CVE-2026-14241: Mozilla Firefox memory safety bugs with out-of-bounds write (CWE-787)
Mozilla disclosed memory safety bugs in Firefox 152.0.3, some showing signs of memory corruption. The record states they were fixed in Firefox 152.0.4, and NVD assigns a CVSS 3.1 base score of 9.8 with CWE-787. Administrators should confirm that all installations run the fixed release.
Overview
This record describes several memory safety bugs in Mozilla Firefox 152.0.3. The NVD entry classifies the weakness as CWE-787 (Out-of-bounds Write). According to the description, some of the bugs showed evidence of memory corruption, and the CNA presumes that with enough effort some could be exploited to run arbitrary code. The description states the issue was fixed in Firefox 152.0.4.
Impact
- The description says that, with sufficient effort, some of these bugs could potentially be used to run arbitrary code. This is a presumption by the CNA, not a demonstrated result.
- NVD lists a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes network attack vector, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
- A second score of 7.5 (CVSS 3.1) appears in the record from a provider whose identity is not stated.
Affected products and versions
- Mozilla Firefox version 152.0.3 is listed as affected.
- The description states the fix is in Firefox 152.0.4. The record does not list other affected versions or a fixes list, so the exact range of vulnerable builds is unknown beyond what is stated.
Exploitation status
The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.0043 (percentile 0.35462), which is an estimate of exploitation likelihood and not evidence of exploitation.
Remediation and mitigation
- Update Firefox to version 152.0.4 or later on all desktop and managed installations, as stated in the record.
- Review the Mozilla security advisory linked below for the vendor's official list of fixed issues and any product-specific guidance.
- Where updates are deployed centrally, verify that the installed version is 152.0.4 or later and that older builds are removed or replaced.
Detection guidance
- Inventory Firefox installations and record their versions, focusing on any system still running 152.0.3 or earlier.
- Check software management tools and endpoint inventories for version mismatches after the update window.
- Monitor for unexpected crashes or instability in the browser, which can accompany memory corruption defects, while recognising that such symptoms are not specific to this CVE.
Limitations of the available information
- The record does not include a fixes list, a vendor-issued fix identifier beyond the description, or details of the individual bugs.
- The identity of the second CVSS provider is not stated.
- The record does not confirm whether the presumed exploitation path has been demonstrated. Treat the exploitability statement as an assessment by the CNA.
- Source pages listed in the record were consulted for metadata only; the Bugzilla link in the references is marked as broken and was not relied upon.
Frequently asked questions
Which Firefox version is affected by this CVE?
The record lists Mozilla Firefox version 152.0.3 as affected. The description states the issue was fixed in Firefox 152.0.4.
Is this vulnerability known to be actively exploited?
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
What is the severity of this CVE?
NVD assigns a CVSS 3.1 base score of 9.8, rated critical. A second score of 7.5 from an unnamed provider also appears in the record.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.