CVE-2026-8090: Use-after-free in the DOM: Networking component
Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 150.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 115.35.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.10.2 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 150.0.2 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.10.2 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.35.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 150.0.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.10.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-8090?
CVE-2026-8090 has been categorized as a critical severity vulnerability due to the potential for exploitation in the DOM networking component.
How do I fix CVE-2026-8090?
You can fix CVE-2026-8090 by updating to Firefox version 150.0.2, Firefox ESR version 140.10.2 or 115.35.2, or Thunderbird version 150.0.2 or 140.10.2.
What software is affected by CVE-2026-8090?
CVE-2026-8090 affects Mozilla Firefox versions below 150.0.2, Firefox ESR versions below 140.10.2 and 115.35.2, and Thunderbird versions below 150.0.2.
What type of vulnerability is CVE-2026-8090?
CVE-2026-8090 is a use-after-free vulnerability in the DOM's networking component that can lead to potential code execution.
When was CVE-2026-8090 fixed?
CVE-2026-8090 was fixed in version 150.0.2 of Firefox and Thunderbird, and in versions 140.10.2 and 115.35.2 of Firefox ESR.