Report feedback

An unauthenticated remote attacker can potentially execute arbitrary code or cause a denial of service (DoS) through a use-after-free vulnerability in the Layout: Scrolling and Overflow component of the Firefox browser [1][4].

The vulnerability is present in product:

• Firefox; >=147.0, <147.0.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

More information:

• CVE-2026-24869 at cve.org, NVD
• CWE-416: Use After Free at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2026.

An unauthenticated remote attacker can bypass an implemented security mitigation in the Privacy: Anti-Tracking component of the Firefox browser [1].

The vulnerability is present in product:

• Mozilla Firefox; >=147.0, <147.0.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

More information:

• CVE-2026-24868 at cve.org, NVD
• CWE-693: Protection Mechanism Failure at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2026.

An unauthenticated remote attacker can obtain decrypted content from partially encrypted emails in Thunderbird through CSS-based exfiltration in the HTML content of an email, by exploiting the fact that the user allows loading of remote content and requests decryption of an embedded OpenPGP part of the message [2][3].

The vulnerability is present in product:

• Thunderbird; >=147.0, <147.0.1; >= 140.7, <140.7.1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

More information:

• CVE-2026-0818 at cve.org, NVD
• CWE-116: Improper Encoding or Escaping of Output at cwe.mitre.org
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
• CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org

The vulnerability was publicly disclosed 27. 1. 2026.