CVE-2026-2793: Memory Safety Bugs in Firefox 147 and ESR 115.32

CVE-2026-2793 is a critical group of memory safety bugs (CVSS 9.8) in Firefox and Thunderbird. Mozilla announced the fix on 24 February 2026 in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8. Update to those releases or later. The record does not mark it as a CISA Known Exploited Vulnerability.

What's affected

Mozilla says the bugs were present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. They are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148 and Thunderbird 140.8.

NVD scores the group 9.8 (Critical). Mozilla's advisory rates it high.

How to check if you're exposed

Check the version you run against the fixed releases.

• Firefox: open the menu, choose Help, then About Firefox. The dialog shows the version and checks for an update.
• Thunderbird: open Help, then About Thunderbird.

From a terminal, on systems where the binaries are on your path:

firefox --version
thunderbird --version

Linux distributions often ship fixes under their own package versions. If you install from a distribution repository, check your distributor's security notice for this CVE instead of comparing version numbers by eye. In a managed fleet, look at your software inventory for Firefox and Thunderbird builds below the fixed releases.

What to do now

1. Update Firefox and Thunderbird to Firefox 148 or later on your release channel, or to the matching ESR release.
2. On managed desktops, push the update through your normal software deployment tool and confirm the installed versions afterwards.
3. Restart both applications. A browser that has downloaded an update keeps running the old code until it restarts.
4. Check the advisory for your exact branch if you run an ESR or a distribution package.

Why it matters

Mozilla says these are memory safety bugs, that some showed evidence of memory corruption, and that with enough effort some could probably have been exploited to run arbitrary code. That wording is the vendor's own assessment, not a report of attacks. NVD files the group under CWE-787 (Out-of-bounds Write).

Browsers and mail clients process content from outside your organisation all day, so a fix in either is worth rolling out quickly even when the vendor's rating is lower than the NVD score.

Memory safety bundles like this one collect several bugs into a single CVE, so one entry can stand for more than one underlying defect. The bug links in the advisory are the place to look for the individual fixes.

Rolling the update out

Browser and mail updates are easy to start and easy to leave half finished. A few habits help.

Treat Firefox and Thunderbird as two separate rollouts. Thunderbird is easy to forget because users open it less often and it may not sit in the same management group as the browser.

Check the installed version after the update, not the policy that sent it. Inventory tools show builds that downloaded an update but never restarted, and those still run the old code.

If you run an ESR branch, confirm which ESR the fix covers. The records list ESR 115.33, ESR 140.8 or both depending on the CVE, and the advisory pages show which branch each fix reached.

Keep a note of the date you applied the update and the versions you reached. That record answers audit and customer questions later without a scramble.

Quick check

Sources

• Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
• Mozilla Foundation Security Advisory 2026-14 (Firefox ESR 115.33)
• Mozilla Foundation Security Advisory 2026-15 (Firefox ESR 140.8)
• Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)

Last reviewed: 19 October 2026.