JavaScript Engine flaw in Firefox 150.0.3 (fixed)
CVE-2026-8391 Published on May 12, 2026
Other issue in the JavaScript Engine component
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Vulnerability Analysis
CVE-2026-8391 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Types
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-8391 has been classified to as a XSS vulnerability or weakness.
What is a Buffer Overflow Vulnerability?
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CVE-2026-8391 has been classified to as a Buffer Overflow vulnerability or weakness.
Products Associated with CVE-2026-8391
stack.watch emails you whenever new vulnerabilities are published in Mozilla Firefox or Mozilla Thunderbird. Just hit a watch button to start following.
Affected Versions
Mozilla Firefox:- Version 115.36, <= 115.* is unaffected.
- Version 140.11, <= 140.* is unaffected.
- Version 150.0.3, <= * is unaffected.
- Version 140.11, <= * is unaffected.