PT-2026-38432 · Mozilla+1 · Firefox Esr+1

Michael Froman · CVE-2026-8094 · Published 2026-05-07 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 140.10.2

Description An issue exists within the WebRTC (Web Real-Time Communication) component, which allows for real-time communication between browsers without the need for plugins.

Recommendations Update to Firefox ESR version 140.10.2.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALSA-2026:19160

ALSA-2026:20566

ALSA-2026:20574

BDU:2026-09769

CVE-2026-8094

OESA-2026-2292

OESA-2026-2349

OESA-2026-2350

OESA-2026-2351

OESA-2026-2352

OPENSUSE-SU-2026:10720-1

OPENSUSE-SU-2026:10738-1

OPENSUSE-SU-2026:21168-1

RHSA-2026:19160

RHSA-2026:20566

RHSA-2026:20574

RHSA-2026:24508

RHSA-2026:24509

RHSA-2026:24510

RHSA-2026:24511

RHSA-2026:24516

RHSA-2026:24755

RHSA-2026:24983

RHSA-2026:25015

Affected Products

Firefox Esr

Red Os

References · 133

• https://mozilla.org/security/advisories/mfsa2026-41 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10738-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:25015 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:20574 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:20566 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-09769 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8094 · Security Note
• https://access.redhat.com/errata/RHSA-2026:19160 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2352 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8094 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-41/#CVE-2026-8094 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8092 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:19160 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2350 · Vendor Advisory