CVE-2026-8947

HighCVSS 7.3

Published: 19/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

Use-after-free vulnerability in the DOM: Bindings (WebIDL) component of Firefox and Thunderbird. The flaw was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Risk Assessment

An attacker could exploit this vulnerability to execute arbitrary code remotely or cause application crashes, compromising user data confidentiality and integrity.

Recommendation

Immediately update Firefox to version 151 or later and Thunderbird to version 151 or later. For ESR versions, apply updates to 115.36 or 140.11.

Original NVD description (English source)

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.