CVE-2026-8958 Mozilla CVE debrief

Who should care

Firefox and Thunderbird users, endpoint administrators, and security teams responsible for browser and mail-client patching should prioritize this CVE, especially on systems that rely on browser sandboxing for containment.

Technical summary

The NVD record classifies this issue with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network reachability, no privileges required, no user interaction, and high confidentiality impact with changed scope. NVD also maps the issue to CWE-668 and CWE-693. The public description states that the flaw is in Mozilla's process sandboxing and can result in information disclosure and sandbox escape.

Defensive priority

High. The combination of no user interaction, no privileges, high confidentiality impact, and sandbox boundary impact makes this a strong patch-priority issue for Mozilla deployments.

Recommended defensive actions

• Update Firefox to 151 or later, or Firefox ESR to 140.11 or later.
• Update Thunderbird to 151 or later, or Thunderbird ESR to 140.11 or later.
• Confirm affected version coverage across managed endpoints and user devices.
• Review Mozilla security advisories linked from the CVE record for vendor guidance and rollout details.
• Verify that patching completed successfully on all supported operating systems and deployment channels.

Evidence notes

This debrief is based only on the supplied NVD CVE record and the official Mozilla references listed there. The CVE description explicitly says "Information disclosure, sandbox escape in the Security: Process Sandboxing component" and states the issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. NVD shows the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, vulnerability status "Analyzed," and vulnerable CPE ranges ending before Firefox 151.0.0 / ESR 140.11.0 and Thunderbird 151.0.0 / ESR 140.11. The Bugzilla and Mozilla advisory URLs are included in the source corpus, but no advisory body text was provided here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.