Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 35

• Critical 9.8
  CVE-2026-8401

  Sandbox escape in the Profile Backup component

  Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026
• Critical 9.8
  CVE-2026-8956

  Integer overflow in the Networking: JAR component

  Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Critical 9.6
  CVE-2026-8953

  Sandbox escape due to use-after-free in the Disability Access APIs component

  Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Critical 9.6
  CVE-2026-8959

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• Critical 9.3
  CVE-2026-8950

  Same-origin policy bypass in the Networking: HTTP component

  Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Critical 9.1
  CVE-2026-8948

  Same-origin policy bypass in the DOM: Networking component

  Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8952

  Privilege escalation in the Application Update component

  Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8955

  Privilege escalation in the DOM: Workers component

  Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8957

  Privilege escalation in the Enterprise Policies component

  Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8970

  Privilege escalation in the Security component

  Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8972

  Privilege escalation in the WebRTC: Audio/Video component

  Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8973

  Memory safety bugs fixed in Thunderbird 151

  Memory safety bugs present in Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunde…

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8974

  Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

  Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.8
  CVE-2026-8975

  Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

  Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.6
  CVE-2026-8958

  Information disclosure, sandbox escape in the Security: Process Sandboxing component

  Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.1
  CVE-2026-8962

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 8.1
  CVE-2026-8969

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8945

  Sandbox escape in Firefox and Firefox Focus for Android

  Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8946

  Incorrect boundary conditions in the Audio/Video: Web Codecs component

  Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8949

  Integer overflow in the Widget: Win32 component

  Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8954

  Incorrect boundary conditions, integer overflow in the Audio/Video component

  Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8960

  Spoofing issue in WebExtensions

  Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8963

  Spoofing issue in the Web Speech component

  Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8964

  Spoofing issue in the Popup Blocker component

  Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8965

  Information disclosure in the DOM: Security component

  Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8966

  Information disclosure in the IP Protection component

  Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8967

  Information disclosure in the Graphics: WebGPU component

  Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• High 7.5
  CVE-2026-8968

  Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

  Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• High 7.3
  CVE-2026-8947

  Use-after-free in the DOM: Bindings (WebIDL) component

  Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Medium 6.5
  CVE-2026-8388 Public exploit

  Incorrect boundary conditions in the JavaScript Engine: JIT component

  Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026
• Medium 6.5
  CVE-2026-8706

  Sensitive user data could be leaked to other applications through Reader mode

  Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox f…

  Mozilla Firefox for iOS mozjs52 mozjs68 iOS Browsers Ubuntu Wolfi
  May 19, 2026
• Medium 6.5
  CVE-2026-8951

  Spoofing issue in the Toolbar component in Firefox for Android

  Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

  Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  May 19, 2026
• Medium 6.5
  CVE-2026-8961

  Spoofing issue in the Form Autofill component

  Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 19, 2026
• Medium 6.5
  CVE-2026-8971

  Same-origin policy bypass in the Networking: JAR component

  Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  May 19, 2026
• Medium 5.3
  CVE-2026-8391

  Other issue in the JavaScript Engine component

  Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  May 12, 2026

Revision history

1. 2026-07-20 #21

   Neue Updates von Oracle Linux aufgenommen

2. 2026-07-19 #20

   Neue Updates von Oracle Linux aufgenommen

3. 2026-07-08 #19

   Neue Updates von IGEL aufgenommen

4. 2026-06-30 #18

   Neue Updates von Oracle Linux aufgenommen

5. 2026-06-29 #17

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-24 #16

   Neue Updates von Oracle Linux aufgenommen

7. 2026-06-17 #15

   Neue Updates von Red Hat aufgenommen

8. 2026-06-16 #14

   Neue Updates von Red Hat aufgenommen

9. 2026-06-15 #13

   Neue Updates von Red Hat aufgenommen

10. 2026-06-08 #12

    Neue Updates von Amazon aufgenommen

11. 2026-06-07 #11

    Neue Updates von Rocky Enterprise Software Foundation und SUSE aufgenommen

12. 2026-06-04 #10

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

13. 2026-06-02 #9

    Neue Updates von Red Hat und IGEL aufgenommen

14. 2026-06-01 #8

    Neue Updates von Red Hat aufgenommen

15. 2026-05-31 #7

    Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen

16. 2026-05-28 #6

    Neue Updates von openSUSE, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

17. 2026-05-27 #5

    Neue Updates von Red Hat und SUSE aufgenommen

18. 2026-05-25 #4

    Neue Updates von Debian und openSUSE aufgenommen

19. 2026-05-21 #3

    Neue Updates von SUSE und Debian aufgenommen

20. 2026-05-20 #2

    Neue Updates von openSUSE und Debian aufgenommen

21. 2026-05-19 #1

    Initiale Fassung

References

• Mozilla Security Advisory mfsa2026-46 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-46/
• Mozilla Security Advisory mfsa2026-47 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-47/
• Mozilla Security Advisory mfsa2026-48 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-48/
• Mozilla Security Advisory mfsa2026-49 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-49/
• Mozilla Security Advisory mfsa2026-50 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-50/
• Mozilla Security Advisory mfsa2026-51 vom 2026-05-19
  https://www.mozilla.org/en-US/security/advisories/mfsa2026-51/
• openSUSE Security Update OPENSUSE-SU-2026:10813-1 vom 2026-05-20
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N4PBMNGPCFVXRJKTYWURGMAHKO2FKQDE/
• Debian Security Advisory DLA-4592 vom 2026-05-20
  https://lists.debian.org/debian-lts-announce/2026/05/msg00037.html
• Debian Security Advisory DSA-6283 vom 2026-05-20
  https://lists.debian.org/debian-security-announce/2026/msg00194.html
• SUSE Security Update SUSE-SU-2026:2039-1 vom 2026-05-21
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026240.html
• Debian Security Advisory DSA-6288 vom 2026-05-21
  https://lists.debian.org/debian-security-announce/2026/msg00199.html
• Debian Security Advisory DLA-4594 vom 2026-05-22
  https://lists.debian.org/debian-lts-announce/2026/05/msg00039.html
• openSUSE Security Update OPENSUSE-SU-2026:20789-1 vom 2026-05-25
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2XKHQFOHFVU7FRH6PM55T4P7D5OPT6NZ/
• Red Hat Security Advisory RHSA-2026:21382 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21382
• Red Hat Security Advisory RHSA-2026:21380 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21380
• Red Hat Security Advisory RHSA-2026:21378 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21378
• SUSE Security Update SUSE-SU-2026:21828-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026321.html
• Red Hat Security Advisory RHSA-2026:21381 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21381
• openSUSE Security Update OPENSUSE-SU-2026:10863-1 vom 2026-05-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/K5XOKX5RBFOVIL522NO3N6BOVHY4P2Q7/
• Oracle Linux Security Advisory ELSA-2026-21382 vom 2026-05-28
  https://linux.oracle.com/errata/ELSA-2026-21382.html
• openSUSE Security Update OPENSUSE-SU-2026:10864-1 vom 2026-05-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UBJIBUOS3WETGSITABGASMM7ABVFBZ2V/
• Rocky Linux Security Advisory RLSA-2026:21382 vom 2026-05-29
  https://errata.build.resf.org/RLSA-2026:21382
• SUSE Security Update SUSE-SU-2026:2109-1 vom 2026-05-29
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026378.html
• Rocky Linux Security Advisory RLSA-2026:21381 vom 2026-05-30
  https://errata.build.resf.org/RLSA-2026:21381
• Rocky Linux Security Advisory RLSA-2026:21378 vom 2026-05-30
  https://errata.build.resf.org/RLSA-2026:21378
• Red Hat Security Advisory RHSA-2026:22325 vom 2026-06-01
  https://access.redhat.com/errata/RHSA-2026:22325
• Red Hat Security Advisory RHSA-2026:22643 vom 2026-06-02
  https://access.redhat.com/errata/RHSA-2026:22643
• IGEL Security Notice ISN-2026-22 vom 2026-06-02
  https://kb.igel.com/en/security-safety/current/isn-2026-22-firefox-esr-vulnerabilities
• Rocky Linux Security Advisory RLSA-2026:21380 vom 2026-06-04
  https://errata.build.resf.org/RLSA-2026:21380
• Oracle Linux Security Advisory ELSA-2026-22643 vom 2026-06-04
  http://linux.oracle.com/errata/ELSA-2026-22643.html
• Rocky Linux Security Advisory RLSA-2026:22643 vom 2026-06-06
  https://errata.build.resf.org/RLSA-2026:22643
• Rocky Linux Security Advisory RLSA-2026:22325 vom 2026-06-05
  https://errata.build.resf.org/RLSA-2026:22325
• SUSE Security Update SUSE-SU-2026:2271-1 vom 2026-06-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026595.html
• Amazon Linux Security Advisory ALAS2FIREFOX-2026-061 vom 2026-06-08
  https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2026-061.html
• Amazon Linux Security Advisory ALAS2-2026-3340 vom 2026-06-09
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3340.html
• Red Hat Security Advisory RHSA-2026:26174 vom 2026-06-16
  https://access.redhat.com/errata/RHSA-2026:26174
• Red Hat Security Advisory RHSA-2026:26269 vom 2026-06-16
  https://access.redhat.com/errata/RHSA-2026:26269
• Red Hat Security Advisory RHSA-2026:26493 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26493
• Red Hat Security Advisory RHSA-2026:26492 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26492
• Red Hat Security Advisory RHSA-2026:26491 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26491
• Red Hat Security Advisory RHSA-2026:26536 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26536
• Red Hat Security Advisory RHSA-2026:26539 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26539
• Red Hat Security Advisory RHSA-2026:26551 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26551
• Red Hat Security Advisory RHSA-2026:26606 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26606
• Red Hat Security Advisory RHSA-2026:26629 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26629
• Red Hat Security Advisory RHSA-2026:26630 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26630
• Oracle Linux Security Advisory ELSA-2026-21381 vom 2026-06-25
  http://linux.oracle.com/errata/ELSA-2026-21381.html
• Oracle Linux Security Advisory ELSA-2026-21378 vom 2026-06-29
  https://linux.oracle.com/errata/ELSA-2026-21378.html
• openSUSE Security Update OPENSUSE-SU-2026:21168-1 vom 2026-06-30
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HQOUZ4FJUQQK7WLZSNIZJXU73B7UNF3A/
• Oracle Linux Security Advisory ELSA-2026-26551 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-26551.html
• IGEL Security Notice ISN-2026-27 vom 2026-07-09
  https://kb.igel.com/en/security-safety/current/isn-2026-27-firefox-esr-vulnerabilities
• Oracle Linux Security Advisory ELSA-2026-22325 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-22325.html
• Oracle Linux Security Advisory ELSA-2026-21380 vom 2026-07-20
  https://linux.oracle.com/errata/ELSA-2026-21380.html