Mozilla Foundation Security Advisory 2026-40

#CVE-2026-8090: Use-after-free in the DOM: Networking component

Reporter

Kevin Brosnan

Impact

high

References

• Bug 2034352

#CVE-2026-8092: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2

Reporter

Andrew McCreight, Christian Holler, Lee Salzman, Maurice Dauer, Tom Schuster, Wayne Mery and the Mozilla Fuzzing Team

Impact

high

Description

Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2

#CVE-2026-8093: Memory safety bugs fixed in Firefox 150.0.2

Reporter

Andy Leiserson, Jan de Mooij, Michael Froman and the Mozilla Fuzzing Team

Impact

high

Description

Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

References

• Memory safety bugs fixed in Firefox 150.0.2