Executive brief
Mozilla Firefox and Thunderbird are affected by a critical security flaw in their JavaScript engine. This vulnerability could allow an attacker to execute malicious code or crash the application if a user visits a specially crafted website or interacts with malicious content. While Thunderbird's default settings mitigate this risk for emails by disabling scripts, the flaw still poses a significant risk during general web browsing or in other interactive contexts.
Technical details
A use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox and Thunderbird. The flaw is triggered when the engine attempts to access memory that has already been deallocated, typically during the execution of complex JavaScript. An attacker can exploit this by enticing a user to visit a malicious webpage, leading to memory corruption, application crashes, or arbitrary code execution within the context of the browser process. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. In Thunderbird, the risk is lower for standard email viewing as JavaScript is disabled by default in that context.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 140.8
- Mozilla Thunderbird < 148
- Mozilla Thunderbird ESR < 140.8
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory
- 2026-02-24: patched