UBUNTU-CVE-2026-124868: Medium severity ubuntu/mozjs52 vulnerability

Published Nov 12, 2026

Updated

Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Affected Software

10 affected components

ubuntu/mozjs52*

ubuntu/mozjs38*

ubuntu/mozjs68*

ubuntu/mozjs52*

ubuntu/mozjs102*

ubuntu/mozjs78*

ubuntu/mozjs91*

ubuntu/thunderbird*

ubuntu/mozjs102*

ubuntu/mozjs115*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 160
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 153.7
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 160
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.7

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which Ubuntu packages should be reviewed for exposure?

Review installations of ubuntu/thunderbird and the listed Mozilla JavaScript engine packages: ubuntu/mozjs38, ubuntu/mozjs52, ubuntu/mozjs68, ubuntu/mozjs78, ubuntu/mozjs91, ubuntu/mozjs102, and ubuntu/mozjs115.

Which upstream releases contain the fix?

The issue was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.