Mozilla MFSA-2026-30: Critical Memory Safety & Privilege Escalation Fixes for Firefox 150 & Thunderbird 150

Mozilla has released a comprehensive security advisory (MFSA-2026-30) addressing a significant cluster of vulnerabilities affecting various components of the Firefox ecosystem, including Firefox for Android, Thunderbird, and NSS libraries. This update highlights a broad spectrum of memory safety issues, ranging from high-severity use-after-free bugs to moderate-severity mitigation bypasses.

For security professionals and system administrators, understanding the technical implications of these flaws is critical for prioritizing patch management. You can view the full official Mozilla Security Advisory for the complete list of affected versions.

High-Severity Vulnerabilities: Memory Safety & Privilege Escalation

The most pressing concerns in this advisory involve memory corruption flaws. These types of vulnerabilities are particularly dangerous because they can be exploited to achieve arbitrary code execution or bypass browser sandboxing.

• Use-After-Free (UAF) Exploits: Several critical UAF vulnerabilities were identified in the DOM: Core & HTML (CVE-2026-6746), WebRTC (CVE-2026-6747), and the JavaScript Engine (CVE-2026-6754) components. In a UAF scenario, the engine attempts to access a memory pointer that has already been deallocated, potentially allowing an attacker to redirect execution flow.
• Uninitialized Memory Access: Flaws in the Web Codecs (CVE-2026-6748, CVE-2026-6751) and Canvas2D (CVE-2026-6749) components involve uninitialized memory. This can lead to information disclosure, where sensitive data left over in memory buffers is leaked to a malicious actor.
• Privilege Escalation: A notable vulnerability in the WebRender component (CVE-2026-6750) could potentially allow an attacker to escalate privileges, moving from a restricted browser process to a more privileged state within the operating system.
• Boundary Condition Errors: The WebRTC component faced multiple “incorrect boundary condition” hits (CVE-2026-6752, CVE-2026-6753), which often serve as the precursor to buffer overflows.

Moderate-Severity Vulnerabilities: Bypassing Defenses

While perhaps less direct than a UAF, the moderate-severity vulnerabilities in this batch focus on weakening the browser’s built-in security layers.

Key areas of concern include:

• Mitigation Bypasses: Vulnerabilities in postMessage (CVE-2026-6755), Firefox for Android (CVE-2026-6756), and Networking: Cookies (CVE-2026-6760) are designed to circumvent the very protections meant to keep malicious scripts isolated.
• WebAssembly (Wasm) Insecurities: Both invalid pointer (CVE-2026-6757) and use-after-free (CVE-2026-6758) issues in the WebAssembly component pose risks to high-performance web applications.
• Information Disclosure: The Form Autofill component (CVE-2026-6765) has been flagged for potential information disclosure, a classic target for credential-harvesting attacks.

Low-Severity & Denial-of-Service (DoS) Risks

The remaining vulnerabilities primarily impact the availability and stability of the browser rather than its confidentiality or integrity. These include integer overflows in WebGPU (CVE-2026-6773) and various Denial-of-Service (DoS) flaws in the Audio/Video playback engine (CVE-2026-6780, CVE-2026-6781). While these are less likely to result in data theft, they can be used to degrade user experience or crash critical applications.

Summary Table of Key CVEs

Recommendation

Given the high number of memory safety bugs fixed across Firefox 150, Thunderbird 150, and various ESR branches (including ESR 115.35 and ESR 140.10), immediate updates are strongly recommended.

Users should ensure their browsers are set to “Auto-update” via the Firefox settings menu to mitigate these risks effectively.