CVE-2026-5735 covers memory safety bugs in Firefox 149.0.1 and Thunderbird 149.0.1. Mozilla fixed them in Firefox 149.0.2 and Thunderbird 149.0.2. Some bugs showed evidence of memory corruption, so update and restart both applications. Restart both applications after updating, since an update does not apply to a running process.
What's affected
Mozilla's advisory says the memory safety bugs were present in Firefox 149.0.1 and Thunderbird 149.0.1, and were fixed in Firefox 149.0.2 and Thunderbird 149.0.2. Unlike the sibling issue CVE-2026-5734, this record names no ESR version.
Mozilla says some of the bugs showed evidence of memory corruption and that it presumes some could be exploited to run arbitrary code with enough effort. The Mozilla bug entries behind this one are 2025475 and 2025477. The advisory is mfsa2026-25 for Firefox and mfsa2026-28 for Thunderbird.
For Thunderbird, Mozilla notes these flaws generally cannot be exploited through email in that product, because scripting is disabled when reading mail.
How to check if you're exposed
- In Firefox, open Help, then About Firefox. In Thunderbird, use Help, then About Thunderbird.
- A version of 149.0.1 is affected. Version 149.0.2 is the fixed release named in the record.
- Check managed machines with your software inventory tool.
- Linux distribution packages may carry their own version numbers. Red Hat, for one, tracks this issue in its own advisories.
What to do now
- Update Firefox to 149.0.2 or later.
- Update Thunderbird to 149.0.2 or later.
- Restart both applications so the update takes effect.
- Push the update through your fleet tools and check for stragglers.
- On Linux, install the package update from your distribution.
Why it matters
The record lists CWE-125, out-of-bounds read, and CWE-787, out-of-bounds write. These are the usual signs of memory safety bugs in a browser engine, which parses complicated content from untrusted sources.
The record is not in CISA's Known Exploited Vulnerabilities catalog, and Mozilla does not report any use in attacks. The network vector and absence of required privileges explain the 9.8 score. Fixed releases of Firefox usually land fast, so the work for most teams is making sure the update reaches every machine.
Quick check
How is this different from CVE-2026-5734?
Both are memory safety bug groups fixed in the 149.0.2 release. This one covers Firefox and Thunderbird 149.0.1 only, and the sibling record also names ESR 140.9.0.
Sources
Last reviewed: 19 October 2026.
