Mozilla Thunderbird Email client

Memory safety bug in Firefox <149.0.2 & Thunderbird 149.0.1
CVE-2026-5735 8.1 - High - April 07, 2026

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

Memory corruption in Firefox <149.0.2 & ESR <140.9.1
CVE-2026-5734 8.1 - High - April 07, 2026

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Classic Buffer Overflow

Firefox <149.0.2 WebGPU Boundary Conditions CVE-2026-5733
CVE-2026-5733 8.8 - High - April 07, 2026

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

Buffer Overflow

Integer Overflow in Firefox Graphics: Text Component (149.0.2 / ESR 140.9.1)
CVE-2026-5732 8.8 - High - April 07, 2026

Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Integer Overflow or Wraparound

Mem safety bug in Firefox <149.0.2 (ESR 115/140)
CVE-2026-5731 9.8 - Critical - April 07, 2026

Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Buffer Overflow

Thunderbird <149 Vulnerable Parser Reads OOB via Malformed Mail (CVE-2026-4371)
CVE-2026-4371 7.4 - High - March 24, 2026

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Buffer Over-read

Thunderbird Email Client Spoofing Issue <149, <140.9
CVE-2026-3889 6.5 - Medium - March 24, 2026

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

User Interface (UI) Misrepresentation of Critical Information

Memory safety bugs in Firefox <149 (CVE-2026-4729)
CVE-2026-4729 9.8 - Critical - March 24, 2026

Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Classic Buffer Overflow

Memory Safety Bug in Firefox (ESR 115.33/140.8 & 148) prior to v149
CVE-2026-4721 9.8 - Critical - March 24, 2026

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Classic Buffer Overflow

Mozilla Firefox <149 & ESR <140.9 Memory Corruption (Thunderbird)
CVE-2026-4720 9.8 - Critical - March 24, 2026

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Classic Buffer Overflow

Firefox Graphics:Text Boundary Condition Flaw (pre-149 / ESR<140.9)
CVE-2026-4719 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Buffer Overflow

Firefox Privacy Anti-Tracking Spoofing Vulnerability
CVE-2026-4728 6.5 - Medium - March 24, 2026

Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Authentication Bypass by Spoofing

Undefined Behavior in WebRTC Signaling of Firefox <149
CVE-2026-4718 8.1 - High - March 24, 2026

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Firefox <149 NSS Libraries DoS (Mozilla)
CVE-2026-4727 7.5 - High - March 24, 2026

Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Resource Exhaustion

Denial-of-Service in Firefox XML Component (CVE-2026-4726)
CVE-2026-4726 7.5 - High - March 24, 2026

Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Resource Exhaustion

Privilege Escalation in Netmonitor of Firefox <149/ESR 140.9
CVE-2026-4717 9.8 - Critical - March 24, 2026

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Firefox <149/ESR <140.9: JS Engine uninitialized memory
CVE-2026-4716 9.1 - Critical - March 24, 2026

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Use of Uninitialized Resource

Uninitialized Memory in Firefox Canvas2D component <149/ESR<140.9
CVE-2026-4715 9.1 - Critical - March 24, 2026

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Use of Uninitialized Resource

Firefox Audio/Video Boundary Condition Flaw (v <149, ESR <140.9)
CVE-2026-4714 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

FF <149 Graphics Boundary Condition Flaw
CVE-2026-4713 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox Canvas2D Sandbox Escape due to Use-After-Free
CVE-2026-4725 9.3 - Critical - March 24, 2026

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Dangling pointer

Firefox <149 Info Disclosure via Widget Cocoa Comp (CVE-2026-4712)
CVE-2026-4712 7.5 - High - March 24, 2026

Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Information Disclosure

Firefox <149 Use-after-free in Cocoa Widget Component
CVE-2026-4711 9.8 - Critical - March 24, 2026

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Dangling pointer

Firefox AV Boundary Condition Flaw v<149/ESR<140.9
CVE-2026-4710 9.8 - Critical - March 24, 2026

Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Buffer Overflow

Mozilla Firefox <149 Audio/Video: GMP Boundary Condition Vulnerability
CVE-2026-4709 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox Graphics Boundary Flaw (149, ESR<140.9)
CVE-2026-4708 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox <149 Canvas2D Boundary Condition Flaw (CVE20264707)
CVE-2026-4707 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox <149 & ESR <115.34,140.9 Canvas2D Boundary Condition Vulnerability
CVE-2026-4706 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

CVE-2026-4705: WebRTC Signaling UB Firefox <149/ESR <140.9
CVE-2026-4705 9.8 - Critical - March 24, 2026

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Undefined Behavior in Firefox Audio/Video Component (CVE-2026-4724)
CVE-2026-4724 9.1 - Critical - March 24, 2026

Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Firefox <149 Denial-of-Service via WebRTC Signaling
CVE-2026-4704 7.5 - High - March 24, 2026

Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Resource Exhaustion

Use-After-Free in Firefox JS Engine (<v149)
CVE-2026-4723 9.8 - Critical - March 24, 2026

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Dangling pointer

Mozilla Firefox <149 JIT Miscompilation in JS Engine (CVE-2026-4702)
CVE-2026-4702 9.8 - Critical - March 24, 2026

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Object Type Confusion

Privilege Escalation in Firefox IPC Component
CVE-2026-4722 8.8 - High - March 24, 2026

Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

Use-after-free in Firefox JS Engine before 149 & ESR <140.9
CVE-2026-4701 9.8 - Critical - March 24, 2026

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Dangling pointer

Firefox <149 Mitigation Bypass in Networking:HTTP Component
CVE-2026-4700 9.8 - Critical - March 24, 2026

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Authentication Bypass Using an Alternate Path or Channel

Firefox <149 Boundary Error in Layout Text & Fonts
CVE-2026-4699 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox <149 JIT-Miscompilation SpiderMonkey
CVE-2026-4698 9.8 - Critical - March 24, 2026

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Object Type Confusion

UA-Free in Firefox Layout:Text & Fonts v<149 (ESR<115.34)
CVE-2026-4696 9.8 - Critical - March 24, 2026

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Dangling pointer

Firefox <149 Audio/Video Web Codecs boundary flaw
CVE-2026-4697 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Integer Overflow Firefox Graphics <=149 (ESR<115.34)
CVE-2026-4694 7.5 - High - March 24, 2026

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox <149: Incorrect Boundary Conditions in Audio/Video Web Codecs
CVE-2026-4695 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

CVE-2026-4692: Sandbox Escape via Responsive Design Mode in Firefox <149
CVE-2026-4692 9.6 - Critical - March 24, 2026

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Firefox <149/ESR<140.9 AV Playback Boundary Check Failure
CVE-2026-4693 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions

Firefox CSS Parsing Use-After-Free (before 149, ESR <115.34/140.9)
CVE-2026-4691 9.8 - Critical - March 24, 2026

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Dangling pointer

Firefox <149 XPCOM Sandbox Escape (CVE-2026-4690)
CVE-2026-4690 9.6 - Critical - March 24, 2026

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Integer Overflow or Wraparound

Firefox <149 Sandbox Escape: XPCOM Integer Overflow
CVE-2026-4689 10 - Critical - March 24, 2026

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Classic Buffer Overflow

Firefox <149/ESR<140.9: Disability Access API UAF Sandbox Escape
CVE-2026-4688 9.6 - Critical - March 24, 2026

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Dangling pointer

Firefox <149 Sandbox Escape via Telemetry Boundary Conditions
CVE-2026-4687 9.6 - Critical - March 24, 2026

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Classic Buffer Overflow

Firefox Canvas2D Incorrect Boundary Conditions ( Firefox 149 / ESR 140.9)
CVE-2026-4686 7.5 - High - March 24, 2026

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Improper Check for Unusual or Exceptional Conditions