Loading story…
Mozilla disclosed two high-severity Firefox vulnerabilities affecting graphics-related code and released fixes in Firefox 149.0.2. CVE-2026-5733 impacts the Graphics: WebGPU component and is described as incorrect boundary conditions under CWE-119, while CVE-2026-5732 affects the Graphics: Text component and involves an integer overflow caused by incorrect boundary conditions under CWE-190.
Both flaws carry a CVSS v3.1 score vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that remote exploitation with user interaction could have severe effects on confidentiality, integrity, and availability. Mozilla said CVE-2026-5732 affects Firefox versions earlier than 149.0.2 and Firefox ESR versions earlier than 140.9.1, while CVE-2026-5733 affects Firefox versions earlier than 149.0.2; the company linked the disclosures to Bugzilla entries and security advisories documenting the issues and available patches.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Mozilla disclosed CVE-2026-5732, an integer overflow caused by incorrect boundary conditions in Graphics: Text, and CVE-2026-5733, incorrect boundary conditions in Graphics: WebGPU. On the same date, the CVE records were updated with severity details, CWE classifications, and references to Bugzilla and Mozilla security advisories.
Mozilla made available fixes for two high-severity Firefox vulnerabilities: CVE-2026-5733 in the Graphics: WebGPU component and CVE-2026-5732 in the Graphics: Text component. The advisories indicate the issues affect Firefox versions earlier than 149.0.2, and for CVE-2026-5732 also Firefox ESR versions earlier than 140.9.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mozilla released **Firefox 151.0.3** to address multiple security vulnerabilities that could lead to denial-of-service conditions, memory corruption, and **arbitrary code execution** on affected systems. The update was highlighted in an EG-FinCIRT security notice urging organizations to review and apply the patch after appropriate testing. Among the issues cited is **`CVE-2026-10701`**, an incorrect boundary conditions flaw in the **Graphics: Text** component with a **CVSS score of 7.5**. The advisory also references **`CVE-2026-10702`** and indicates that enterprises should prioritize deployment of the updated browser version to reduce exposure to exploitation.
Jul 8, 2026
Mozilla released security updates for **Firefox 154**, supported **Firefox ESR** branches, and **Thunderbird** to fix a broad set of vulnerabilities affecting desktop and mobile users. Government and vendor advisories said the updates address **3 critical** and **17 high-severity** flaws involving arbitrary code execution, privilege escalation, security restriction bypass, sandbox escape, site isolation failures, use-after-free conditions, and information disclosure. Firefox 154 also introduced product changes including expanded Local Access Network protections for WebSocket connections, while security notices from Canada and Italy urged organizations to review Mozilla bulletins and update affected installations. Tenable and downstream Linux advisories flagged the issue set as **critical** across Windows, macOS, and Slackware packages, with affected versions including Firefox releases prior to 154, multiple ESR builds before their patched versions, and Thunderbird releases prior to **140.14** or **154.0** depending on branch. Nessus coverage tied the fixes to numerous CVEs, including **`CVE-2026-74990`** as a scoring reference in several advisories, and highlighted specific Thunderbird issues such as a Remote Settings Client sandbox escape, a CanvasWebGL site isolation flaw, a DOM: Networking privilege escalation bug, and WebAssembly and garbage-collection use-after-free vulnerabilities. The recommended action across all notices was to upgrade Mozilla products to the latest patched versions immediately.
Aug 26, 2026
Mozilla published security advisories for **Firefox 149** and **Firefox 149.0.2**, disclosing that both releases contain fixes for security vulnerabilities in the browser. The advisories, tracked as `MFSA-2026-20` and `MFSA-2026-25`, indicate that Mozilla issued follow-up updates to address flaws affecting Firefox users. While the advisories provided here do not include vulnerability synopses, the paired releases show Mozilla delivering both a major browser update and a subsequent point release with additional security fixes. Organizations using Firefox should review the affected versions and prioritize upgrading to the latest available release to reduce exposure to browser-based attacks.
Jun 29, 2026