CVE-2026-8958

LLM-synthesized narrative grounded in this CVE's description and references.

• Mozilla Corporation/Firefoxinferred5 versions

  <140.11+ 4 more

  • (no CPE)range: <140.11
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <151.0.0
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.11.0
  • (no CPE)range: < 140.11
  • (no CPE)range: < 151
• Mozilla Corporation/Thunderbird4 versions

  cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*+ 3 more

  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*range: <151.0.0
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*range: <140.11
  • (no CPE)range: < 140.11
  • (no CPE)range: < 151
• osv-coords9 versions

  pkg:apk/chainguard/firefoxpkg:apk/chainguard/firefox-esrpkg:apk/wolfi/firefoxpkg:rpm/almalinux/firefoxpkg:rpm/almalinux/firefox-x11pkg:rpm/almalinux/thunderbirdpkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed

  < 140.11-r0+ 8 more

  • (no CPE)range: < 140.11-r0
  • (no CPE)range: < 140.11-r0
  • (no CPE)range: < 140.11-r0
  • (no CPE)range: < 140.11.0-1.el9_8.alma.1
  • (no CPE)range: < 140.11.0-1.el9_8.alma.1
  • (no CPE)range: < 140.11.0-1.el9_8.alma.1
  • (no CPE)range: < 140.11.0-1.1
  • (no CPE)range: < 151.0.1-1.1
  • (no CPE)range: < 140.11.1-1.1

• www.mozilla.org/security/advisories/mfsa2026-46/nvdVendor Advisory
• www.mozilla.org/security/advisories/mfsa2026-48/nvdVendor Advisory
• www.mozilla.org/security/advisories/mfsa2026-50/nvdVendor Advisory
• www.mozilla.org/security/advisories/mfsa2026-51/nvdVendor Advisory
• bugzilla.mozilla.org/show_bug.cginvdPermissions Required

• Mozilla Firefox: 25 CVEs Patched in May 2026 Update, Including Four Critical Sandbox Escapes
  Vypr Intelligence · May 19, 2026