Junglewise Threat Intelligence

CVE-2026-8974: Mozilla Firefox memory safety bugs in Firefox and Firefox ESR

CVE-2026-8974 · Severity: info · Published 2026-05-19

Technologies: Mozilla Firefox ESR, Mozilla Firefox. Vendors: Mozilla.

Executive brief

Mozilla has released security updates to address multiple memory safety vulnerabilities in the Firefox and Firefox ESR web browsers. These flaws could allow an attacker to corrupt the browser's memory, potentially leading to the execution of unauthorized code on a user's system. Such an exploit could result in the theft of sensitive data, unauthorized access to accounts, or the installation of malicious software if a user visits a specially crafted website.

Technical details

Mozilla developers and community members reported several memory safety bugs in Firefox 150 and Firefox ESR 140.10. These vulnerabilities encompass various memory corruption issues that, while not individually detailed, are presumed to be exploitable for arbitrary code execution given sufficient effort. The attack vector typically involves a user navigating to a malicious webpage that triggers the memory corruption. The vulnerabilities were addressed by improving memory handling and safety checks in the browser engine. Users are advised to update to Firefox 151 or Firefox ESR 140.11 to mitigate these risks.

Affected products

  • Mozilla Firefox ESR 140.10
  • Mozilla Firefox 150

Timeline

  • 2026-05-19: advisory: Mozilla Foundation Security Advisory MFSA2026-46 and MFSA2026-48 published.
  • 2026-05-19: patched: Fixed in Firefox 151 and Firefox ESR 140.11.

References

Related threats