Cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amozillafirefoxesr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 11 May 2026 12:07:38 +0000Multiple Vulnerabilities in Mozilla Products Leading to Arbitrary Code Executionhttps://feed.craftedsignal.io/briefs/2026-05-mozilla-vulns/Mon, 11 May 2026 12:07:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-mozilla-vulns/Multiple vulnerabilities in Mozilla Firefox and Thunderbird products can lead to arbitrary code execution and unspecified security issues if the products are not updated to the latest versions.On May 11, 2026, CERT-FR published an advisory regarding multiple vulnerabilities found in Mozilla products, specifically Firefox and Thunderbird. These vulnerabilities can be exploited by an attacker to achieve arbitrary code execution, as well as cause other unspecified security issues on a targeted system. The affected products include Firefox ESR versions prior to 115.35.2 and 140.10.2, Firefox versions prior to 150.0.2, Thunderbird ESR versions prior to 140.10.2, and Thunderbird versions prior to 140.10.2 and 150.0.2. It is recommended that users update to the latest versions to mitigate these risks. The vulnerabilities are tracked by CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, and CVE-2026-8094.

Attack Chain

  1. The attacker identifies a vulnerable Firefox or Thunderbird instance.
  2. The attacker crafts a malicious web page or email containing the exploit.
  3. The user opens the malicious web page in Firefox or views the email in Thunderbird.
  4. The exploit triggers a vulnerability, such as a memory corruption issue.
  5. The attacker gains arbitrary code execution on the user’s machine.
  6. The attacker installs malware or performs other malicious actions.

Impact

Successful exploitation of these vulnerabilities can lead to arbitrary code execution on the victim’s machine. This can allow an attacker to install malware, steal sensitive information, or perform other malicious activities. Given the widespread use of Firefox and Thunderbird, a large number of users could be affected if these vulnerabilities are not addressed.

Recommendation

  • Upgrade Firefox ESR to version 115.35.2 or later to remediate CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, and CVE-2026-8094.
  • Upgrade Firefox to version 150.0.2 or later to remediate CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, and CVE-2026-8094.
  • Upgrade Thunderbird ESR to version 140.10.2 or later to remediate CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, and CVE-2026-8094.
  • Upgrade Thunderbird to version 150.0.2 or later to remediate CVE-2026-8090, CVE-2026-8091, CVE-2026-8092, CVE-2026-8093, and CVE-2026-8094.
]]>highadvisoryvulnerabilityarbitrary code executionmozilla