HighCVE-2026-118008

    firefox: Improper Privilege Management (CVE-2026-118008)

    Published Sources: BSI

    What is affected, what to do

    Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

    Update firefox to version 153.4.0, thunderbird to version 153.4.0, Firefox to version 159.

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    8.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    8.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: BSI

    0.4 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 28.6

    Show all metrics
    Severity
    High
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    74.49 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    8.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    8.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.4 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    28.6
    Elevated — this CVE ranks above at least 10% of all CVEs scored today.
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: none known · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 27 October 2026
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-269

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

    Source: BSI WID Portal

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    mozillafirefox
    • 141.0 – < 153.4.0
    • 154.0.0 – < 157.0.0
    • < 140.17.0
    • 153.4.0
    • 157.0.0
    • 140.17.0
    mozillathunderbird
    • 141.0 – < 153.4.0
    • 154.0 – < 157.0
    • < 140.17.0
    • 153.4.0
    • 157.0
    • 140.17.0
    MozillaFirefox
    • < 159
    • 159
    MozillaFirefox ESR
    • < 115.44
    • < 153.6
    • 115.44
    • 153.6
    MozillaThunderbird
    • < 153.6
    • < 159
    • 153.6
    • 159
    From bundled advisories, not CVE-specific (17)

    Product list of a bundled advisory that does not state which product this CVE affects.

    Products from bundled advisories
    Affected versionsFixed in
    MozillaFirefox
    • < 157
    • < 158
    • < 158.0.1
    • 157
    • 158
    • 158.0.1
    MozillaFirefox ESR
    • < 115.42
    • < 115.43
    • < 115.43.1
    • < 140.17
    • < 153.4
    • < 153.5
    • < 153.5.1
    • 115.42
    • 115.43
    • 115.43.1
    • 140.17
    • 153.4
    • 153.5
    • 153.5.1
    mozillaMozilla Firefox and Firefox ESR
    • < 115.44
    • < 153.6
    • < 159
    • 115.44
    • 153.6
    • 159
    MozillaThunderbird
    • < 153.5
    • < 153.5.1
    • < 158
    • < 158.0.1
    • 153.5
    • 153.5.1
    • 158
    • 158.0.1

    Affected operating systems

    Affected operating systems
    Linuxdebianfirefox-esrbookworm
    Linuxdebianfirefox-esrtrixie
    Linuxdebianthunderbirdbookworm
    Linuxdebianthunderbirdtrixie

    Weakness classes (CWE)

    • CWE-269Improper Privilege Management

      Class

      The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

      Entry at MITRE CWE-269

    References & sources

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    1. Record modifiedCISA ADP

      CISA assessment (SSVC): exploitation: none known, automatable: no

      Show 2 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      SSVC assessmentremoved
      {"id":"CVE-2026-118008","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T14:28:16.218311Z"}
      —
      SSVC assessmentadded
      —
      {"id":"CVE-2026-118008","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T00:00:00+00:00"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    2. Record modifiedMozilla

      Description added or changed

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionchanged
      Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.
      Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
      Affected versions (publisher)added
      —
      Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/118xxx/CVE-2026-118008.json">CVE-2026-118008</a>
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-121/

      Source identifier: security@mozilla.org

    3. Record modifiedCISA ADP

      CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

      CISA assessment (SSVC): exploitation: none known, automatable: no

      Weakness type: CWE-269

      Show 3 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      CVSSadded
      —
      AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
      Weakness type (CWE)added
      —
      CWE-269
      SSVC assessmentadded
      —
      {"id":"CVE-2026-118008","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-27T14:28:16.218311Z"}

      Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    4. ReceivedMozilla

      Description added or changed

      Show 4 original changes
      Individual changes of this event as published by NVD
      TypeActionBeforeAfter
      Descriptionadded
      —
      Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.
      Affected versions (publisher)added
      —
      New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/118xxx/CVE-2026-118008.json">CVE-2026-118008</a>
      Referenceadded
      —
      https://bugzilla.mozilla.org/show_bug.cgi?id=2075440
      Referenceadded
      —
      https://www.mozilla.org/security/advisories/mfsa2026-118/

      Source identifier: security@mozilla.org

    Linked CVEs

    Linked CVEs
    Not ratedCVE-2026-118180Matrix homeserver could redirect the chat session to a local file or network share——
    Not ratedCVE-2026-118179Request forgery via news: links——
    Not ratedCVE-2026-118178RSS feed could redirect its subscription to a local file or network share——
    Not ratedCVE-2026-118177Calendar discovery accepted local file and remote network share locations——
    Not ratedCVE-2026-118176Bypass of remote UNC path restriction in mailbox: URLs——
    Not ratedCVE-2026-118175Content of other messages could be included when replying to a crafted message——
    Not ratedCVE-2026-118174Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment——
    Not ratedCVE-2026-118027Frame poisoning in the Layout component——
    Not ratedCVE-2026-118026Invalid pointer in the JavaScript: GC component——
    Not ratedCVE-2026-118025Other issue in the SVG component——
    Not ratedCVE-2026-118024Use-after-free in the Graphics: Text component——
    Not ratedCVE-2026-118023Sandbox escape due to use-after-free in the Graphics: WebRender component——
    Not ratedCVE-2026-118022Sandbox escape due to use-after-free in the Disability Access APIs component——
    Not ratedCVE-2026-118021Sandbox escape due to use-after-free in the XPCOM component——
    Not ratedCVE-2026-118020Use-after-free in the Layout component——
    Not ratedCVE-2026-118019Race condition, use-after-free in the DOM: File component——
    Not ratedCVE-2026-118018Spoofing issue in the Downloads component in Firefox for Android——
    Not ratedCVE-2026-118017Use-after-free in the SVG component——
    Not ratedCVE-2026-118016Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-118015Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-118014Use-after-free in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-118013Use-after-free in the Layout: Images, Video, and HTML Frames component——
    Not ratedCVE-2026-118012Use-after-free in the DOM: Animation component——
    Not ratedCVE-2026-118011Frame poisoning in the CSS Parsing and Computation component——
    Show 156 more CVEs
    Linked CVEs
    Not ratedCVE-2026-118010Use-after-free in the Disability Access APIs component——
    Not ratedCVE-2026-118009Integer overflow, use-after-free in the Graphics: Text component——
    HighCVE-2026-118008Privilege escalation in the DOM: Navigation component8.8—
    Not ratedCVE-2026-118007Use-after-free in the JavaScript: GC component——
    Not ratedCVE-2026-118006Privilege escalation due to use-after-free in the WebRTC: Signaling component——
    Not ratedCVE-2026-118005Use-after-free in the WebRTC: Signaling component——
    Not ratedCVE-2026-118004Incorrect boundary conditions in the CSS Transitions and Animations component——
    Not ratedCVE-2026-118003Information disclosure in the Networking: DNS component——
    Not ratedCVE-2026-118002Information disclosure due to race condition in the Networking component——
    Not ratedCVE-2026-118000Information disclosure in the Networking: HTTP component——
    Not ratedCVE-2026-117999Race condition in the IPC component——
    Not ratedCVE-2026-117998Mitigation bypass in the DOM: Push Subscriptions component——
    Not ratedCVE-2026-117997Sandbox escape due to use-after-free in the Widget component——
    Not ratedCVE-2026-117996Incorrect boundary conditions in the WebRTC component——
    Not ratedCVE-2026-117995Privilege escalation in the DOM: UI Events & Focus Handling component——
    Not ratedCVE-2026-117994Use-after-free in the JavaScript: GC component——
    Not ratedCVE-2026-117993Integer overflow in the Graphics: Text component——
    Not ratedCVE-2026-117992Information disclosure in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117991Incorrect boundary conditions in the Layout: Text and Fonts component——
    Not ratedCVE-2026-117990Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component——
    Not ratedCVE-2026-117989Use-after-free in the Graphics component——
    Not ratedCVE-2026-117988Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component——
    Not ratedCVE-2026-117987Use-after-free in the Graphics component——
    Not ratedCVE-2026-117986Use-after-free in the Graphics component——
    Not ratedCVE-2026-117985Sandbox escape due to use-after-free in the Graphics component——
    Not ratedCVE-2026-117984Incorrect boundary conditions in the Layout: Scrolling and Overflow component——
    Not ratedCVE-2026-117983Use-after-free in the Graphics component——
    Not ratedCVE-2026-117982Invalid pointer in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117981Privilege escalation in the Toolkit component——
    Not ratedCVE-2026-117980Use-after-free in the Graphics component——
    Not ratedCVE-2026-117979Incorrect boundary conditions in the Graphics: WebRender component——
    Not ratedCVE-2026-117978Incorrect boundary conditions in the Graphics component——
    Not ratedCVE-2026-117977Other issue in the Console component——
    Not ratedCVE-2026-117976Site isolation issue in the DOM: Navigation component——
    Not ratedCVE-2026-117975Sandbox escape due to invalid pointer in the Graphics: WebRender component——
    Not ratedCVE-2026-117974Use-after-free in the XML component——
    Not ratedCVE-2026-117973Use-after-free in the Networking: DNS component——
    Not ratedCVE-2026-117972Use-after-free in the Graphics component——
    Not ratedCVE-2026-117971Sandbox escape due to use-after-free in the Print Preview component——
    Not ratedCVE-2026-117970Race condition in the Disability Access APIs component——
    Not ratedCVE-2026-117969Invalid pointer in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117968Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117967Mitigation bypass in the DOM: Security component——
    Not ratedCVE-2026-117966Site isolation issue in the Networking: HTTP component——
    Not ratedCVE-2026-117965Same-origin policy bypass in the Address Bar component——
    Not ratedCVE-2026-117964Use-after-free in the Panning and Zooming component——
    Not ratedCVE-2026-117963Incorrect boundary conditions in the DOM: Service Workers component——
    Not ratedCVE-2026-117962Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component——
    Not ratedCVE-2026-117961Incorrect boundary conditions in the Layout: Text and Fonts component——
    Not ratedCVE-2026-117960Spoofing issue in the DOM: Core & HTML component——
    Not ratedCVE-2026-117959Site isolation issue in the DOM: Service Workers component——
    Not ratedCVE-2026-117958Site isolation issue in the Networking: HTTP component——
    Not ratedCVE-2026-117957Cryptographic issue in the WebRTC: Networking component——
    Not ratedCVE-2026-117956Invalid pointer in the Nimbus Desktop Client component——
    Not ratedCVE-2026-117955JIT miscompilation in the JavaScript: WebAssembly component——
    Not ratedCVE-2026-117954Use-after-free in the Layout: Positioned component——
    Not ratedCVE-2026-117953Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117952Uninitialized memory in the Networking component——
    Not ratedCVE-2026-117951Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117950Incorrect boundary conditions in the DOM: Core & HTML component——
    Not ratedCVE-2026-117949Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117948Use-after-free in the SVG component——
    Not ratedCVE-2026-117947Use-after-free in the XML component——
    Not ratedCVE-2026-117946Incorrect boundary conditions in the JavaScript Engine component——
    Not ratedCVE-2026-117945Incorrect boundary conditions in the XML component——
    Not ratedCVE-2026-117944Use-after-free in the Layout component——
    Not ratedCVE-2026-117943Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117942Incorrect boundary conditions in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117941Use-after-free in the DOM: CSS Object Model component——
    Not ratedCVE-2026-117940Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117939Use-after-free in the XML component——
    Not ratedCVE-2026-117938Use-after-free in the Layout component——
    Not ratedCVE-2026-117937Invalid pointer in the JavaScript Engine component——
    Not ratedCVE-2026-117936Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117935Use-after-free in the DOM: Bindings (WebIDL) component——
    Not ratedCVE-2026-117934Use-after-free in the Layout component——
    Not ratedCVE-2026-117933Frame poisoning in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117932Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117931Use-after-free in the DOM: Events component——
    Not ratedCVE-2026-117930Use-after-free in the DOM: Bindings (WebIDL) component——
    Not ratedCVE-2026-117929Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117928Same-origin policy bypass in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117927Use-after-free in the SVG component——
    Not ratedCVE-2026-117926Incorrect boundary conditions in the SVG component——
    Not ratedCVE-2026-117925Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117924Use-after-free in the XSLT component——
    Not ratedCVE-2026-117923Use-after-free in the Audio/Video component——
    Not ratedCVE-2026-117922Use-after-free in the Networking: WebSockets component——
    Not ratedCVE-2026-117921Use-after-free in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117920Use-after-free in the DOM: HTML Parser component——
    Not ratedCVE-2026-117919Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117918Use-after-free in the Graphics: Canvas2D component——
    Not ratedCVE-2026-117917Invalid pointer in the Graphics: WebRender component——
    Not ratedCVE-2026-117916Use-after-free in the XSLT component——
    Not ratedCVE-2026-117915Incorrect boundary conditions in the Layout: Block and Inline component——
    Not ratedCVE-2026-117914Use-after-free in the SVG component——
    Not ratedCVE-2026-117913Use-after-free in the SVG component——
    Not ratedCVE-2026-117912Same-origin policy bypass in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117911Use-after-free in the Audio/Video: Playback component——
    Not ratedCVE-2026-117910Invalid pointer in the JavaScript Engine component——
    Not ratedCVE-2026-117909Use-after-free in the JavaScript: GC component——
    Not ratedCVE-2026-117908Use-after-free in the Graphics: ImageLib component——
    Not ratedCVE-2026-117907Use-after-free in the Networking component——
    Not ratedCVE-2026-117906Use-after-free in the CSS Parsing and Computation component——
    Not ratedCVE-2026-117905Use-after-free in the Audio/Video: Playback component——
    Not ratedCVE-2026-117904Use-after-free in the JavaScript: GC component——
    Not ratedCVE-2026-117903Use-after-free in the Audio/Video component——
    Not ratedCVE-2026-117902Use-after-free in the Layout: Text and Fonts component——
    Not ratedCVE-2026-117901Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117900Use-after-free in the DOM: Editor component——
    Not ratedCVE-2026-117899Use-after-free in the Networking: HTTP component——
    Not ratedCVE-2026-117898Use-after-free in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117897Incorrect boundary conditions in the Layout: Tables component——
    Not ratedCVE-2026-117896Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117895Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117894Incorrect boundary conditions in the WebRTC: Signaling component——
    Not ratedCVE-2026-117893Incorrect boundary conditions in the Security: PSM component——
    Not ratedCVE-2026-117892Privilege escalation due to use-after-free in the WebRTC: Networking component——
    Not ratedCVE-2026-117891Use-after-free in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117890JIT miscompilation in the JavaScript Engine: JIT component——
    Not ratedCVE-2026-117889Incorrect boundary conditions in the JavaScript Engine component——
    Not ratedCVE-2026-117888Uninitialized memory in the Graphics: Canvas2D component——
    Not ratedCVE-2026-117887Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117886Incorrect boundary conditions in the Graphics: Text component——
    Not ratedCVE-2026-117885Use-after-free in the Layout: Grid component——
    Not ratedCVE-2026-117884Use-after-free in the Networking component——
    Not ratedCVE-2026-117883Use-after-free in the DOM: HTML Parser component——
    Not ratedCVE-2026-117882Use-after-free in the Layout component——
    Not ratedCVE-2026-117881Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117880Use-after-free in the XML component——
    Not ratedCVE-2026-117879Incorrect boundary conditions in the Layout: Tables component——
    Not ratedCVE-2026-117878Other issue, use-after-free in the Storage: IndexedDB component——
    Not ratedCVE-2026-117877Use-after-free in the Layout: Text and Fonts component——
    Not ratedCVE-2026-117876Use-after-free in the Layout: Text and Fonts component——
    Not ratedCVE-2026-117875Use-after-free in the Layout: Scrolling and Overflow component——
    Not ratedCVE-2026-117874Use-after-free in the Internationalization component——
    Not ratedCVE-2026-117873Incorrect boundary conditions in the Audio/Video: Playback component——
    Not ratedCVE-2026-117872Use-after-free in the JavaScript: Standard Library component——
    Not ratedCVE-2026-117871Invalid pointer in the Graphics component——
    Not ratedCVE-2026-117870Use-after-free in the JavaScript Engine component——
    Not ratedCVE-2026-117869Use-after-free in the DOM: Core & HTML component——
    Not ratedCVE-2026-117868Sandbox escape in the DOM: Networking component——
    Not ratedCVE-2026-117867Use-after-free in the Layout component——
    Not ratedCVE-2026-117866Privilege escalation due to use-after-free in the Graphics: Canvas2D component——
    Not ratedCVE-2026-117865Use-after-free in the JavaScript: GC component——
    Not ratedCVE-2026-117864Sandbox escape in the Form Manager component——
    Not ratedCVE-2026-117863Information disclosure due to uninitialized memory in the Audio/Video component——
    Not ratedCVE-2026-117862Privilege escalation due to incorrect boundary conditions in the Networking component——
    Not ratedCVE-2026-117861Sandbox escape in the DOM: Navigation component——
    Not ratedCVE-2026-117860Same-origin policy bypass in the DOM: Navigation component——
    MediumCVE-2026-113869Use-after-free in S/MIME decryption during a security device password prompt5.4—
    HighCVE-2026-110247Integer overflow in libmime buffer growth could lead to heap corruption8.4—
    CriticalCVE-2026-109708Sandbox escape due to incorrect boundary conditions in the Networking component9.6—
    CriticalCVE-2026-109707Sandbox escape due to use-after-free in the Networking component9.6—
    CriticalCVE-2026-109705Debian Thunderbird: Use After Free9.6—
    HighCVE-2026-100801Privilege escalation in the DLL Services component8.8—
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-118008
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-118008"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-118008.svg?lang=en" alt="CVE-2026-118008 – NEOSEC Intel" height="20"></a>