CVE-2026-0891

Vulnerability

Overview

CVE-2026-0891 is a catch-all identifier for multiple memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146, Firefox 146, and Thunderbird 146. The official description states that some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code [1][2]. The vulnerabilities were addressed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7 [1][2][3][4].

Attack

Vector and Prerequisites

The specific bugs include use-after-free issues in the IPC and JavaScript Engine components, sandbox escapes due to boundary conditions and integer overflows in Graphics components, and a mitigation bypass in the DOM Security component [1][2]. In Thunderbird, these flaws cannot be exploited through email because scripting is disabled when reading mail, but they remain risks in browser or browser-like contexts [1][3]. Exploitation would typically require user interaction such as visiting a malicious web page or opening a crafted document in a browser context.

Impact

Successful exploitation could allow an attacker to execute arbitrary code on the affected system, potentially leading to full compromise of the application and underlying operating system. The CVSS v3 base score of 8.1 (High) reflects the serious nature of these vulnerabilities [1][2].

Mitigation

Mozilla has released fixed versions: Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users should update to these versions immediately. No workarounds are available [1][2][3][4].