:22.886Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Cody"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Netmonitor component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Privilege escalation in the Netmonitor component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:33.383Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010743"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Privilege escalation in the Netmonitor component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2782",
"datePublished": "2026-02-24T13:33:16.262Z",
"dateReserved": "2026-02-19T15:06:15.435Z",
"dateUpdated": "2026-02-25T17:18:22.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2767 (GCVE-0-2026-2767)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript: WebAssembly component
Summary
Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Sajeeb Lohani
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:20.889Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013741"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript: WebAssembly component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2767",
"datePublished": "2026-02-24T13:33:05.551Z",
"dateReserved": "2026-02-19T15:05:39.633Z",
"dateUpdated": "2026-02-24T17:30:20.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2790 (GCVE-0-2026-2790)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Same-origin policy bypass in the Networking: JAR component
Summary
Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Surya Dev Singh
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Surya Dev Singh"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:39.461Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2008426"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Same-origin policy bypass in the Networking: JAR component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2790",
"datePublished": "2026-02-24T13:33:21.600Z",
"dateReserved": "2026-02-19T15:06:33.357Z",
"dateUpdated": "2026-02-24T17:30:39.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2795 (GCVE-0-2026-2795)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript: GC component
Summary
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
x0e
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "x0e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:41.221Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010940"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Use-after-free in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2795",
"datePublished": "2026-02-24T13:33:26.111Z",
"dateReserved": "2026-02-19T15:06:41.117Z",
"dateUpdated": "2026-02-24T17:30:41.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2762 (GCVE-0-2026-2762)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Integer overflow in the JavaScript: Standard Library component
Summary
Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
André Bargull
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andr\u00e9 Bargull"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:16.322Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011649"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Integer overflow in the JavaScript: Standard Library component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2762",
"datePublished": "2026-02-24T13:33:01.761Z",
"dateReserved": "2026-02-19T15:05:27.383Z",
"dateUpdated": "2026-02-24T17:30:16.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2792 (GCVE-0-2026-2792)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:47
VLAI?
EPSS
Title
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Summary
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
9.8 (Critical)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Andrew McCreight, Maurice Dauer, Olli Pettay, Ryan Hunt
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2792",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:55:57.483447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:47:39.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andrew McCreight, Maurice Dauer, Olli Pettay, Ryan Hunt"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:40.473Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"name": "Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2008912%2C2010050%2C2010275%2C2012331"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2792",
"datePublished": "2026-02-24T13:33:22.842Z",
"dateReserved": "2026-02-19T15:06:37.841Z",
"dateUpdated": "2026-02-25T17:47:39.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2784 (GCVE-0-2026-2784)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Mitigation bypass in the DOM: Security component
Summary
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
D. Santos
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "D. Santos"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:36.359Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012984"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Mitigation bypass in the DOM: Security component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2784",
"datePublished": "2026-02-24T13:33:17.554Z",
"dateReserved": "2026-02-19T15:06:19.739Z",
"dateUpdated": "2026-02-24T17:30:36.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2794 (GCVE-0-2026-2794)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 13:44
VLAI?
EPSS
Title
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android
Summary
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability affects Firefox < 148.
Severity ?
No CVSS data available.
Assigner
References
Credits
Steven Julian
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Steven Julian"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability affects Firefox \u003c 148."
}
],
"value": "Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability affects Firefox \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T13:44:05.439Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2008365"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
}
],
"title": "Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2794",
"datePublished": "2026-02-24T13:33:25.399Z",
"dateReserved": "2026-02-19T15:06:38.903Z",
"dateUpdated": "2026-02-25T13:44:05.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2805 (GCVE-0-2026-2805)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Invalid pointer in the DOM: Core & HTML component
Summary
Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Invalid pointer in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:45.766Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014549"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Invalid pointer in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2805",
"datePublished": "2026-02-24T13:33:32.768Z",
"dateReserved": "2026-02-19T15:07:03.616Z",
"dateUpdated": "2026-02-24T17:30:45.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2771 (GCVE-0-2026-2771)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Undefined behavior in the DOM: Core & HTML component
Summary
Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Undefined behavior in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Undefined behavior in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:25.709Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014593"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Undefined behavior in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2771",
"datePublished": "2026-02-24T13:33:08.538Z",
"dateReserved": "2026-02-19T15:05:48.804Z",
"dateUpdated": "2026-02-24T17:30:25.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2788 (GCVE-0-2026-2788)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Incorrect boundary conditions in the Audio/Video: GMP component
Summary
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:38.598Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014824"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Incorrect boundary conditions in the Audio/Video: GMP component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2788",
"datePublished": "2026-02-24T13:33:20.287Z",
"dateReserved": "2026-02-19T15:06:29.079Z",
"dateUpdated": "2026-02-24T17:30:38.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2766 (GCVE-0-2026-2766)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript Engine: JIT component
Summary
Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:20.471Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013583"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2766",
"datePublished": "2026-02-24T13:33:04.946Z",
"dateReserved": "2026-02-19T15:05:37.180Z",
"dateUpdated": "2026-02-24T17:30:20.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2791 (GCVE-0-2026-2791)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Mitigation bypass in the Networking: Cache component
Summary
Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:40.073Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2015220"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Mitigation bypass in the Networking: Cache component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2791",
"datePublished": "2026-02-24T13:33:22.237Z",
"dateReserved": "2026-02-19T15:06:35.590Z",
"dateUpdated": "2026-02-24T17:30:40.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2765 (GCVE-0-2026-2765)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript Engine component
Summary
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:20.086Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013562"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript Engine component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2765",
"datePublished": "2026-02-24T13:33:03.943Z",
"dateReserved": "2026-02-19T15:05:35.131Z",
"dateUpdated": "2026-02-24T17:30:20.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2803 (GCVE-0-2026-2803)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Information disclosure, mitigation bypass in the Settings UI component
Summary
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Skywarp
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Skywarp"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:44.561Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012012"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Information disclosure, mitigation bypass in the Settings UI component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2803",
"datePublished": "2026-02-24T13:33:31.491Z",
"dateReserved": "2026-02-19T15:06:58.944Z",
"dateUpdated": "2026-02-24T17:30:44.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2783 (GCVE-0-2026-2783)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
Summary
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
x0e
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "x0e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:35.131Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010943"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2783",
"datePublished": "2026-02-24T13:33:16.921Z",
"dateReserved": "2026-02-19T15:06:17.478Z",
"dateUpdated": "2026-02-24T17:30:35.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2761 (GCVE-0-2026-2761)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Sandbox escape in the Graphics: WebRender component
Summary
Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Oskar L
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Oskar L"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:15.523Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011063"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Sandbox escape in the Graphics: WebRender component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2761",
"datePublished": "2026-02-24T13:33:01.011Z",
"dateReserved": "2026-02-19T15:05:25.145Z",
"dateUpdated": "2026-02-24T17:30:15.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2758 (GCVE-0-2026-2758)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:32 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript: GC component
Summary
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Gary Kwong
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Gary Kwong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:14.017Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009608"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2758",
"datePublished": "2026-02-24T13:32:58.501Z",
"dateReserved": "2026-02-19T15:05:18.397Z",
"dateUpdated": "2026-02-24T17:30:14.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2764 (GCVE-0-2026-2764)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
Summary
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:19.453Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012608"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "JIT miscompilation, use-after-free in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2764",
"datePublished": "2026-02-24T13:33:03.207Z",
"dateReserved": "2026-02-19T15:05:32.669Z",
"dateUpdated": "2026-02-24T17:30:19.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2770 (GCVE-0-2026-2770)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the DOM: Bindings (WebIDL) component
Summary
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:22.805Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014585"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the DOM: Bindings (WebIDL) component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2770",
"datePublished": "2026-02-24T13:33:07.898Z",
"dateReserved": "2026-02-19T15:05:46.768Z",
"dateUpdated": "2026-02-24T17:30:22.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2800 (GCVE-0-2026-2800)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Spoofing issue in the WebAuthn component in Firefox for Android
Summary
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
hafiizh & kang ali
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "hafiizh \u0026 kang ali"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:43.309Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1988145"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Spoofing issue in the WebAuthn component in Firefox for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2800",
"datePublished": "2026-02-24T13:33:29.312Z",
"dateReserved": "2026-02-19T15:06:52.343Z",
"dateUpdated": "2026-02-24T17:30:43.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2804 (GCVE-0-2026-2804)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript: WebAssembly component
Summary
Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
5.4 (Medium)
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Information to follow
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T15:55:39.007594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T15:56:04.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:44.942Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013584"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Use-after-free in the JavaScript: WebAssembly component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2804",
"datePublished": "2026-02-24T13:33:32.144Z",
"dateReserved": "2026-02-19T15:07:01.585Z",
"dateUpdated": "2026-02-24T17:30:44.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2768 (GCVE-0-2026-2768)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Sandbox escape in the Storage: IndexedDB component
Summary
Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Sajeeb Lohani
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:21.281Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014101"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Sandbox escape in the Storage: IndexedDB component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2768",
"datePublished": "2026-02-24T13:33:06.258Z",
"dateReserved": "2026-02-19T15:05:41.880Z",
"dateUpdated": "2026-02-24T17:30:21.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2773 (GCVE-0-2026-2773)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Incorrect boundary conditions in the Web Audio component
Summary
Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:26.682Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014832"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Incorrect boundary conditions in the Web Audio component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2773",
"datePublished": "2026-02-24T13:33:10.177Z",
"dateReserved": "2026-02-19T15:05:53.926Z",
"dateUpdated": "2026-02-24T17:30:26.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2799 (GCVE-0-2026-2799)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the DOM: Core & HTML component
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:42.844Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014551"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2799",
"datePublished": "2026-02-24T13:33:28.665Z",
"dateReserved": "2026-02-19T15:06:49.658Z",
"dateUpdated": "2026-02-24T17:30:42.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2802 (GCVE-0-2026-2802)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Race condition in the JavaScript: GC component
Summary
Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
4.2 (Medium)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Gary Kwong
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T15:56:29.941950Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T15:56:58.815Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Gary Kwong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Race condition in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Race condition in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:44.158Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2011069"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Race condition in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2802",
"datePublished": "2026-02-24T13:33:30.784Z",
"dateReserved": "2026-02-19T15:06:56.714Z",
"dateUpdated": "2026-02-24T17:30:44.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2776 (GCVE-0-2026-2776)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
Summary
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Sajeeb Lohani
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:28.178Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2015266"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2776",
"datePublished": "2026-02-24T13:33:12.247Z",
"dateReserved": "2026-02-19T15:06:01.828Z",
"dateUpdated": "2026-02-24T17:30:28.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2772 (GCVE-0-2026-2772)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the Audio/Video: Playback component
Summary
Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:26.169Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014827"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the Audio/Video: Playback component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2772",
"datePublished": "2026-02-24T13:33:09.181Z",
"dateReserved": "2026-02-19T15:05:51.470Z",
"dateUpdated": "2026-02-24T17:30:26.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2778 (GCVE-0-2026-2778)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
Summary
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Sajeeb Lohani
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:29.886Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2016358"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2778",
"datePublished": "2026-02-24T13:33:13.564Z",
"dateReserved": "2026-02-19T15:06:06.469Z",
"dateUpdated": "2026-02-24T17:30:29.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2807 (GCVE-0-2026-2807)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:47
VLAI?
EPSS
Title
Memory safety bugs fixed in Firefox 148 and Thunderbird 148
Summary
Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
9.8 (Critical)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Agi Sferro, Andrew McCreight, Randell Jesup, Tom Schuster
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2807",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:55:41.912370Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:47:40.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Agi Sferro, Andrew McCreight, Randell Jesup, Tom Schuster"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:46.576Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"name": "Memory safety bugs fixed in Firefox 148 and Thunderbird 148",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1756056%2C1999402%2C2004872%2C2006037%2C2012855"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Memory safety bugs fixed in Firefox 148 and Thunderbird 148"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2807",
"datePublished": "2026-02-24T13:33:34.035Z",
"dateReserved": "2026-02-19T15:07:07.640Z",
"dateUpdated": "2026-02-25T17:47:40.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2780 (GCVE-0-2026-2780)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:19
VLAI?
EPSS
Title
Privilege escalation in the Netmonitor component
Summary
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
8.8 (High)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
RyotaK
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2780",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:56:05.296618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:19:00.644Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Netmonitor component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Privilege escalation in the Netmonitor component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:31.960Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2007829"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Privilege escalation in the Netmonitor component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2780",
"datePublished": "2026-02-24T13:33:14.850Z",
"dateReserved": "2026-02-19T15:06:11.352Z",
"dateUpdated": "2026-02-25T17:19:00.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2796 (GCVE-0-2026-2796)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
JIT miscompilation in the JavaScript: WebAssembly component
Summary
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:41.643Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013165"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "JIT miscompilation in the JavaScript: WebAssembly component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2796",
"datePublished": "2026-02-24T13:33:26.775Z",
"dateReserved": "2026-02-19T15:06:43.289Z",
"dateUpdated": "2026-02-24T17:30:41.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2779 (GCVE-0-2026-2779)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Incorrect boundary conditions in the Networking: JAR component
Summary
Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Alex Mayorga
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Alex Mayorga"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:31.538Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1164141"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Incorrect boundary conditions in the Networking: JAR component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2779",
"datePublished": "2026-02-24T13:33:14.195Z",
"dateReserved": "2026-02-19T15:06:08.909Z",
"dateUpdated": "2026-02-24T17:30:31.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2634 (GCVE-0-2026-2634)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 13:33
VLAI?
EPSS
Title
Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS
Summary
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability affects Firefox for iOS < 147.4.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Firefox for iOS |
Affected:
unspecified , < 147.4
(custom)
|
Credits
Renwa
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox for iOS",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "147.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Renwa"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability affects Firefox for iOS \u003c 147.4."
}
],
"value": "Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability affects Firefox for iOS \u003c 147.4."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T13:33:24.725Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1975529"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-12/"
}
],
"title": "Spoofed web content presented under trusted domains using scripted navigation on Firefox iOS"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2634",
"datePublished": "2026-02-24T13:33:24.725Z",
"dateReserved": "2026-02-17T18:31:35.581Z",
"dateUpdated": "2026-02-24T13:33:24.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2769 (GCVE-0-2026-2769)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the Storage: IndexedDB component
Summary
Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
8.8 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T14:20:50.862453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:21:09.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:21.670Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014550"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the Storage: IndexedDB component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2769",
"datePublished": "2026-02-24T13:33:06.912Z",
"dateReserved": "2026-02-19T15:05:44.343Z",
"dateUpdated": "2026-02-24T17:30:21.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2787 (GCVE-0-2026-2787)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the DOM: Window and Location component
Summary
Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:38.135Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014560"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the DOM: Window and Location component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2787",
"datePublished": "2026-02-24T13:33:19.579Z",
"dateReserved": "2026-02-19T15:06:26.851Z",
"dateUpdated": "2026-02-24T17:30:38.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2806 (GCVE-0-2026-2806)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Uninitialized memory in the Graphics: Text component
Summary
Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Zijie Zhao
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Zijie Zhao"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:46.157Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2006199"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Uninitialized memory in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2806",
"datePublished": "2026-02-24T13:33:33.407Z",
"dateReserved": "2026-02-19T15:07:05.634Z",
"dateUpdated": "2026-02-24T17:30:46.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2777 (GCVE-0-2026-2777)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:46
VLAI?
EPSS
Title
Privilege escalation in the Messaging System component
Summary
Privilege escalation in the Messaging System component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
9.8 (Critical)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Richard Belisle
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2777",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:56:06.730737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:46:32.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Richard Belisle"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the Messaging System component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Privilege escalation in the Messaging System component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:28.615Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2015305"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Privilege escalation in the Messaging System component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2777",
"datePublished": "2026-02-24T13:33:12.869Z",
"dateReserved": "2026-02-19T15:06:03.824Z",
"dateUpdated": "2026-02-25T17:46:32.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2785 (GCVE-0-2026-2785)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Invalid pointer in the JavaScript Engine component
Summary
Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:37.096Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013549"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Invalid pointer in the JavaScript Engine component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2785",
"datePublished": "2026-02-24T13:33:18.254Z",
"dateReserved": "2026-02-19T15:06:21.995Z",
"dateUpdated": "2026-02-24T17:30:37.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2775 (GCVE-0-2026-2775)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Mitigation bypass in the DOM: HTML Parser component
Summary
Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:27.752Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2015199"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Mitigation bypass in the DOM: HTML Parser component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2775",
"datePublished": "2026-02-24T13:33:11.553Z",
"dateReserved": "2026-02-19T15:05:58.825Z",
"dateUpdated": "2026-02-24T17:30:27.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2797 (GCVE-0-2026-2797)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript: GC component
Summary
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:42.064Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013561"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Use-after-free in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2797",
"datePublished": "2026-02-24T13:33:27.406Z",
"dateReserved": "2026-02-19T15:06:45.386Z",
"dateUpdated": "2026-02-24T17:30:42.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2774 (GCVE-0-2026-2774)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Integer overflow in the Audio/Video component
Summary
Integer overflow in the Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow in the Audio/Video component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Integer overflow in the Audio/Video component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:27.312Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014883"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Integer overflow in the Audio/Video component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2774",
"datePublished": "2026-02-24T13:33:10.821Z",
"dateReserved": "2026-02-19T15:05:56.372Z",
"dateUpdated": "2026-02-24T17:30:27.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2793 (GCVE-0-2026-2793)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-25 17:47
VLAI?
EPSS
Title
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Summary
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
9.8 (Critical)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
Credits
Andrew McCreight, Christian Holler
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2793",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-25T04:55:55.876404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T17:47:40.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "115.33",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Andrew McCreight, Christian Holler"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 115.33, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:40.827Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"name": "Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148",
"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2015196%2C2016423%2C2016498"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2793",
"datePublished": "2026-02-24T13:33:23.571Z",
"dateReserved": "2026-02-19T15:06:38.377Z",
"dateUpdated": "2026-02-25T17:47:40.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2798 (GCVE-0-2026-2798)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 18:25
VLAI?
EPSS
Title
Use-after-free in the DOM: Core & HTML component
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
8.8 (High)
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Sajeeb Lohani
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-2798",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-24T18:24:51.747768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T18:25:31.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Sajeeb Lohani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:42.470Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014136"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2798",
"datePublished": "2026-02-24T13:33:28.034Z",
"dateReserved": "2026-02-19T15:06:47.628Z",
"dateUpdated": "2026-02-24T18:25:31.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2781 (GCVE-0-2026-2781)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Integer overflow in the Libraries component in NSS
Summary
Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Clay Ver Valen
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Clay Ver Valen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:32.527Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009552"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Integer overflow in the Libraries component in NSS"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2781",
"datePublished": "2026-02-24T13:33:15.551Z",
"dateReserved": "2026-02-19T15:06:13.592Z",
"dateUpdated": "2026-02-24T17:30:32.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2786 (GCVE-0-2026-2786)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Use-after-free in the JavaScript Engine component
Summary
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||||||||||||
|
|||||||||||||||||||
Credits
Information to follow
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Information to follow"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"value": "Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u003c 148, Firefox ESR \u003c 140.8, Thunderbird \u003c 148, and Thunderbird \u003c 140.8."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:37.620Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013612"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
}
],
"title": "Use-after-free in the JavaScript Engine component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2786",
"datePublished": "2026-02-24T13:33:18.980Z",
"dateReserved": "2026-02-19T15:06:24.424Z",
"dateUpdated": "2026-02-24T17:30:37.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2801 (GCVE-0-2026-2801)
Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-02-24 17:30
VLAI?
EPSS
Title
Incorrect boundary conditions in the JavaScript: WebAssembly component
Summary
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Affected:
unspecified , < 148
(custom)
|
|||||||
|
|||||||||
Credits
Kanaru Sato
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "148",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Kanaru Sato"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"value": "Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u003c 148 and Thunderbird \u003c 148."
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T17:30:43.776Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009901"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
}
],
"title": "Incorrect boundary conditions in the JavaScript: WebAssembly component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-2801",
"datePublished": "2026-02-24T13:33:29.929Z",
"dateReserved": "2026-02-19T15:06:54.497Z",
"dateUpdated": "2026-02-24T17:30:43.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…