CVE-2026-8092
Analyzed Analyzed - Analysis Complete
Memory Corruption in Firefox ESR and Firefox

Publication date: 2026-05-07

Last updated on: 2026-05-18

Assigner: Mozilla Corporation

Description
Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-07
Last Modified
2026-05-18
Generated
2026-06-17
AI Q&A
2026-05-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-8092
EUVD
EUVD-2026-28363
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
mozilla firefox From 150.0 (inc) to 150.0.2 (exc)
mozilla firefox to 115.35.2 (exc)
mozilla firefox From 140.0 (inc) to 140.10.2 (exc)
mozilla thunderbird From 150.0 (inc) to 150.0.2 (exc)
mozilla thunderbird From 140.0 (inc) to 140.10.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.

Compliance Impact

The provided information does not specify how CVE-2026-8092 affects compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-8092 is a security vulnerability in certain versions of Firefox (ESR 115.35.1, ESR 140.10.1, and 150.0.1) involving memory safety bugs.

These bugs can cause memory corruption, which means the program might behave unpredictably or incorrectly due to improper handling of memory.

Mozilla presumes that with enough effort, attackers could exploit these bugs to run arbitrary code on the affected systems.

The vulnerability was fixed in later versions: Firefox ESR 115.35.2, ESR 140.10.2, and Firefox 150.0.2.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code on your system if you are using an affected version of Firefox.

Exploiting memory corruption bugs can lead to unauthorized control over the affected device, potentially compromising your data and system integrity.

Using a fixed version of Firefox (115.35.2, 140.10.2, or 150.0.2 and later) mitigates this risk.

Mitigation Strategies

To mitigate this vulnerability, you should update Firefox to a fixed version.

  • Upgrade Firefox ESR to version 115.35.2 or later.
  • Upgrade Firefox ESR to version 140.10.2 or later.
  • Upgrade Firefox to version 150.0.2 or later.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8092. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart