Firefox and Thunderbird: two critical memory flaws rated CVSS 9.8, update as so…

What happened

On October 27, 2026, Mozilla released security updates for the Firefox browser and the Thunderbird email client. Among dozens of fixed bugs, two are listed as critical in the NVD database: CVE-2026-117946 in the JavaScript engine (the part of the browser that runs scripts on web pages) and CVE-2026-117945 in the component that processes XML.

Both flaws are of the same kind: the program does not properly guard the boundaries of the memory it works with. They are fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159 and Thunderbird 153.6. The JavaScript engine flaw is also fixed in the older supported branch, Firefox ESR 115.44.

Mozilla has also changed how it publishes advisories. Every memory safety bug it finds internally now gets its own CVE, which is why the current advisories are so long. As of November 5, 2026, neither flaw is in the CISA KEV catalog, and the EU Vulnerability Database (EUVD) run by ENISA does not report any exploitation. Mozilla’s advisories do not mention exploitation either.

Why it is dangerous

Think of an “improper memory boundaries” flaw (CWE-119) as a warehouse worker told to put ten boxes on a shelf who never checks where the shelf ends. The eleventh box lands on the neighboring shelf and crushes whatever was there. In software, this means data from a badly processed web page can overwrite another part of the browser’s memory. In the worst case, flaws of this kind can lead to running an attacker’s code, but Mozilla has not published the specific conditions.

CVSS is a zero-to-ten scale that expresses how severe a flaw is. Both flaws are rated 9.8 in the NVD database under CVSS version 3.1, which is critical. This score was not assigned by NVD itself but by another organization. Mozilla rates the overall impact of its advisories as “high”.

According to the CVSS vector, the attack works over the network, the attacker needs no login or privileges, and the rating assumes no further action from the victim. For a browser, this in practice means the risk lies in processing malicious content, such as a web page. The rating assumes high impact on confidentiality, integrity and availability, which potentially means data leaks, data tampering and crashes.

For Thunderbird, Mozilla notes that many of these flaws cannot be exploited through email, because scripting is disabled when reading mail. The risk remains wherever Thunderbird displays content the way a browser does.

EPSS is a model that estimates the probability that a flaw will be exploited within the next thirty days. As of November 5, 2026, it is very low for both flaws, under half a percent. The CISA KEV catalog lists flaws that the US agency CISA knows are actively exploited, and these two are not on it. Still, do not postpone the update: the browser is one of the most exposed programs in any company.

Who is affected

Firefox before 159
Firefox ESR before 153.6
Firefox ESR before 115.44 (only CVE-2026-117946, the XML flaw description does not mention the 115 branch)
Thunderbird before 159
Thunderbird before 153.6

This mainly concerns company desktops and laptops where people browse the web every day. Also pay attention to terminal servers (such as Remote Desktop or Citrix), where many users share one Firefox installation, and to Linux servers with a graphical desktop. The long-term support ESR versions are popular with organizations that want a stable environment, and they need the update too.

Neither Mozilla nor NVD lists other browsers as affected. If you run Firefox or Thunderbird from Linux distribution packages, follow your distribution’s security announcements, as it may ship the fix under its own package version.

How to check if you are affected

The easiest way: in Firefox, open the menu, choose Help and then About Firefox. In Thunderbird, it is Help and About Thunderbird. The window shows the version and checks for updates at the same time. In Firefox, you can also see details by typing about:support into the address bar.

On Linux, check the version with these read-only commands. On Ubuntu, Firefox is often installed as a snap package, in which case the snap list output is what counts, not dpkg:

firefox --version
thunderbird --version
dpkg -l 'firefox*' 'thunderbird*'
rpm -q firefox thunderbird
snap list firefox thunderbird

On Windows, in PowerShell:

(Get-Item "$env:ProgramFiles\Mozilla Firefox\firefox.exe").VersionInfo.ProductVersion
(Get-Item "$env:ProgramFiles\Mozilla Thunderbird\thunderbird.exe").VersionInfo.ProductVersion

If you manage many machines, check the software inventory in your management tool (Intune, SCCM, RMM) and look for every Firefox and Thunderbird installation.

How to fix it

Fixed versions: Firefox 159, Firefox ESR 153.6, Firefox ESR 115.44, Thunderbird 159 and Thunderbird 153.6. Mozilla does not list any temporary workaround, so updating is the only protection.

Start with Firefox on machines used for everyday browsing and on terminal servers. That is where the risk is highest.
Update regular Firefox to version 159. Opening the About Firefox window and restarting the browser is enough.
If you use ESR, move to 153.6 (the 153 branch) or 115.44 (the 115 branch). For the 115 branch, Mozilla lists only the JavaScript engine fix, so prefer the 153 branch where you can. With central management, deploy the new installer through Intune, GPO or another tool.
Then update Thunderbird to 159, or 153.6, depending on which branch you use.
On Linux, install the security updates from your distribution’s repository.
Make sure browsers were actually restarted after the update. As long as an old instance is running, the fix does not take effect.

Check that automatic updates are not disabled by company policy. If they are, set up a regular update process, because Mozilla ships security fixes often.

What if you may already be compromised

Neither Mozilla nor any other source has published indicators of compromise, and no exploitation is known. If you have reason to be suspicious, focus on general signs of a compromised browser.

Antivirus or EDR alerts where firefox.exe or thunderbird.exe launches unexpected processes, such as cmd.exe or powershell.exe.
Unknown extensions in about:addons and a changed home page or search engine.
New scheduled tasks, services or startup entries that nobody added.
Unknown local or domain accounts and unusual outbound connections from workstations.

If you find any of this, disconnect the machine from the network, do not wipe the traces, and bring in an incident response specialist. This applies especially to terminal servers or computers with access to sensitive data.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Firefox and Thunderbird: two critical memory flaws rated CVSS 9.8, update as soon as possible