Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-2791: Firefox and Thunderbird cache can be forced to skip security
CVE-2026-2791 · published 8 months ago
Summary
The cache part of Firefox and Thunderbird can be tricked into bypassing normal safety checks, potentially letting harmful content be stored or delivered. This affects standard releases of Firefox, Firefox ESR, Thunderbird, and the related Debian and Ubuntu packages. Apply the latest updates that include the fix and keep these applications up to date.
What to do
- Update debian firefox-esr to version 140.8.0esr-1~deb11u1.
- Update debian firefox-esr to version 140.8.0esr-1~deb12u1.
- Update debian firefox-esr to version 140.8.0esr-1~deb13u1.
- Update debian firefox-esr to version 140.8.0esr-1.
- Update debian thunderbird to version 1:140.8.0esr-1~deb11u1.
- Update debian thunderbird to version 1:140.8.0esr-1~deb12u1.
- Update debian thunderbird to version 1:140.8.0esr-1~deb13u1.
- Update debian thunderbird to version 1:140.8.0esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox |
< 140.8.0 < 148.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 140.8.0 < 148.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* |
| Debian:11 | debian | firefox-esr |
< 140.8.0esr-1~deb11u1 Fix: upgrade to 140.8.0esr-1~deb11u1
|
| Debian:12 | debian | firefox-esr |
< 140.8.0esr-1~deb12u1 Fix: upgrade to 140.8.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 140.8.0esr-1~deb13u1 Fix: upgrade to 140.8.0esr-1~deb13u1
|
| Debian:14 | debian | firefox-esr |
< 140.8.0esr-1 Fix: upgrade to 140.8.0esr-1
|
| Debian:11 | debian | thunderbird |
< 1:140.8.0esr-1~deb11u1 Fix: upgrade to 1:140.8.0esr-1~deb11u1
|
| Debian:12 | debian | thunderbird |
< 1:140.8.0esr-1~deb12u1 Fix: upgrade to 1:140.8.0esr-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:140.8.0esr-1~deb13u1 Fix: upgrade to 1:140.8.0esr-1~deb13u1
|
| Debian:14 | debian | thunderbird |
< 1:140.8.0esr-1 Fix: upgrade to 1:140.8.0esr-1
|
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
Original advisory text
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2015220 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-13/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-15/ Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-2791 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-2791 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-2791 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-13/#CVE-2026-2791 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-15/#CVE-2026-2791 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-16/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-17/ Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-288Authentication Bypass Using Alternate Path
Timeline
Published24 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-2791 · NVD
CVE-2026-2791 · OSV
DEBIAN-CVE-2026-2791 · OSV
UBUNTU-CVE-2026-2791 · OSV
Track software like this
Free during beta