CVE-2026-14241 covers memory safety bugs in Mozilla Firefox 152.0.3, rated critical at CVSS 9.8. Mozilla says some of them showed evidence of memory corruption and could probably be turned into arbitrary code execution with enough effort. The fix is Firefox 152.0.4. Update the browser everywhere and restart it so the new build is actually running.
What's affected
- Product: Mozilla Firefox.
- Affected: Firefox 152.0.3, the version named in the advisory.
- Fixed: Firefox 152.0.4, announced on 30 June 2026 in Mozilla Foundation Security Advisory 2026-62.
- Severity: Mozilla rates the advisory impact as high. The CVE record scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Exploited in the wild: the record is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not report active exploitation.
The advisory is a roll up. It points to two Bugzilla groupings, one for high severity memory safety bugs and one for moderate severity ones, all fixed in 152.0.4. The bug entries were not readable when this post was written, so the advisory itself is the source for scope.
How to check if you're exposed
Check the version on each machine that runs Firefox. On a desktop, open the menu, choose Help, then About Firefox. It shows the version and downloads any pending update. From a terminal on Linux or macOS:
firefox --version
On a managed fleet, pull the installed version from your endpoint inventory or software deployment tool and filter for anything below 152.0.4. Do not forget kiosks, shared lab machines and virtual desktops, which tend to sit on old builds because nobody restarts them.
Firefox only applies an update after a restart. A machine that downloaded 152.0.4 but has had the browser open for weeks is still running the old code, so ask for restarts, not only for patch status.
What to do now
- Update Firefox to 152.0.4 or later on every endpoint, including servers or virtual desktops that run a browser.
- Force a restart. Use your device management tool to prompt users, or schedule a restart window for shared machines.
- Re-run your inventory query a day later and list anything still below 152.0.4.
- If you package Firefox inside another product or image, rebuild the image from the updated base and redeploy it.
- Check that automatic updates are not blocked by policy on machines that sit outside your normal patching rhythm.
Why it matters
The advisory describes memory safety bugs, and the CVE record maps them to CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-787 (out-of-bounds write). These are the classic failure of code written in languages that leave memory management to the programmer. A bug that reads or writes outside its intended buffer can corrupt data the program trusts, and with enough work an attacker may steer that corruption into running their own code.
The record rates the attack vector as network with no privileges and no user interaction beyond what a browser does when it renders content. That is why the score is so high, and why a browser is a worthwhile target: it processes untrusted input from the whole internet all day. Mozilla's wording is careful. It says the bugs showed evidence of memory corruption and that it presumes some could be exploited. It does not claim a working exploit exists, and neither should an internal ticket.
For most organizations the practical answer is dull and effective. Keep browsers on automatic update, track the version across the fleet like any other software inventory, and treat a restart as part of the patch. Browsers rarely appear in the dependency manifests that scanners read, so make sure your asset inventory covers them separately.
Try it yourself
This walkthrough shows how a fix that already exists gets matched to the affected software, which is exactly the situation with a browser update.
Click through it at your own pace, or open it full screen.
Quick check
Is Firefox 152.0.4 the only fixed version?
The advisory names 152.0.4 as the release that fixes these bugs. If a newer release is available when you read this, installing that is fine too. Check Mozilla's advisory page for later guidance.
Does this mean attackers are using it now?
The record is not on the CISA Known Exploited Vulnerabilities list and the advisory does not say it is exploited. Mozilla says only that some bugs could probably be exploited with enough effort. Patch on a normal urgent schedule.
Sources
Last reviewed: 19 October 2026.
