PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8952 Mozilla CVE debrief

CVE-2026-8952 is a high-severity privilege escalation vulnerability in Mozilla’s Application Update component. Mozilla fixed the issue in Firefox 151 and Thunderbird 151. The NVD record rates the issue as network-reachable with user interaction required, and lists affected Firefox and Thunderbird versions below 151.0.0.

Vendor
Mozilla
Product
Firefox
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-20
Advisory published
2026-05-19
Advisory updated
2026-05-20

Who should care

Organizations and individuals running Mozilla Firefox or Thunderbird versions earlier than 151.0.0 should treat this as important. It is especially relevant for environments where end users may trigger the vulnerable path through normal application use.

Technical summary

The official NVD record describes CVE-2026-8952 as a privilege escalation issue in the Application Update component. NVD maps it to CWE-269 and assigns CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network exposure with user interaction required and potential high confidentiality, integrity, and availability impact. The vulnerable CPE ranges in the NVD data cover Mozilla Firefox and Thunderbird versions before 151.0.0.

Defensive priority

High. This is a patch-priority issue for supported Firefox and Thunderbird deployments because the vulnerability can elevate privileges and carries a high CVSS score.

Recommended defensive actions

  • Upgrade Mozilla Firefox to version 151 or later.
  • Upgrade Mozilla Thunderbird to version 151 or later.
  • Verify deployed versions are not below 151.0.0 for either product.
  • Prioritize remediation on endpoints where users routinely interact with Firefox or Thunderbird.
  • Review Mozilla’s security advisories for deployment guidance and update status.

Evidence notes

This debrief is based on the official CVE and NVD records supplied in the source corpus. The NVD entry for CVE-2026-8952 lists Mozilla Firefox and Thunderbird as vulnerable below 151.0.0 and cites Mozilla security advisories as references. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and the record includes CWE-269. Published and modified timestamps used here come from the supplied CVE metadata: published 2026-05-19T14:16:51.480Z and modified 2026-05-20T17:16:29.823Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8952 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8952

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8952 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8952

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.