Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 147 and Thunderbird < 147.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 147.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-04 advisory.

  - Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-0892)

  - Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147 and Thunderbird     < 147. (CVE-2026-0881)

  - Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 147.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-04 advisory.

  - Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-0892)

  - Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147 and Thunderbird     < 147. (CVE-2026-0881)

  - Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7.
    (CVE-2026-0879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0136a5ab4e advisory.

    - New upstream release (147.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 147.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-01 advisory.

  - Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-0892)

  - Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147.
    (CVE-2026-0881)

  - Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, and Firefox ESR < 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147 and Firefox ESR < 140.7. (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, and Firefox ESR < 140.7. (CVE-2026-0879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 147.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-01 advisory.

  - Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. (CVE-2026-0892)

  - Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147.
    (CVE-2026-0881)

  - Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR <     115.32, and Firefox ESR < 140.7. (CVE-2026-0877)

  - Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This     vulnerability affects Firefox < 147 and Firefox ESR < 140.7. (CVE-2026-0878)

  - Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects     Firefox < 147, Firefox ESR < 115.32, and Firefox ESR < 140.7. (CVE-2026-0879)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de370822e0 advisory.

    - New upstream release (147.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
284838	Mozilla Thunderbird < 147.0	Nessus	MacOS X Local Security Checks	critical
284835	Mozilla Thunderbird < 147.0	Nessus	Windows	critical
284667	Fedora 42 : firefox (2026-0136a5ab4e)	Nessus	Fedora Local Security Checks	critical
283709	Mozilla Firefox < 147.0	Nessus	Windows	critical
283706	Mozilla Firefox < 147.0	Nessus	MacOS X Local Security Checks	critical
283572	Fedora 43 : firefox (2026-de370822e0)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2026-0892

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical