Executive brief
Mozilla Firefox is a widely used web browser. A vulnerability was identified in its audio and video handling component, which could potentially allow an attacker to cause a crash or execute unauthorized actions when the browser processes malicious media content. This could lead to a compromise of the user's system or the theft of sensitive information.
Technical details
The vulnerability is classified as an 'incorrect boundary conditions' issue within the 'cubeb' component, which is Mozilla's cross-platform audio library used for audio/video playback. The flaw likely involves a buffer overflow or out-of-bounds access triggered during the processing of audio or video streams. An attacker could exploit this by enticing a user to visit a specially crafted website containing malicious media content. Successful exploitation could lead to memory corruption, potentially allowing for arbitrary code execution within the context of the browser process. The issue has been addressed in Firefox 153 and the corresponding Extended Support Releases (ESR).
Affected products
- Mozilla Firefox < 153
- Mozilla Firefox ESR < 115.38, < 140.13
Timeline
- 2026-07-21: advisory: Mozilla Foundation Security Advisory published.
- 2026-07-21: patched: Fixed in Firefox 153, ESR 115.38, and ESR 140.13.