Executive brief
A security vulnerability exists in the IndexedDB storage component of Mozilla Firefox and Thunderbird. This component is responsible for storing large amounts of structured data in the browser. An attacker could exploit this flaw to potentially crash the application or execute unauthorized code, which could lead to the theft of sensitive user data or full system compromise.
Technical details
A use-after-free vulnerability was identified in the Storage: IndexedDB component of Mozilla browsers and mail clients. The flaw occurs when the application continues to use a memory pointer after it has been freed, typically during complex database operations. An attacker can exploit this by enticing a user to visit a specially crafted website or open a malicious email, leading to memory corruption. This can result in a stable crash or, in more sophisticated attacks, arbitrary code execution within the context of the application. The vulnerability is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and Thunderbird 148/140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory
- 2026-02-24: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014550
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338