Vulnerability-Lookup

OESA-2026-1540 (CVE-2026-2757)

Vulnerability from osv_openeuler – Published: 2026-03-06 11:10 – Updated: 2026-08-06 11:10 – Source website

Summary

thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2757)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2758)

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2759)

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2760)

Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2761)

Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2762)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2763)

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2764)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2765)

Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2766)

Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2767)

Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2768)

Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2769)

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2770)

Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2771)

Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2772)

Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2773)

Integer overflow in the Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2774)

Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2775)

Privilege escalation in the Messaging System component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2777)

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2778)

Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2779)

Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2781)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2782)

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2783)

Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2784)

Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2785)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2786)

Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2787)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2788)

Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2789)

Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2790)

Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2791)

Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2792)

Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2793)

Severity

10.0 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2757	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2758	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2759	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2760	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2761	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2762	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2763	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2764	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2765	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2766	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2767	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2768	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2769	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2770	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2771	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2772	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2773	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2774	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2775	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2777	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2778	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2779	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2781	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2782	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2783	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2784	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2785	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2786	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2787	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2788	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2789	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2790	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2791	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2792	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-2793	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "thunderbird-140.8.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-debuginfo-140.8.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-debugsource-140.8.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-librnp-rnp-140.8.0-1.oe2403sp3.aarch64.rpm",
          "thunderbird-wayland-140.8.0-1.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "thunderbird-140.8.0-1.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "thunderbird-140.8.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-debuginfo-140.8.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-debugsource-140.8.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-librnp-rnp-140.8.0-1.oe2403sp3.x86_64.rpm",
          "thunderbird-wayland-140.8.0-1.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "thunderbird",
        "purl": "pkg:rpm/openEuler/thunderbird\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.8.0-1.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nIncorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2757)\n\nUse-after-free in the JavaScript: GC component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2758)\n\nIncorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2759)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2760)\n\nSandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2761)\n\nInteger overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2762)\n\nUse-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2763)\n\nJIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2764)\n\nUse-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2765)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2766)\n\nUse-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2767)\n\nSandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2768)\n\nUse-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2769)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2770)\n\nUndefined behavior in the DOM: Core \u0026amp; HTML component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2771)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2772)\n\nIncorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2773)\n\nInteger overflow in the Audio/Video component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2774)\n\nMitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2775)\n\nPrivilege escalation in the Messaging System component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2777)\n\nSandbox escape due to incorrect boundary conditions in the DOM: Core \u0026amp; HTML component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2778)\n\nIncorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2779)\n\nInteger overflow in the Libraries component in NSS. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2781)\n\nPrivilege escalation in the Netmonitor component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2782)\n\nInformation disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2783)\n\nMitigation bypass in the DOM: Security component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2784)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2785)\n\nUse-after-free in the JavaScript Engine component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2786)\n\nUse-after-free in the DOM: Window and Location component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2787)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2788)\n\nUse-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2789)\n\nSame-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2790)\n\nMitigation bypass in the Networking: Cache component. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2791)\n\nMemory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2792)\n\nMemory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 148, Firefox ESR \u0026lt; 115.33, Firefox ESR \u0026lt; 140.8, Thunderbird \u0026lt; 148, and Thunderbird \u0026lt; 140.8.(CVE-2026-2793)",
  "id": "OESA-2026-1540",
  "modified": "2026-08-06T11:10:32Z",
  "published": "2026-03-06T11:10:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1540"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2757"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2758"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2759"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2760"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2761"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2762"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2763"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2764"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2765"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2766"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2767"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2768"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2769"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2770"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2771"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2772"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2773"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2774"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2775"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2777"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2778"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2779"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2781"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2782"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2783"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2784"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2785"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2786"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2787"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2788"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2789"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2790"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2791"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2792"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2793"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "thunderbird security update",
  "upstream": [
    "CVE-2026-2757",
    "CVE-2026-2758",
    "CVE-2026-2759",
    "CVE-2026-2760",
    "CVE-2026-2761",
    "CVE-2026-2762",
    "CVE-2026-2763",
    "CVE-2026-2764",
    "CVE-2026-2765",
    "CVE-2026-2766",
    "CVE-2026-2767",
    "CVE-2026-2768",
    "CVE-2026-2769",
    "CVE-2026-2770",
    "CVE-2026-2771",
    "CVE-2026-2772",
    "CVE-2026-2773",
    "CVE-2026-2774",
    "CVE-2026-2775",
    "CVE-2026-2777",
    "CVE-2026-2778",
    "CVE-2026-2779",
    "CVE-2026-2781",
    "CVE-2026-2782",
    "CVE-2026-2783",
    "CVE-2026-2784",
    "CVE-2026-2785",
    "CVE-2026-2786",
    "CVE-2026-2787",
    "CVE-2026-2788",
    "CVE-2026-2789",
    "CVE-2026-2790",
    "CVE-2026-2791",
    "CVE-2026-2792",
    "CVE-2026-2793"
  ]
}

CVE-2026-2778 (GCVE-0-2026-2778)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-07-15 01:13

Title

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Summary

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-28 03:17 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

34 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2016358
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://access.redhat.com/security/cve/CVE-2026-2778	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2442335	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:3984	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3976	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4260	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3361	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3338	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3515	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3492	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4432	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3491	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3980	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3495	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3979	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3494	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3493	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:4152	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3978	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3496	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3981	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3497	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3982	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3339	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3516	vendor-advisoryx_refsource_REDHAT

Impacted products

34 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:140.8.0-2.el10_1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:140.8.0-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:140.8.0-2.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:140.8.0-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:140.8.0-1.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:140.8.0-2.el8_2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:140.8.0-1.el8_2 , < * (rpm) cpe:/a:redhat:rhel_aus:8.2
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:140.8.0-2.el8_4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:140.8.0-2.el8_4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:140.8.0-2.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:140.8.0-1.el8_6 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:140.8.0-2.el8_6 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	Unaffected: 0:140.8.0-1.el8_6 , < * (rpm) cpe:/a:redhat:rhel_tus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:140.8.0-2.el8_6 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	Unaffected: 0:140.8.0-1.el8_6 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:140.8.0-2.el8_8 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:140.8.0-1.el8_8 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:140.8.0-2.el8_8 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:140.8.0-1.el8_8 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:140.8.0-2.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:140.8.0-1.el9_7 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:140.8.0-2.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	Unaffected: 0:140.8.0-1.el9_0 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.0
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:140.8.0-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:140.8.0-2.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:140.8.0-2.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:140.8.0-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:140.8.0-2.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:140.8.0-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7

Credits

Sajeeb Lohani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T03:17:17.791021Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:32:14.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.1"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el10_1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el7_9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.2"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el9_7",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.0"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el9_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-2.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:140.8.0-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10/firefox-flatpak",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10/thunderbird-flatpak",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "firefox",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "thunderbird",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-24T13:33:13.564Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component"
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:13:00.274Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-2778"
          },
          {
            "name": "RHBZ#2442335",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442335"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2778.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3984"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3976"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:4260"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3361"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3517"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3338"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3515"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3492"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:4432"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3491"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3980"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3495"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3979"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3494"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:4022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3493"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3983"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:4152"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3978"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3496"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3981"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3497"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3982"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3339"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:3516"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:3984: Red Hat Enterprise Linux Server (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3976: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:4260: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3361: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3517: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3338: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3515: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3492: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:4432: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3491: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3980: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3495: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3979: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3494: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:4022: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3493: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3983: Red Hat Enterprise Linux AppStream E4S (v.9.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:4152: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3978: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3496: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3981: Red Hat Enterprise Linux AppStream EUS (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3497: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3982: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3339: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:3516: Red Hat Enterprise Linux AppStream (v. 9)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-24T14:05:18.491Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-24T13:33:13.564Z",
            "value": "Made public."
          }
        ],
        "title": "firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Sajeeb Lohani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:53.411Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2016358"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the DOM: Core \u0026 HTML component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2778",
    "datePublished": "2026-02-24T13:33:13.564Z",
    "dateReserved": "2026-02-19T15:06:06.469Z",
    "dateUpdated": "2026-07-15T01:13:00.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2779 (GCVE-0-2026-2779)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-16 14:32

Title

Incorrect boundary conditions in the Networking: JAR component

Summary

Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-28 03:15 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1164141
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Alex Mayorga

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T03:15:18.517530Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:32:33.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Alex Mayorga"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:21.075Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1164141"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Incorrect boundary conditions in the Networking: JAR component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2779",
    "datePublished": "2026-02-24T13:33:14.195Z",
    "dateReserved": "2026-02-19T15:06:08.909Z",
    "dateUpdated": "2026-04-16T14:32:33.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2781 (GCVE-0-2026-2781)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-21 12:40

Title

Integer overflow in the Libraries component in NSS

Summary

Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:07 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

7 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2009552
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.35 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Clay Ver Valen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:07:29.760093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T20:07:34.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-25T16:26:01.616Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.35",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Clay Ver Valen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35."
            }
          ],
          "value": "Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T12:40:43.312Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2009552"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-31/"
        }
      ],
      "title": "Integer overflow in the Libraries component in NSS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2781",
    "datePublished": "2026-02-24T13:33:15.551Z",
    "dateReserved": "2026-02-19T15:06:13.592Z",
    "dateUpdated": "2026-04-21T12:40:43.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2782 (GCVE-0-2026-2782)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-13 13:53

Title

Privilege escalation in the Netmonitor component

Summary

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-25 04:55 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2010743
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Cody

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-25T04:55:58.916536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T14:44:08.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Cody"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:27.919Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010743"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Privilege escalation in the Netmonitor component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2782",
    "datePublished": "2026-02-24T13:33:16.262Z",
    "dateReserved": "2026-02-19T15:06:15.435Z",
    "dateUpdated": "2026-04-13T13:53:27.919Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2783 (GCVE-0-2026-2783)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-13 13:53

Title

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

Summary

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2010943
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

x0e

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:09:59.675929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T20:10:05.132Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "x0e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:30.360Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2010943"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2783",
    "datePublished": "2026-02-24T13:33:16.921Z",
    "dateReserved": "2026-02-19T15:06:17.478Z",
    "dateUpdated": "2026-04-13T13:53:30.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2784 (GCVE-0-2026-2784)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-16 14:32

Title

Mitigation bypass in the DOM: Security component

Summary

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-28 03:13 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2012984
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

D. Santos

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2784",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T03:13:23.268966Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-288",
                "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:32:57.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "D. Santos"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:34.499Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2012984"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Mitigation bypass in the DOM: Security component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2784",
    "datePublished": "2026-02-24T13:33:17.554Z",
    "dateReserved": "2026-02-19T15:06:19.739Z",
    "dateUpdated": "2026-04-16T14:32:57.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2785 (GCVE-0-2026-2785)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-13 13:53

Title

Invalid pointer in the JavaScript Engine component

Summary

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:06 UTC

CWE

CWE-824 - Access of Uninitialized Pointer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2013549
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2785",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:06:44.652338Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-824",
                "description": "CWE-824 Access of Uninitialized Pointer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T20:06:49.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:37.061Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013549"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Invalid pointer in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2785",
    "datePublished": "2026-02-24T13:33:18.254Z",
    "dateReserved": "2026-02-19T15:06:21.995Z",
    "dateUpdated": "2026-04-13T13:53:37.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2786 (GCVE-0-2026-2786)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-05-10 12:54

Title

Use-after-free in the JavaScript Engine component

Summary

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:03 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2013612
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:03:48.457816Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-10T12:54:19.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:53:40.663Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2013612"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Use-after-free in the JavaScript Engine component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2786",
    "datePublished": "2026-02-24T13:33:18.980Z",
    "dateReserved": "2026-02-19T15:06:24.424Z",
    "dateUpdated": "2026-05-10T12:54:19.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2787 (GCVE-0-2026-2787)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-13 13:52

Title

Use-after-free in the DOM: Window and Location component

Summary

Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 20:02 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2014560
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2787",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T20:02:37.287928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T20:02:41.330Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:56.351Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014560"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Use-after-free in the DOM: Window and Location component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2787",
    "datePublished": "2026-02-24T13:33:19.579Z",
    "dateReserved": "2026-02-19T15:06:26.851Z",
    "dateUpdated": "2026-04-13T13:52:56.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-2788 (GCVE-0-2026-2788)

Vulnerability from cvelistv5 – Published: 2026-02-24 13:33 – Updated: 2026-04-21 02:40

Title

Incorrect boundary conditions in the Audio/Video: GMP component

Summary

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-28 03:11 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 750 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2014824
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 115.33 , ≤ 115.* (rpm) Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 140.8 , ≤ 140.* (rpm) Unaffected: 148 , ≤ * (rpm)

Credits

Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-2788",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-28T03:11:58.735838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T02:40:29.432Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.33",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.8",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "148",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
            }
          ],
          "value": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T13:52:58.431Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014824"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-13/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-14/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-15/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-16/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-17/"
        }
      ],
      "title": "Incorrect boundary conditions in the Audio/Video: GMP component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-2788",
    "datePublished": "2026-02-24T13:33:20.287Z",
    "dateReserved": "2026-02-19T15:06:29.079Z",
    "dateUpdated": "2026-04-21T02:40:29.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-1540 (CVE-2026-2757)

CVE-2026-2778 (GCVE-0-2026-2778)

CVE-2026-2779 (GCVE-0-2026-2779)

CVE-2026-2781 (GCVE-0-2026-2781)

CVE-2026-2782 (GCVE-0-2026-2782)

CVE-2026-2783 (GCVE-0-2026-2783)

CVE-2026-2784 (GCVE-0-2026-2784)

CVE-2026-2785 (GCVE-0-2026-2785)

CVE-2026-2786 (GCVE-0-2026-2786)

CVE-2026-2787 (GCVE-0-2026-2787)

CVE-2026-2788 (GCVE-0-2026-2788)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour