CVE-2026-3845
Heap Buffer Overflow in Firefox Android Playback Component
Publication date: 2026-03-10
Last updated on: 2026-04-13
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | to 148.0.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3845 is a high-impact security vulnerability found in the Audio/Video Playback component of Firefox for Android versions prior to 148.0.2.
It is a heap buffer overflow, which means that the program writes more data to a buffer located in the heap than it is allocated to hold, potentially corrupting memory.
This overflow can be exploited by an attacker to execute arbitrary code by taking advantage of the memory corruption in the affected component.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an attacker to execute arbitrary code on the affected device.
Successful exploitation could lead to unauthorized control over the Firefox browser on Android, potentially compromising user data, privacy, and device security.
Because it involves memory corruption, it could also lead to crashes or instability in the browser.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Firefox for Android to version 148.0.2 or later, as this version contains the fix for the heap buffer overflow in the Audio/Video Playback component.
Applying this update will also address other high-impact vulnerabilities and improve the overall security and stability of Firefox.