Executive brief
A critical vulnerability exists in the JavaScript engine used by Firefox and Thunderbird. This flaw could allow an attacker to execute malicious code or crash the application when a user visits a specially crafted website or opens a malicious email. Users should update to the latest versions of their browser and email client to protect their data and systems.
Technical details
A use-after-free (UAF) vulnerability exists in the JavaScript: GC component, specifically within the 'js::gc::PreWriteBarrierImpl' function. The root cause involves the use of move assignment on a hash table entry that is no longer live (effectively a 'use-after-destructor' scenario), which can lead to memory corruption when GC barrier wrappers assume the object state is valid. An attacker can exploit this via a network vector (e.g., malicious web content) without requiring special privileges or user interaction beyond visiting a site. The vulnerability was fixed by ensuring new entries are constructed in place. Affected versions include Firefox prior to 148, Firefox ESR prior to 115.33 and 140.8, and Thunderbird prior to 148 and 140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
- Red Hat Enterprise Linux Server (v. 7 ELS) affected
Timeline
- 2026-02-24: advisory: Mozilla Foundation Security Advisory published
- 2026-02-24: patched: Fixed in Firefox 148, ESR 115.33, and ESR 140.8
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2009608
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338