Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
3376 articles · 142292 vulns · 36/41 feeds (7d)
← Back to list
9.8
CVE-2026-8091EXPLOITEDPATCHED
mozilla · firefox

Incorrect boundary conditions in the Audio/Video: Playback component

Description

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

Affected Products

VendorProductVersions
mozillafirefox—

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
mozillafirefoxcert_advisory90%
mozillafirefox esrcert_advisory90%

References

  • https://bugzilla.mozilla.org/show_bug.cgi?id=2029301
  • https://www.mozilla.org/security/advisories/mfsa2026-30/
  • https://www.mozilla.org/security/advisories/mfsa2026-33/
  • https://www.mozilla.org/security/advisories/mfsa2026-36/
  • https://www.mozilla.org/security/advisories/mfsa2026-39/
  • https://www.mozilla.org/security/advisories/mfsa2026-42/

Related News (3 articles)

Tier B
CERT-FR21h ago
Multiples vulnérabilités dans les produits Mozilla (11 mai 2026)
→ No new info (linked only)
Tier B
BSI Advisories3d ago
[NEU] [mittel] Mozilla Firefox und Firefox ESR: Mehrere Schwachstellen
→ No new info (linked only)
Tier C
VulDB4d ago
CVE-2026-8091 | Mozilla Firefox up to 115.35.1/140.10.1 Playback memory corruption
→ No new info (linked only)
CVSS 3.19.8 CRITICAL
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
115.35.2140.10.2
PublishedMay 7, 2026
Last enriched4d agov2
Trending Score71
Source articles3
Independent3
Info Completeness7/14
Missing: cvss, epss, cwe, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-8090EXP
Use-after-free in the DOM: Networking component
Trending: 64
HIGHCVE-2026-8092EXP
Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2
Trending: 60
HIGHCVE-2026-8093EXP
Memory safety bugs fixed in Thunderbird 150.0.2
Trending: 60
CRITICALCVE-2026-8094
Other issue in the WebRTC component
Trending: 55
CRITICALCVE-2026-7321
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component
Trending: 44

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
May 7, 2026
Discovered by ZDM
May 7, 2026
Updated: description, severity, affectedVersions, activelyExploited
May 7, 2026
Actively Exploited
May 8, 2026
Patch Available
May 8, 2026

Version History

v2
Last enriched 4d ago
v2Tier C4d ago

Updated severity to CRITICAL, added affected versions 115.35.1 and 140.10.1, and corrected exploit availability to false.

descriptionseverityaffectedVersionsactivelyExploited
via VulDB
v14d ago

Initial creation