CVE-2026-3847 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416 — Use After Free7 documents7 sources

Severity

8.8HIGHNVD

EPSS

0.0%

top 85.08%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox

Timeline

PublishedMar 10

Description

Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148.0.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages1 packages

▶NVDmozilla/firefox< 148.0.2

🔴Vulnerability Details

GHSA

GHSA-8v9x-6h3j-jcw8: Memory safety bugs present in Firefox 148↗2026-03-10

▶

CVEList

Memory safety bugs fixed in Firefox 148.0.2↗2026-03-10

▶

OSV

CVE-2026-3847: Memory safety bugs present in Firefox 148↗2026-03-10

▶

📋Vendor Advisories

Debian

CVE-2026-3847: firefox - Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidenc...↗2026

▶

Mozilla

Mozilla Foundation Security Advisory 2026-19: CVE-2026-3847↗

▶

🕵️Threat Intelligence

Wiz

CVE-2026-3847 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶