PT-2026-41913

CVE-2026-8959

Published

2026-05-19

Updated

2026-06-29

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 151 Firefox ESR versions prior to 140.11 Thunderbird versions prior to 151 Thunderbird versions prior to 140.11

Description Incorrect boundary conditions in the Widget: Win32 component allow for a sandbox escape, which occurs when a process breaks out of its restricted environment to access the broader system.

Recommendations Update to version 151 Update to version 140.11 Update to version 151 Update to version 140.11

Exploitability

Fix

Impacts

Researchers

Ameen Basha M K

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-693: Protection Mechanism Failure

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer