CVE-2026-8094: Mozilla Firefox and Thunderbird code injection in WebRTC

CVE-2026-8094 · Severity: critical · CVSS 9.8 · Published 2026-05-07

A critical security vulnerability has been identified in the WebRTC component of Mozilla Firefox and Thunderbird, which are widely used for web browsing and email communication. This flaw could allow a remote attacker to execute unauthorized code or gain control over an affected system. While Thunderbird users are generally protected when reading standard emails, the risk remains high in browser-like contexts or if malicious scripts are executed.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird. Vendors: Mozilla.

Quick answers

Is CVE-2026-8094 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8094 being exploited in the wild.
How severe is CVE-2026-8094?
Critical severity, with a CVSS score of 9.8, published 7 May 2026.
Which products and versions are affected?
Mozilla Firefox ESR < 140.10.2, up to (excluding) 140.10.2; Mozilla Thunderbird < 140.10.2.
Is there a fix for CVE-2026-8094?
A patch was published on 2026-05-07: Fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8094 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8094?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR or Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as a code injection issue (CWE-94) within the WebRTC component of Mozilla products. The flaw allows for improper control of code generation, which can be leveraged by a remote, unauthenticated attacker to execute arbitrary code on the target system. The attack vector is network-based and, according to CISA-ADP, does not require user interaction or elevated privileges, resulting in a CVSS score of 9.8. Mozilla has addressed this in Firefox ESR 140.10.2 and Thunderbird 140.10.2. Red Hat has also released corresponding updates for various Enterprise Linux versions.

Affected products

  • Mozilla Firefox ESR < 140.10.2
  • Mozilla Thunderbird < 140.10.2
  • Red Hat Enterprise Linux 8, 9, 10

Timeline

  • 2026-05-07: advisory: Mozilla Foundation Security Advisory 2026-41 published
  • 2026-05-07: patched: Fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2
  • 2026-05-19: advisory: Red Hat security advisory RHSA-2026:19160 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.