Mozilla released Firefox 150 on April 21, 2026, followed by a point release 150.0.1 on April 28. Together they patch 45 distinct CVEs across Firefox, Firefox ESR 115.35/140.10, and Thunderbird 150. The scale is striking: over 100 individual memory corruption bugs collapsed into three aggregate CVEs, plus 42 discrete vulnerabilities spanning use-after-free, uninitialized memory, privilege escalation, and sandbox escape. Notably, Anthropic's Claude receives credit on multiple high-severity flaws, marking a shift toward AI-assisted vulnerability research.
Background
Firefox follows a four-week release cycle. Version 150 landed April 21 with the bulk of fixes (MFSA 2026-30 through 34). A week later, 150.0.1 (MFSA 2026-35) added four more CVEs. Extended Support Release branches ESR 115 and ESR 140 received parallel updates (115.35/115.35.1 and 140.10/140.10.1). Thunderbird, which shares Firefox's Gecko engine, received identical fixes in version 150.
The advisories cover five Mozilla Foundation Security Advisories (MFSA 2026-30 through 34 for 150, and MFSA 2026-35 for 150.0.1). This is the largest single-cycle CVE count for Firefox in recent years.
Why This Matters
Browsers are the primary attack surface for most users and organizations. A single memory corruption bug can lead to remote code execution, sandbox escape, or data theft. Firefox 150 addresses:
- Remote code execution vectors in WebRTC, JavaScript engine, and DOM components
- Privilege escalation from renderer to browser-privileged processes
- Sandbox bypass via WebRTC networking boundary conditions
- Information disclosure across graphics, media, and networking stacks
For enterprises on ESR, the 115.35.1 and 140.10.1 updates are mandatory — these branches receive only security fixes, so every CVE is actively relevant. Thunderbird users inherit the same risk profile since the mail client renders HTML using Gecko.
Technical Breakdown
Aggregate Memory Safety CVEs (High/Critical)
Three CVEs account for over 100 individual memory corruption bugs:
| CVE | Impact | Products Fixed | Bug Count |
|---|---|---|---|
| CVE-2026-6784 | High | Firefox 150, Thunderbird 150 | 60+ bugs |
| CVE-2026-6785 | High | ESR 115.35, ESR 140.10, Firefox 150, Thunderbird 150 | 100+ bugs |
| CVE-2026-6786 | High | ESR 140.10, Firefox 150, Thunderbird 150 | 60+ bugs |
These represent "memory safety bugs" — crashes with evidence of memory corruption that could be weaponized with sufficient effort. Mozilla's fuzzing infrastructure (libFuzzer, AFL, custom harnesses) continuously discovers these. The bug counts reflect distinct crash signatures, not necessarily independent exploit primitives.
Discrete High-Severity Vulnerabilities
CVE-2026-6746: Use-after-free in DOM Core & HTML
Reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic. A use-after-free in the DOM Core & HTML component allows remote code execution. Fixed in Firefox 150, ESR 115.35, ESR 140.10, Thunderbird 150, Thunderbird 140.10. CVSS 3.1: 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) per CISA-ADP.
CVE-2026-6747: Use-after-free in WebRTC
Reported by Nan Wang. WebRTC's peer connection handling contains a use-after-free exploitable via crafted signaling. Fixed across all branches.
CVE-2026-6748: Uninitialized memory in Web Codecs
Reported by Inseo An. Audio/Video Web Codecs component leaks uninitialized memory, enabling information disclosure.
CVE-2026-6749: Information disclosure in Canvas2D
Reported by Inseo An. Graphics Canvas2D component exposes uninitialized memory contents.
CVE-2026-6750: Privilege escalation in WebRender
Reported by choeseyeong. The GPU-accelerated WebRender compositor has a privilege escalation path from content process to privileged browser process.
CVE-2026-6751: Uninitialized memory in Web Codecs (second instance)
Reported by Joren Afman. Another uninitialized memory issue in the same component.
CVE-2026-6752/6753: WebRTC boundary conditions
Reported by jmwebdevelopement. Two distinct incorrect boundary condition bugs in WebRTC, both high severity.
CVE-2026-6754: Use-after-free in JavaScript Engine
Reported by Xuehao Guo. SpiderMonkey's JIT or GC subsystem contains a use-after-free.
CVE-2026-7321: Sandbox escape via WebRTC Networking
Reported by Mozilla Fuzzing Team. Incorrect boundary conditions in WebRTC Networking allow sandbox escape — a critical escalation from renderer compromise to system access. Rated Moderate by Mozilla but functionally a sandbox bypass.
CVE-2026-8091: Boundary conditions in Playback
Reported by Mozilla Fuzzing Team. Audio/Video Playback component has high-severity boundary condition issues.
Moderate and Low Severity
The remaining CVEs cover mitigation bypasses (postMessage, Cookies, File Handling, Security, Networking), spoofing (DOM Core & HTML), privilege escalation (Networking, Debugger), information disclosure (Form Autofill, IP Protection), and denial-of-service (WebGPU, Playback). NSS (Network Security Services) receives multiple boundary condition fixes.
AI-Assisted Discovery: A Notable Shift
Three high-severity CVEs (CVE-2026-6746, CVE-2026-6757, CVE-2026-6758) credit "Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic." This is not a one-off — the same research group appears across multiple WebAssembly and DOM vulnerabilities.
This signals a maturation of AI-assisted vulnerability research. Large language models excel at pattern recognition across massive codebases, identifying variant bugs, and reasoning about complex memory management invariants. Expect more AI-credited discoveries in coming cycles.
Mitigation & Patching
Immediate Actions
-
Update Firefox: Restart to trigger auto-update to 150.0.1 (or 150 if 150.0.1 not yet offered). Verify via
about:support→ Application Basics → Version. -
Update ESR: Enterprise deployments on ESR 115 must move to 115.35.1; ESR 140 to 140.10.1. Test in staging before wide rollout.
-
Update Thunderbird: Version 150 includes all Gecko fixes. Restart the client.
-
Verify Linux distro packages: Distributions (Debian, Ubuntu, Fedora, Arch, etc.) typically ship updates within 24-48 hours. Run
apt update && apt upgrade firefoxor equivalent.
Detection
No specific IOCs are published for these CVEs — they are pre-exploitation fixes. However, monitor for:
- Firefox crashes with
EXCEPTION_ACCESS_VIOLATIONorSIGSEGVin WebRTC, DOM, or JS engine modules - Unexpected renderer process termination
- Sandbox escape attempts (rare, but CVE-2026-7321 enables this)
Configuration Hardening
While patches are the primary fix, defense-in-depth measures reduce exploitability:
Frequently Asked Questions
Q: Is Firefox 150.0.1 a separate release or cumulative?
It is a point release (chemspill-style) addressing four CVEs discovered after 150 shipped. It includes all 150 fixes plus the new ones. Install 150.0.1 directly.
Q: Do ESR users get the same fixes?
Yes. ESR 115.35.1 and 140.10.1 contain the identical security fixes. ESR 115 is the legacy branch (Firefox 115 base); ESR 140 is the current branch.
Q: Are any of these actively exploited?
Mozilla marks all as "fixed in" releases with no indication of in-the-wild exploitation. These are proactive fixes from fuzzing, code audit, and AI-assisted research.
Q: Why so many memory safety bugs in one cycle?
Mozilla's fuzzing infrastructure runs continuously. The 150 cycle aggregates bugs found over ~4 weeks across multiple fuzzing harnesses. The aggregate CVE approach (6784/6785/6786) avoids CVE exhaustion while capturing volume.
Q: Does Thunderbird really need browser engine patches?
Yes. Thunderbird renders HTML email using Gecko. A malicious email can trigger the same memory corruption as a malicious webpage. Scripting is disabled in mail, but memory corruption precedes script execution.
Q: What about the AI credit — is that marketing?
The researchers are established vulnerability analysts (Carlini, Gaynor, Weinberger are well-known in the field). Claude served as a force multiplier for code analysis and variant discovery, not an autonomous agent.
Q: Should I disable WebRTC/WebAssembly preemptively?
Only if you don't use them. Disabling breaks legitimate applications (video conferencing, gaming, heavy web apps). Patching is the correct remediation.
Q: When is Firefox 151 coming?
Approximately four weeks after 150 — around May 19, 2026.
Key Takeaways
- 45 CVEs in one cycle is a high watermark for Firefox, driven by fuzzing scale and AI-assisted analysis.
- Memory safety dominates: 3 aggregate CVEs cover 200+ individual corruption bugs.
- AI-assisted discovery is real: Anthropic's Claude credited on multiple high-severity flaws by a team of elite researchers.
- WebRTC and JS Engine are hotspots: 5 high-sev WebRTC CVEs alone; SpiderMonkey remains a rich target.
- ESR parity is critical: Enterprise must patch 115.35.1 / 140.10.1 immediately.
- Point releases matter: 150.0.1 added 4 CVEs one week later — auto-update must be enabled.
- Thunderbird shares the risk: Email client inherits all Gecko engine vulnerabilities.
Conclusion
Firefox 150 demonstrates that browser security is a volume game. The combination of massive-scale fuzzing, expert human analysis, and now AI-assisted variant discovery produces a steady stream of memory safety fixes. For developers and security teams, the operational lesson is unchanged: apply updates promptly, verify deployment, and assume the next cycle will bring another batch. The involvement of LLMs in vulnerability research suggests the velocity will only increase — patch management must keep pace.
Sources:
- Mozilla Foundation Security Advisory 2026-30: https://www.mozilla.org/en-US/security/advisories/mfsa2026-30/
- Mozilla Foundation Security Advisory 2026-31: https://www.mozilla.org/en-US/security/advisories/mfsa2026-31/
- Mozilla Foundation Security Advisory 2026-32: https://www.mozilla.org/en-US/security/advisories/mfsa2026-32/
- Mozilla Foundation Security Advisory 2026-33: https://www.mozilla.org/en-US/security/advisories/mfsa2026-33/
- Mozilla Foundation Security Advisory 2026-34: https://www.mozilla.org/en-US/security/advisories/mfsa2026-34/
- Mozilla Foundation Security Advisory 2026-35: https://www.mozilla.org/en-US/security/advisories/mfsa2026-35/
- NVD CVE-2026-6746: https://nvd.nist.gov/vuln/detail/CVE-2026-6746
- Bugzilla Mozilla: https://bugzilla.mozilla.org/
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.