CVE-2026-8970

⚠️ high

Summary

Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS Score

8.8

High

EPSS Score

0.0

Exploit Probability

Published Date

2026-05-19

First Seen: 2026-05-20

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 336,041 vulnerabilities in our database.

#63,447

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 20, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

pakhunov.anton.n

SSVC data provided by CISA

Last Modified 2026-05-20

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-269

📦 Affected Products 4

Vendor	Product	Status	Affected Versions
mozilla	firefox	Affected	< 140.11.0
mozilla	firefox	Affected	< 151.0.0
mozilla	thunderbird	Affected	< 140.11
mozilla	thunderbird	Affected	< 151.0.0

🔗 References 5

https://bugzilla.mozilla.org/show_bug.cgi?id=2032174

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026...

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-15718	🔶 medium	4.3	0.2	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw....	2026-07-14
CVE-2026-15719	🔶 medium	5.4	0.1	We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw....	2026-07-14
CVE-2026-13356	🔶 medium	6.3	0.1	A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the brows...	2026-07-07
CVE-2026-57962	🔶 medium	5.3	0.2	A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitr...	2026-07-01
CVE-2026-57963	🔶 medium	6.5	0.2	An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, an...	2026-07-01
CVE-2026-14241	⛔ critical	9.8	0.2	Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume th...	2026-06-30

These CVEs affect the same products