This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 41 vulnerabilities
Mozilla fixes 41 vulnerabilities in various products. The most severe of them are listed below. Individual products and their fixed versions: Firefox - 150 [1] Firefox ESR - 140.10, 115.35 [2][3] Thunderbird - 150, 140.10 [4][5]
An unauthenticated remote attacker is able to access memory that has already been freed in the DOM and HTML document processing component, which may cause a data processing error and a subsequent application crash [1][2][3][4][5].
The vulnerability is present in products:
- Firefox; < 150
- Firefox ESR; >=115, < 115.35; >=140, < 140.10
- Thunderbird; >=140, < 140.10; < 150
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2026-6746 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 21. 4. 2026.
An unauthenticated remote attacker is able to execute code in the multimedia content processing component due to a flaw in the handling of uninitialized memory [1][2][3][4][5].
The vulnerability is present in products:
- Firefox; < 150
- Firefox ESR; >=115, < 115.35; >=140, < 140.10
- Thunderbird; >=140, < 140.10; < 150
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6748 at cve.org, NVD
- CWE-457: Use of Uninitialized Variable at cwe.mitre.org
The vulnerability was publicly disclosed 21. 4. 2026.
An unauthenticated remote attacker is able to escalate their access privileges in the system without authorization via the web content rendering component [1][2][3][4][5].
The vulnerability is present in products:
- Firefox; < 150
- Firefox ESR; >=115, < 115.35; >=140, < 140.10
- Thunderbird; >=140, < 140.10; < 150
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6750 at cve.org, NVD
- CWE-269: Improper Privilege Management at cwe.mitre.org
The vulnerability was publicly disclosed 21. 4. 2026.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2026-31/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/
- [4] https://www.mozilla.org/en-US/security/advisories/mfsa2026-33/
- [5] https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/
By CESNET, z.s.p.o. Henrieta Paločková on 24. 4. 2026.