CVE-2026-8958
Description
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An information disclosure and sandbox escape vulnerability in Firefox and Thunderbird's Process Sandboxing component was fixed in Firefox 151, ESR 140.11, Thunderbird 151, and 140.11.
Vulnerability
CVE-2026-8958 is an information disclosure and sandbox escape in the Security: Process Sandboxing component of Firefox and Thunderbird. The vulnerability affects Firefox versions before 151, Firefox ESR versions before 140.11, Thunderbird versions before 151, and Thunderbird versions before 140.11 [1][2][3][4].
Exploitation
An attacker could potentially leverage this flaw to disclose sensitive information and escape the sandbox. The exact exploitation steps are not detailed in the available references, but it can be triggered in browser or browser-like contexts within Thunderbird (scripting is disabled when reading mail, reducing email-based risk) [2][3].
Impact
Successful exploitation could lead to information disclosure and sandbox escape, allowing an attacker to break out of the sandboxed environment and potentially access sensitive data or execute code outside the sandbox restrictions [1][2][3][4].
Mitigation
Mozilla fixed this vulnerability in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11 as announced on May 19, 2026 [1][2][3][4]. Users should update to these versions or later to mitigate the risk. No workarounds are mentioned.
AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
5- Range: <140.11
- Range: < 140.11
- Range: < 140.11
- Range: < 151
- Range: < 151
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.mozilla.org/security/advisories/mfsa2026-46/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-48/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-50/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-51/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.