CVE-2026-8945
A remote, anonymous attacker can exploit multiple vulnerabilities in Mozilla Firefox, Mozilla Firefox ESR, and Mozilla Thunderbird to execute arbitrary code, disclose information, bypass security restrictions (e.g., sandbox escape), deceive the user, escalate permissions, or cause a Denial-of-Service condition.
CSIRTS triage
- What
- Multiple vulnerabilities can be exploited to execute arbitrary code, disclose information, bypass security restrictions, escalate permissions, or cause a Denial-of-Service condition.
- Who is affected
- Users of Mozilla Firefox, Firefox ESR, and Thunderbird are affected.
- Urgency
- Remediation is urgent due to the high severity and potential for exploitation.
- Action
- Update to the latest version of Mozilla Firefox or Thunderbird.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-8945
Get an email if CVE-2026-8945 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Advisory coverage (1)
- high[UPDATE] [high] Mozilla Firefox and Thunderbird: Multiple vulnerabilitiescert-bund · 2026-07-09
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-8945)