CVE-2026-8091: Mozilla Firefox

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

Affected products

• Mozilla Firefox: before 115.35.2 (fixed in 115.35.2); from 140.0, before 140.10.1 (fixed in 140.10.1)
• Mozilla Thunderbird: from 140.0, before 140.10.1 (fixed in 140.10.1)

Published 2026-05-07. Last modified 2026-08-11.