CVE-2026-4721
Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
| Vendor | mozilla |
| Product | firefox |
| Ecosystems | |
| Industries | Technology |
| Published | Mar 24, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for mozilla firefox
Be the first to know when new critical vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / Firefox
All versions affected Mozilla / Thunderbird
All versions affected References
bugzilla.mozilla.org: https://bugzilla.mozilla.org/buglist.cgi?bug_id=2013762%2C2015291%2C2016591%2C2016661%2C2016664%2C2017303%2C2017894%2C2018090%2C2018196%2C2018379%2C2019112%2C2022090%2C2022243%2C2022351%2C2022478%2C2022676 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-20/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-21/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-22/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-23/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-24/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-4721 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2450711 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4721.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8427 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7843 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8315 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5931 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5932 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6917 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7840 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8285 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7858 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8850 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7842 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8289 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7838 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8288 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7839 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8286 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7841 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8287 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7845 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8290 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7837 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8284 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5930 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6188
Credits
Christian Holler, Timothy Nikkel, Tom Schuster and the Mozilla Fuzzing Team