JavaScript Engine flaw in Firefox 150.0.3 (fixed)
CVE-2026-8391 Published on May 12, 2026
Other issue in the JavaScript Engine component
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Vulnerability Analysis
CVE-2026-8391 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Types
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-8391 has been classified to as a XSS vulnerability or weakness.
What is a Buffer Overflow Vulnerability?
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CVE-2026-8391 has been classified to as a Buffer Overflow vulnerability or weakness.
Undefined Behavior for Input to API
The behavior of this function is undefined unless its control parameter is set to a specific value.
Products Associated with CVE-2026-8391
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-8391 are published in these products:
Affected Versions
Mozilla Firefox:- Version 115.36, <= 115.* is unaffected.
- Version 140.11, <= 140.* is unaffected.
- Version 150.0.3, <= * is unaffected.
- Version 140.11, <= * is unaffected.
- Version 0:140.11.0-1.el10_2 and below * is unaffected.
- Version 0:140.11.0-1.el10_2 and below * is unaffected.
- Version 0:140.11.0-1.el10_0 and below * is unaffected.
- Version 0:140.11.0-1.el10_0 and below * is unaffected.
- Version 0:140.11.0-1.el7_9 and below * is unaffected.
- Version 0:140.11.0-1.el8_10 and below * is unaffected.
- Version 0:140.11.0-1.el8_10 and below * is unaffected.
- Version 0:140.11.0-1.el8_4 and below * is unaffected.
- Version 0:140.11.0-1.el8_4 and below * is unaffected.
- Version 0:140.11.0-1.el8_4 and below * is unaffected.
- Version 0:140.11.0-1.el8_4 and below * is unaffected.
- Version 0:140.11.0-1.el8_6 and below * is unaffected.
- Version 0:140.11.0-1.el8_6 and below * is unaffected.
- Version 0:140.11.0-1.el8_6 and below * is unaffected.
- Version 0:140.11.0-1.el8_6 and below * is unaffected.
- Version 0:140.11.0-1.el8_8 and below * is unaffected.
- Version 0:140.11.0-1.el8_8 and below * is unaffected.
- Version 0:140.11.0-1.el8_8 and below * is unaffected.
- Version 0:140.11.0-1.el8_8 and below * is unaffected.
- Version 0:140.11.0-1.el9_8 and below * is unaffected.
- Version 0:140.11.0-1.el9_8 and below * is unaffected.
- Version 0:140.11.0-1.el9_2 and below * is unaffected.
- Version 0:140.11.0-1.el9_2 and below * is unaffected.
- Version 0:140.11.0-1.el9_4 and below * is unaffected.
- Version 0:140.11.0-1.el9_4 and below * is unaffected.
- Version 0:140.11.0-1.el9_6 and below * is unaffected.
- Version 0:140.11.0-1.el9_6 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.