Buffer overflow in Firefox for Android and Mozilla Firefox - CVE-2026-8973
Published: May 19, 2026
Vulnerability identifier: #VU131863
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-8973
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to memory corruption in multiple components when processing web content. A remote attacker can trigger the flaws to execute arbitrary code.
Some of the bugs showed evidence of memory corruption.
Affected software
Firefox for Android
Mozilla Firefox
Mozilla Thunderbird
Mozilla Firefox
Mozilla Thunderbird
How to mitigate CVE-2026-8973
Install security update from vendor's website.
Firefox for Android - update to 151.0
Mozilla Firefox - update to 151.0
Mozilla Thunderbird - update to 151.0
Mozilla Firefox - update to 151.0
Mozilla Thunderbird - update to 151.0
External References
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-46/
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1362365
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1860538
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1929005
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1983353
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1998526
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2023271
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2023943
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024244
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024260
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024443
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024665
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024774
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2024916
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025346
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025357
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025406
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025434
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025488
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025496
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025942
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025947
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025968
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2026279
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027159
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027239
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027276
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027308
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027310
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027324
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027329
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027363
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027381
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027382
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027383
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2028274
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2028884
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029060
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029065
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029068
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029281
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029293
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029297
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029303
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029439
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029448
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029703
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029720
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029721
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029723
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029770
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029771
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029782
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029818
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029885
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2030100
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2030379
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2030385
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2030979
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2031119
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2031122
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2034119
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2034791
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2035209
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2036666
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2037986