PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-4721 Mozilla CVE debrief

CVE-2026-4721 is a critical vulnerability affecting Mozilla Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148. The vulnerability involves memory safety bugs that show evidence of memory corruption. If exploited, these bugs could potentially allow attackers to run arbitrary code. The vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. This CVE has a CVSS score of 9.8, indicating a critical severity level.

Vendor
Mozilla
Product
Firefox
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-24
Original CVE updated
2026-07-15
Advisory published
2026-03-24
Advisory updated
2026-07-15

Who should care

Organizations and individuals using Mozilla Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148 should prioritize patching this vulnerability. Given the critical severity and potential for arbitrary code execution, immediate attention is required to prevent potential exploitation.

Technical summary

The vulnerability is caused by memory safety bugs in the affected versions of Mozilla Firefox and Thunderbird. These bugs could lead to memory corruption and potentially allow attackers to execute arbitrary code. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on March 24, 2026, and has since been modified on June 30, 2026.

Defensive priority

High. Immediate patching is recommended due to the critical severity and potential for arbitrary code execution.

Recommended defensive actions

  • Patch affected systems: Update Firefox to version 149, Firefox ESR to version 115.34 or 140.9, and Thunderbird to version 149 or 140.9.
  • Inventory and prioritize: Ensure all instances of affected software are identified and prioritized for patching.
  • Verify patch deployment: Confirm that patches have been successfully deployed and systems are no longer vulnerable.
  • Monitor for suspicious activity: Enhance monitoring for potential exploitation attempts or anomalous behavior.
  • Implement compensating controls: Consider implementing additional security controls, such as network segmentation or enhanced logging, until patching can be completed.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. Mozilla's security advisories (MFSA 2026-20 to MFSA 2026-24) offer detailed guidance on the vulnerability and mitigation steps. Red Hat errata (RHSA-2026:5930 and others) provide additional information on affected and patched versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-4721 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-4721

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-4721 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-4721

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.