CVE-2026-5735

The vulnerability results from out-of-bounds write errors in the memory management of the browser/email client engine. Some of the detected errors led to process memory corruption, which provides a basis for their exploitation to gain control over the program's execution flow. An attacker can deliver specially crafted content (e.g., a website or email message) that triggers the vulnerable code without requiring authentication or user interaction.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code remotely (RCE) in the context of a Firefox or Thunderbird process, which may lead to complete compromise of the user session, data breach, or malicious software installation.

Mozilla Firefox should be updated immediately to version 149.0.2 or later, and Mozilla Thunderbird should be updated to version 149.0.2 or later. Patches are available through the automatic update mechanism or directly from the manufacturer's websites indicated in the references.

Mozilla Firefox 149.0.1 and Mozilla Thunderbird 149.0.1