This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox (ESR) and Thunderbird (ESR) fix 5 vulnerabilities

Mozilla fixes 5 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 150.0.2 [1] Firefox ESR - 140.10.2, 115.35.2 [2][3] Thunderbird - 150.0.2 [4] Thunderbird ESR - 140.10.2 [5]

Mozilla Firefox, Firefox ESR, Thunderbird - incorrect memory handling (CVE-2026-8092)
CVSS 8.1 (High)

An unauthenticated remote attacker is able to exploit a memory handling flaw, which under certain circumstances may lead to code execution [1][2][3][4][5]

The vulnerability is present in products:

  • Mozilla Thunderbird; >=150.0.0, <150.0.2;
  • Mozilla Firefox ESR; >=115.35.0, <115.35.2; >=140.10.0, <140.10.2;
  • Mozilla Firefox; >=150.0.0, <150.0.2;
  • Mozilla Thunderbird ESR; >=140.10.0, <140.10.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 8. 5. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird - use-after-free (CVE-2026-8090)
CVSS 7.3 (High)

An unauthenticated remote attacker is able to access memory that has already been freed, which could potentially cause unauthorized reading or writing of data and denial of service [1][2][3][4][5].

The vulnerability is present in products:

  • Mozilla Thunderbird; >=150.0.0, <150.0.2;
  • Mozilla Firefox ESR; >=115.35.0, <115.35.2; >=140.10.0, <140.10.2;
  • Mozilla Firefox; >=150.0.0, <150.0.2;
  • Mozilla Thunderbird ESR; >=140.10.0, <140.10.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 8. 5. 2026.

By CESNET, z.s.p.o. Martin Krajči on 11. 5. 2026.

CESNET, z.s.p.o. Logo