Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-0885: Firefox and Thunderbird may let malicious code run
CVE-2026-0885 · published 9 months ago
Summary
A memory handling bug in the JavaScript engine of Firefox, Firefox ESR, Thunderbird and their Linux packages can let a crafted web page or email cause the program to execute unwanted code. This could let an attacker take control of the browser or email client and access data. Install the latest updates (Firefox 147 or newer, Firefox ESR 140.7 or newer, Thunderbird 147 or newer, Thunderbird 140.7 or newer) to fix the problem.
What to do
- Update debian firefox-esr to version 140.7.0esr-1~deb11u1.
- Update debian firefox-esr to version 140.7.0esr-1~deb12u1.
- Update debian firefox-esr to version 140.7.0esr-1~deb13u1.
- Update debian firefox-esr to version 140.7.0esr-1.
- Update debian thunderbird to version 1:140.7.0esr-1~deb11u1.
- Update debian thunderbird to version 1:140.7.0esr-1~deb12u1.
- Update debian thunderbird to version 1:140.7.0esr-1~deb13u1.
- Update canonical thunderbird to version 1:140.7.1+build1-0ubuntu0.22.04.1.
- Update debian thunderbird to version 1:140.7.0esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox |
< 140.7.0 < 147.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 140.7.0 < 147.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* |
| Debian:11 | debian | firefox-esr |
< 140.7.0esr-1~deb11u1 Fix: upgrade to 140.7.0esr-1~deb11u1
|
| Debian:12 | debian | firefox-esr |
< 140.7.0esr-1~deb12u1 Fix: upgrade to 140.7.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 140.7.0esr-1~deb13u1 Fix: upgrade to 140.7.0esr-1~deb13u1
|
| Debian:14 | debian | firefox-esr |
< 140.7.0esr-1 Fix: upgrade to 140.7.0esr-1
|
| Debian:11 | debian | thunderbird |
< 1:140.7.0esr-1~deb11u1 Fix: upgrade to 1:140.7.0esr-1~deb11u1
|
| Debian:12 | debian | thunderbird |
< 1:140.7.0esr-1~deb12u1 Fix: upgrade to 1:140.7.0esr-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:140.7.0esr-1~deb13u1 Fix: upgrade to 1:140.7.0esr-1~deb13u1
|
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird |
< 1:140.7.1+build1-0ubuntu0.22.04.1 Fix: upgrade to 1:140.7.1+build1-0ubuntu0.22.04.1
|
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:14 | debian | thunderbird |
< 1:140.7.0esr-1 Fix: upgrade to 1:140.7.0esr-1
|
Original advisory text
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
References
- https://www.mozilla.org/security/advisories/mfsa2026-04/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-05/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=2003607 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-0885 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-0885 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-0885 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-01/#CVE-2026-0885 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-03/#CVE-2026-0885 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-01/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-03/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-7991-1 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-416Use After Free
Timeline
Published13 Jan 2026
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2026-0885 · OSV
CVE-2026-0885 · NVD
DEBIAN-CVE-2026-0885 · OSV
UBUNTU-CVE-2026-0885 · OSV
Track software like this
Free during beta