CVE-2026-8092
Memory Corruption in Firefox ESR and Firefox
Publication date: 2026-05-07
Last updated on: 2026-05-18
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | From 150.0 (inc) to 150.0.2 (exc) |
| mozilla | firefox | to 115.35.2 (exc) |
| mozilla | firefox | From 140.0 (inc) to 140.10.2 (exc) |
| mozilla | thunderbird | From 150.0 (inc) to 150.0.2 (exc) |
| mozilla | thunderbird | From 140.0 (inc) to 140.10.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-8092 affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.
Can you explain this vulnerability to me?
CVE-2026-8092 is a security vulnerability in certain versions of Firefox (ESR 115.35.1, ESR 140.10.1, and 150.0.1) involving memory safety bugs.
These bugs can cause memory corruption, which means the program might behave unpredictably or incorrectly due to improper handling of memory.
Mozilla presumes that with enough effort, attackers could exploit these bugs to run arbitrary code on the affected systems.
The vulnerability was fixed in later versions: Firefox ESR 115.35.2, ESR 140.10.2, and Firefox 150.0.2.
How can this vulnerability impact me? :
This vulnerability could allow an attacker to execute arbitrary code on your system if you are using an affected version of Firefox.
Exploiting memory corruption bugs can lead to unauthorized control over the affected device, potentially compromising your data and system integrity.
Using a fixed version of Firefox (115.35.2, 140.10.2, or 150.0.2 and later) mitigates this risk.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Firefox to a fixed version.
- Upgrade Firefox ESR to version 115.35.2 or later.
- Upgrade Firefox ESR to version 140.10.2 or later.
- Upgrade Firefox to version 150.0.2 or later.