Executive brief
Mozilla Firefox is a popular web browser used for accessing the internet. A security flaw was found in how the browser handles JAR files (a type of archive file), which could potentially allow an attacker to compromise the browser if a user visits a malicious website. This could lead to unauthorized access to data or the ability to run malicious code on the user's system.
Technical details
An integer overflow vulnerability was identified in the Networking: JAR component of Mozilla Firefox. The issue occurs during the handling of JAR (Java Archive) files within the networking stack. While specific root cause details are restricted in the associated Bugzilla report, integer overflows in such components typically lead to heap-based buffer overflows or other memory corruption primitives. An attacker could exploit this by enticing a user to visit a specially crafted webpage or download a malicious archive, potentially achieving arbitrary code execution within the context of the browser process. The vulnerability is resolved in Firefox 151 and Firefox ESR 140.11.
Affected products
- Mozilla Firefox < 151
- Mozilla Firefox ESR < 140.11
Timeline
- 2026-05-19: disclosed
- 2026-05-19: patched
- 2026-05-19: advisory