PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5735 Mozilla CVE debrief

CVE-2026-5735 is a critical Mozilla vulnerability affecting Firefox 149.0.1 and Thunderbird 149.0.1. The CVE description says the issue involved memory safety bugs, some with evidence of memory corruption, and that Mozilla presumed some could have been exploited to run arbitrary code. Mozilla fixed the problem in Firefox 149.0.2 and Thunderbird 149.0.2. Because NVD rates the issue 9.8 and the CVSS vector indicates network attack, no privileges, and no user interaction, this should be treated as an urgent patching item.

Vendor
Mozilla
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-07-15
Advisory published
2026-04-07
Advisory updated
2026-07-15

Who should care

Administrators and users running Firefox or Thunderbird 149.0.1, especially in environments where browser or email-client compromise would have high impact. Security teams managing endpoint patching should prioritize this update immediately.

Technical summary

NVD classifies the flaw as a memory safety issue with CWE-787 as the primary weakness and CWE-125/CWE-787 as secondary references. The published description notes evidence of memory corruption and a presumption of possible arbitrary code execution with sufficient effort. NVD lists affected Mozilla products as Firefox and Thunderbird versions prior to 149.0.2, with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade Firefox to 149.0.2 or later.
  • Upgrade Thunderbird to 149.0.2 or later.
  • Prioritize patch deployment for internet-facing or high-use endpoints first.
  • Verify that managed software inventories no longer include version 149.0.1.
  • Monitor Mozilla security advisories and vendor release notes for any follow-up guidance.

Evidence notes

This debrief is based on the supplied CVE description and NVD metadata only. The source corpus states that Mozilla fixed the issue in Firefox and Thunderbird 149.0.2 and that some bugs showed evidence of memory corruption. NVD references Mozilla advisories and an issue-tracking link, but the full advisory text was not included in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5735 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5735

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5735 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5735

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.