PT-2026-35735 · Mozilla+1 · Thunderbird+3

Bugmon · Published 2026-04-28 · Updated 2026-05-26 · CVE-2026-7321

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Firefox ESR versions prior to 140.10.1

Description A sandbox escape exists in the WebRTC: Networking component caused by incorrect boundary conditions. A sandbox is a security mechanism used to separate running programs from the rest of the system to prevent malicious code from accessing sensitive data or resources.

Recommendations Update Firefox to version 150. Update Thunderbird to version 150. Update Firefox ESR to version 140.10.1.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2026:19153

ALSA-2026:19157

ALSA-2026:19348

ALSA-2026:19370

ALSA-2026:19588

ALSA-2026:20586

CVE-2026-7321

OESA-2026-2132

OESA-2026-2133

OESA-2026-2134

OESA-2026-2246

OESA-2026-2275

OPENSUSE-SU-2026:10661-1

OPENSUSE-SU-2026:10687-1

RHSA-2026:19153

RHSA-2026:19157

RHSA-2026:19348

RHSA-2026:19370

RHSA-2026:19588

RHSA-2026:20586

RHSA-2026:21743

Affected Products

Firefox

Firefox Esr

Rocky Linux

Thunderbird

References · 123

• https://cve.org/CVERecord?id=CVE-2026-7321 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2134 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-7321 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-39 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-7321 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10661-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2132 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:19157 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-19157.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:19370 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-30 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8091 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-36 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2133 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-20586.html · Vendor Advisory