CVE-2026-8391
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
An unspecified vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. The flaw is fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
Risk Assessment
The vulnerability could allow an attacker to perform unauthorized operations within the browser or mail client context, potentially compromising data confidentiality and integrity.
Recommendation
Immediately update Firefox to version 150.0.3 or later, and Firefox ESR and Thunderbird to version 140.11 or later.
Other vulnerabilities in JavaScript Engine
See all- CVE-2026-2786Critical
CVE-2026-2786 involves a use-after-free vulnerability in the JavaScript Engine component. It has been fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CVE-2026-2763Critical
A use-after-free vulnerability was discovered in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Original NVD description (English source)
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.