CVE-2026-8094
CRITICALMozilla Firefox and Thunderbird 140.10.2 - WebRTC Code Injection
Title source: manualDescription
Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
References (17)
Core 17
Core References
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19160
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20566
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:20574
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24508
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24509
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24510
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24511
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24516
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24755
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:24983
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:25015
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-8094
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2467706
Scores
CVSS v3
9.8
EPSS
0.0045
EPSS Percentile
35.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (4)
mozilla/firefox
< 140.10.2
Mozilla/Firefox
140.10.2
mozilla/thunderbird
< 140.10.2
Mozilla/Thunderbird
140.10.2
Published
May 07, 2026
Tracked Since
May 07, 2026