CVE-2026-5735

Description

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

CVSS Details

CVSS Score

9.8

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:* - VULNERABLE

Mozilla Firefox < 149.0.2

Mozilla Thunderbird < 149.0.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- PoC for Memory Corruption in Firefox/Thunderbird -->
<!-- This is a generic template for triggering browser crashes -->
<html>
<body>
<script>
try {
    // Attempt to trigger memory corruption via complex DOM manipulation
    let buffer = new ArrayBuffer(0x100000);
    let view = new Uint8Array(buffer);
    for(let i=0; i<view.length; i++) {
        view[i] = 0x41;
    }
    // Simulate a use-after-free scenario (Conceptual)
    let element = document.createElement('div');
    document.body.appendChild(element);
    document.body.removeChild(element);
    // Access the freed element to potentially trigger crash
    element.innerHTML = 'Test';
} catch(e) {
    console.log('PoC execution failed');
}
</script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-5735
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-5735
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-5735/
[4] VulDB https://vuldb.com/cve/CVE-2026-5735
[5] https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025475%2C2025477
[6] https://www.mozilla.org/security/advisories/mfsa2026-25/
[7] https://www.mozilla.org/security/advisories/mfsa2026-28/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-5735", "sourceIdentifier": "[email protected]", "published": "2026-04-07T13:16:47.763", "lastModified": "2026-05-10T21:16:29.483", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-787"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "149.0.2", "matchCriteriaId": "CF910B3C-C241-48B5-9066-260750E8E7ED"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "versionEndExcluding": "149.0.2", "matchCriteriaId": "5FB6BDEF-D9FC-4C5C-9098-03DCA98223D3"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025475%2C2025477", "source": "[email protected]", "tags": ["Broken Link", "Issue Tracking"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-25/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-28/", "source": "[email protected]"}]}}