Mozilla has patched five vulnerabilities in Firefox and Firefox Extended Support Release that could enable arbitrary code execution, including a critical flaw in audio and video playback rated CVSS 9.8 by the National Vulnerability Database. The fixes arrived in Firefox 150.0.2, Firefox ESR 140.10.2 and Firefox ESR 115.35.2, according to the Mozilla security advisory for Firefox 150.0.2 and related Firefox ESR advisory.
The vulnerabilities are tracked as CVE-2026-8090 through CVE-2026-8094. They include a use-after-free in the DOM networking component, incorrect boundary conditions in audio and video playback, memory-safety bugs, and an issue in WebRTC. Mozilla’s advisories group the fixes across MFSA 2026-40, MFSA 2026-41 and MFSA 2026-42.
CVE-2026-8091 carries the highest reported NVD severity, with a CVSS 3.1 score of 9.8 and a network-based attack vector that requires no privileges or user interaction. Other available NVD scores include 7.3 for CVE-2026-8090 and 8.1 for CVE-2026-8092. Mozilla’s description of the memory-safety issues warns that some bugs showed evidence of memory corruption and could potentially be leveraged for code execution.
The affected versions are Firefox releases before 150.0.2, Firefox ESR releases before 140.10.2, and the older ESR 115 branch before 115.35.2. Successful exploitation could let an attacker run code in the context of the logged-in user; the resulting impact would depend on that account’s permissions, potentially allowing software installation, data modification or deletion, and creation of accounts with equivalent rights.
There were no reports of exploitation in the wild when the advisory was issued, and the advisory contains no public proof-of-concept reference. Administrators should nevertheless prioritize browser updates because Firefox routinely processes untrusted web content and the highest-rated issue requires no user interaction in NVD’s assessment. Organizations should deploy Mozilla’s fixed releases through their normal endpoint-management systems, verify the installed version across managed devices, and avoid relying on administrator privileges as a mitigation.
