Executive brief
Mozilla Firefox and Thunderbird are popular open-source web browsers and email clients used globally for internet browsing and communication. Multiple memory safety vulnerabilities have been identified that could allow an attacker to corrupt the application's memory. In a worst-case scenario, this could enable an attacker to take control of a user's computer or execute unauthorized commands simply by tricking the user into visiting a malicious website or opening a specially crafted email.
Technical details
This advisory covers a collection of memory safety bugs (CWE-787) identified within the Mozilla codebase. These vulnerabilities manifest as memory corruption issues in various components of the browser and mail client. An attacker could potentially exploit these flaws via a remote network vector, such as a malicious website or email, without requiring special privileges. If successfully exploited, these bugs could allow for arbitrary code execution within the context of the application. The vulnerabilities have been addressed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla web browser Thunderbird < 148
- Mozilla Thunderbird ESR < 140.8
Timeline
- 2026-02-24: disclosed
- 2026-02-24: advisory
- 2026-02-24: patched
References
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2015196%2C2016423%2C2016498
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338