Undefined behavior in the Audio/Video component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

The version of Thunderbird installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303506	Mozilla Thunderbird < 149.0	Nessus	Windows	critical
303504	Mozilla Thunderbird < 149.0	Nessus	MacOS X Local Security Checks	critical
303474	Mozilla Firefox < 149.0	Nessus	Windows	critical
303471	Mozilla Firefox < 149.0	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2026-4724

critical

Tenable Plugins

critical

critical

critical

critical