CVE-2026-8391 - Vulnerability Details

- Other issue in the JavaScript Engine component

Description

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Published: 2026-05-12

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The CVE documents an unspecified issue within Mozilla Firefox's JavaScript engine that was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11. No explicit impact is described by Mozilla; the associated CWE identifiers (CWE‑119, CWE‑20, CWE‑475, CWE‑79) suggest potential weaknesses such as buffer overflows, input validation failures, or cross‑site scripting, but the real impact on confidentiality, integrity, or availability is not stated.

Affected Systems

All Mozilla Firefox installations running any version prior to 150.0.3 and all Mozilla Thunderbird installations running any version prior to 140.11 are affected. No other vendors or products are reported to be vulnerable.

Risk and Exploitability

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a web‑based or browser‑context delivery of malicious JavaScript, although no concrete exploitation is documented at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.36`	unaffected	≤ 115.*
`140.11`	unaffected	≤ 140.*
`150.0.3`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.11`	unaffected	≤ *

Configuration 1 [-]

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*

No data.

Vendor Product Confidence Versions

Mozilla

Firefox

100%

Version	Status	Scheme	Platform
`[150.0.3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Firefox to version 150.0.3 or later from trusted Mozilla sources.
Enable automatic updates or regularly check Mozilla's security advisories for patches.
If an immediate upgrade is impossible, disable or restrict JavaScript execution from untrusted or external domains using browser settings or a content security policy.

Generated by OpenCVE AI on May 20, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4592-1	firefox-esr security update
Debian DLA	DLA-4594-1	thunderbird security update
Debian DSA	DSA-6283-1	firefox-esr security update
Debian DSA	DSA-6288-1	thunderbird security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00109.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2038575
https://nvd.nist.gov/vuln/detail/CVE-2026-8391
https://www.cve.org/CVERecord?id=CVE-2026-8391
https://www.mozilla.org/security/advisories/mfsa2026-45/
https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8391
https://www.mozilla.org/security/advisories/mfsa2026-47/
https://www.mozilla.org/security/advisories/mfsa2026-48/
https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8391
https://www.mozilla.org/security/advisories/mfsa2026-51/

History

Wed, 20 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-475
References		https://nvd.nist.gov/vuln/detail/CVE-2026-8391 https://www.cve.org/CVERecord?id=CVE-2026-8391 https://www.mozilla.org/security/advisories/mfsa2026-45/#CVE-2026-8391 https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8391
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 19 May 2026 17:45:00 +0000

Type	Values Removed	Values Added
Description	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11.	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
References		https://www.mozilla.org/security/advisories/mfsa2026-51/

Tue, 19 May 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3.	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, and Firefox ESR 140.11.
References		https://www.mozilla.org/security/advisories/mfsa2026-47/ https://www.mozilla.org/security/advisories/mfsa2026-48/

Wed, 13 May 2026 19:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-94

Wed, 13 May 2026 17:30:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::*

Wed, 13 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-20
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 12 May 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-79 CWE-94

Tue, 12 May 2026 15:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Tue, 12 May 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3.
Title		Other issue in the JavaScript Engine component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2038575 https://www.mozilla.org/security/advisories/mfsa2026-45/

Subscriptions

Mozilla Firefox

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2026-05-12T12:36:15.548Z

Updated: 2026-05-19T17:10:47.079Z

Reserved: 2026-05-12T12:36:14.816Z

Link: CVE-2026-8391

Vulnrichment

Updated: 2026-05-13T15:47:13.828Z

NVD

Status : Modified

Published: 2026-05-12T14:17:12.173

Modified: 2026-05-19T18:16:31.347

Link: CVE-2026-8391

Redhat

Severity : Important

Publid Date: 2026-05-12T12:36:15Z

Links: CVE-2026-8391 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-20T01:30:06Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-20
Improper Input Validation
CWE-475
Undefined Behavior for Input to API
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object