Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-2784: Firefox and Thunderbird let web pages bypass security checks

CVE-2026-2784 · published 8 months ago

Summary

Certain versions of Firefox, Firefox ESR, Thunderbird and related builds let a malicious web page avoid built‑in security protections. This could allow attackers to run unwanted code or steal data from users. Upgrade to the latest versions released after Firefox 148/Firefox ESR 140.8 and Thunderbird 148/140.8 to resolve the issue.

What to do

Update debian firefox-esr to version 140.8.0esr-1~deb11u1.
Update debian firefox-esr to version 140.8.0esr-1~deb12u1.
Update debian firefox-esr to version 140.8.0esr-1~deb13u1.
Update debian firefox-esr to version 140.8.0esr-1.
Update debian thunderbird to version 1:140.8.0esr-1~deb11u1.
Update debian thunderbird to version 1:140.8.0esr-1~deb12u1.
Update debian thunderbird to version 1:140.8.0esr-1~deb13u1.
Update debian thunderbird to version 1:140.8.0esr-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	mozilla	firefox	< 140.8.0 < 148.0 `cpe:2.3:a:mozilla:firefox:::::esr:::*`
–	mozilla	thunderbird	< 140.8.0 < 148.0 `cpe:2.3:a:mozilla:thunderbird:::::esr:::*`
Debian:11	debian	firefox-esr	< 140.8.0esr-1~deb11u1 Fix: upgrade to 140.8.0esr-1~deb11u1
Debian:12	debian	firefox-esr	< 140.8.0esr-1~deb12u1 Fix: upgrade to 140.8.0esr-1~deb12u1
Debian:13	debian	firefox-esr	< 140.8.0esr-1~deb13u1 Fix: upgrade to 140.8.0esr-1~deb13u1
Debian:14	debian	firefox-esr	< 140.8.0esr-1 Fix: upgrade to 140.8.0esr-1
Debian:11	debian	thunderbird	< 1:140.8.0esr-1~deb11u1 Fix: upgrade to 1:140.8.0esr-1~deb11u1
Debian:12	debian	thunderbird	< 1:140.8.0esr-1~deb12u1 Fix: upgrade to 1:140.8.0esr-1~deb12u1
Debian:13	debian	thunderbird	< 1:140.8.0esr-1~deb13u1 Fix: upgrade to 1:140.8.0esr-1~deb13u1
Debian:14	debian	thunderbird	< 1:140.8.0esr-1 Fix: upgrade to 1:140.8.0esr-1
Ubuntu:18.04:LTS	canonical	mozjs52	All versions
Ubuntu:18.04:LTS	canonical	mozjs38	All versions
Ubuntu:20.04:LTS	canonical	mozjs68	All versions
Ubuntu:22.04:LTS	canonical	mozjs102	All versions
Ubuntu:22.04:LTS	canonical	mozjs78	All versions
Ubuntu:22.04:LTS	canonical	mozjs91	All versions
Ubuntu:22.04:LTS	canonical	thunderbird	All versions
Ubuntu:24.04:LTS	canonical	mozjs115	All versions

Original advisory text

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2012984 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-13/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-15/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-16/ Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-2784 Vendor Advisory
https://ubuntu.com/security/CVE-2026-2784 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-2784 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2026-13/#CVE-2026-2784 Third Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2026-15/#CVE-2026-2784 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-17/ Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-288Authentication Bypass Using Alternate Path

Timeline

Published24 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-2784 · NVD

CVE-2026-2784 · OSV

DEBIAN-CVE-2026-2784 · OSV

UBUNTU-CVE-2026-2784 · OSV

Track software like this

Free during beta