Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

mozilla mfsa2026-23: Security Vulnerabilities fixed in Thunderbird 149

mozilla mfsa2026-24: Security Vulnerabilities fixed in Thunderbird 140.9

The version of Firefox installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303474	Mozilla Firefox < 149.0	Nessus	Windows	high
303473	Mozilla Firefox ESR < 140.9	Nessus	MacOS X Local Security Checks	high
303472	Mozilla Firefox ESR < 140.9	Nessus	Windows	high
303471	Mozilla Firefox < 149.0	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2026-4716

critical

Tenable Plugins

Coming Soon

high

high

high

high