Mozilla Firefox 151 Security Advisory: Multiple Vulnerabilities Fix (Sandbox Escape, RCE, CVEs)

Mozilla Security Advisory 2026-46 Vulnerability Overview The Mozilla Foundation has released a security advisory regarding Firefox 151. This update fixes multiple security vulnerabilities, including sandbox escapes, privilege escalation, same-origin policy bypasses, integer overflows, information disclosure, denial of service, and memory safety vulnerabilities. Impact Scope Affected Product: Firefox 151 Advisory Date: May 19, 2026 Overall Impact: High Remediation Upgrade to Firefox 151 to fix all listed vulnerabilities. Detailed Vulnerability List High Impact CVE-2026-8945: Sandbox escape in Firefox and Firefox Focus for Android (Reporter: Daisuke Hatakeyama) CVE-2026-8946: Audio/Video: Off-by-one error in Web Codecs (Reporter: zx) CVE-2026-8947: DOM: Use-after-free in Bindings (WebIDL) (Reporter: Satoshi Tsuji) CVE-2026-8948: DOM: Same-origin policy bypass in Networking (Reporter: satyamasd) CVE-2026-8973: Memory safety bug in Firefox 151 (Reporter: Andrew Creskey et al.) CVE-2026-8974: Memory safety bug in Firefox ESR 140.11 and Firefox 151 (Reporter: Nika Layzell et al.) Moderate Impact CVE-2026-8949: Widget: Integer overflow in Win32 (Reporter: q1) CVE-2026-8950: Networking: Same-origin policy bypass in HTTP (Reporter: Jakub Szymsza) CVE-2026-8951: UI spoofing in Firefox for Android Toolbar (Reporter: yfbug123) CVE-2026-8952: Privilege escalation in Application Update (Reporter: Tomoya Nakanishi) CVE-2026-8953: Sandbox escape in Disability Access APIs (Reporter: stevej) CVE-2026-8954: Off-by-one error and integer overflow in Audio/Video (Reporter: Ameen Basha M K) CVE-2026-8955: Privilege escalation in DOM: Workers (Reporter: lebr0nli) CVE-2026-8956: Integer overflow in Networking: JAR (Reporter: Yaqoob Aldurayhim) CVE-2026-8957: Privilege escalation in Enterprise Policies (Reporter: Mateusz Dobrzyński) CVE-2026-8958: Information disclosure and sandbox escape in Security: Process Sandboxing (Reporter: Yaqoob Aldurayhim) CVE-2026-8959: Sandbox escape in Widget: Win32 (Reporter: Ameen Basha M K) Low Impact CVE-2026-8960: UI spoofing in WebExtensions (Reporter: Kanaru Sato) CVE-2026-8961: UI spoofing in Form Autofill (Reporter: Hafizh) CVE-2026-8962: Mitigation bypass in DOM: Security (Reporter: Manojkumar Jaganathan) CVE-2026-8963: UI spoofing in Web Speech (Reporter: Qadhfay Muhammad Tera) CVE-2026-8964: UI spoofing in Popup Blocker (Reporter: Satoshi Tsuji) CVE-2026-8965: Information disclosure in DOM: Security (Reporter: Shihab Mirza) CVE-2026-8966: Information disclosure in IP Protection (Reporter: Rintaro Kobayashi) CVE-2026-8967: Information disclosure in Graphics: WebGPU (Reporter: Inseo An) CVE-2026-8968: Denial of service in Audio/Video: Web Codecs (Reporter: Tristan Madani) CVE-2026-8969: Mitigation bypass in DOM: Security (Reporter: Atsushi Sada) CVE-2026-8970: Privilege escalation in Security (Reporter: pakhunov.anton.n) CVE-2026-8971: Same-origin policy bypass in Networking: JAR (Reporter: Surya Dev Singh) CVE-2026-8972: Privilege escalation in WebRTC: Audio/Video (Reporter: pakhunov.anton.n) (Note: Specific POC code or exploit code is not included in the page)

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox 151 Security Advisory: Multiple Vulnerabilities Fix (Sandbox Escape, RCE, CVEs)