Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
The vulnerability results from the presence of errors related to improper memory management, including buffer overflows. Some of the detected errors leave traces indicating actual memory corruption of the process. According to Mozilla's assessment, with sufficient effort these errors could be exploited to execute arbitrary code in the context of the vulnerable application.
An attacker can cause arbitrary code execution (RCE) on the victim's system, which may result in complete takeover of the application or system. Due to the network vector (AV:N) and lack of required privileges (PR:N, UI:N), the attack can be conducted remotely without user interaction.
Mozilla Firefox should be updated to version 149 and Mozilla Thunderbird to version 149, in which the vulnerability has been fixed. Details available in Mozilla security advisories: mfsa2026-20 and mfsa2026-23.
Mozilla Firefox 148 and Mozilla Thunderbird 148
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMozilla Firefox
APPMozilla< 149.0Mozilla Thunderbird
APPMozilla< 149.0
Related vulnerabilities
Use-after-free w Animation timelines Firefox/Thunderbird — RCE
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escap...
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes ...
Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before...
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we ...