CVE-2026-8945
published 2026-05-19CVE-2026-8945: Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
PriorityP337high7.5CVSS 3.1
AVNACHPRNUIRSUCHIHAH
EPSS
0.37%
30.6th percentile
Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 151 | Firefox 151 |
| mozilla | firefox | < 151.0.0 | 151.0.0 |
| mozilla | firefox_focus | < 151.0 | 151.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
vendor_redhat·2026-09-16·CVSS 6.5
CVE-2026-19033 [MEDIUM] CWE-347 bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
A flaw was found in bind. A remot
Red Hat
perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
vendor_redhat·2026-09-01·CVSS 7.5
CVE-2026-81928 [HIGH] CWE-835 perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
A flaw was found in Net::DNS versions before 1.57 for Perl. An attacker can cause a denial of service (DoS) by sending a specially crafted DNS message with a misplaced Transaction Signature (TSIG) record. When a system using Net::DNS, such as a forwarder or proxy, attempts to re-encode this message, it can lead to unbounded recursion and memory exhaustion, ultimately terminating the process. This vulnerability arises because the `sig_data` function fails to properly remove TSIG records from all sections of a DNS message, violating RFC 8945 section 5.2 requirements.
Mitigation: To mitigate this issue, restrict network access to DNS services utilizing `perl-Net-DNS` to trusted clients or internal
Red Hat
firefox: Sandbox escape in Firefox and Firefox Focus for Android
vendor_redhat·2026-05-19·CVSS 7.5
CVE-2026-8945 [HIGH] CWE-653 firefox: Sandbox escape in Firefox and Firefox Focus for Android
firefox: Sandbox escape in Firefox and Firefox Focus for Android
Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape in Firefox and Firefox Focus for Android
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: firefox (Red Hat Enterprise Linux 8) - Not affected
Package: firefox
Mozilla
Mozilla Foundation Security Advisory 2026-46: CVE-2026-8945
vendor_mozilla·CVSS 7.5
CVE-2026-8945 [HIGH] Mozilla Foundation Security Advisory 2026-46: CVE-2026-8945
Mozilla Foundation Security Advisory 2026-46
CVE: CVE-2026-8945
Product: Firefox
Impact: high
Fixed in: Firefox 151
GHSA
GHSA-jvw5-v42q-rpwc: Sandbox escape in Firefox and Firefox Focus for Android
ghsa_unreviewed·2026-05-19
CVE-2026-8945 [HIGH] CWE-693 GHSA-jvw5-v42q-rpwc: Sandbox escape in Firefox and Firefox Focus for Android
Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
VulDB
Mozilla Firefox up to 150 on Android sandbox
vuldb·2026-05-19·CVSS 7.5
CVE-2026-8945 [HIGH] Mozilla Firefox up to 150 on Android sandbox
A vulnerability marked as critical has been reported in Mozilla Firefox up to 150 on Android. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in sandbox issue.
This vulnerability was named CVE-2026-8945. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-19033 bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
bugzilla·2026-09-16·CVSS 6.5
CVE-2026-19033 [MEDIUM] CVE-2026-19033 bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
CVE-2026-19033 bind: BIND: Unauthorized zone content updates via unauthenticated IXFR deltas
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with the TSIG signature arrives. This could allow an attacker that does not actually possess a valid TSIG signature to send unauthorized zone contents to a secondary server. Although no TSIG signature ever arrives, `named` does not rollback to the pre-transfer state. To exploit the vulnerability, the transfer must be a multi-message TCP IXFR, as described by RFC 8945.
This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.
Bugzilla
CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
bugzilla·2026-09-01·CVSS 7.5
CVE-2026-81928 [HIGH] CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
CVE-2026-81928 perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.
sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.
The recu
Bugzilla
CVE-2026-8945 firefox: Sandbox escape in Firefox and Firefox Focus for Android
bugzilla·2026-05-19·CVSS 7.5
CVE-2026-8945 [HIGH] CVE-2026-8945 firefox: Sandbox escape in Firefox and Firefox Focus for Android
CVE-2026-8945 firefox: Sandbox escape in Firefox and Firefox Focus for Android
Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
2026-05-19
Published