CVE-2026-7321: mozilla firefox Classic Buffer Overflow
CVSS: 9.6v3.1CriticalAnalyzed
AliasesDEBIAN-CVE-2026-7321CGA-5vx6-f93m-c5f6CGA-8p4q-xhj6-h856CGA-hhc4-24pv-mhrpCGA-w5p8-4466-xwxj
Published 28-04-2026Last modified 30-04-2026
Vulnerability summary
CVE-2026-7321 is a critical (CVSS 9.6) Classic Buffer Overflow vulnerability in mozilla firefox. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.
CVSS score
9.6/10
010
Critical · v3.1 (CVE.org)EPSS score
0.45%
0%100%
Low · +0.19 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 25 · Related 4OPENSUSE-SU-2026:10661-1OPENSUSE-SU-2026:10687-1OPENSUSE-SU-2026:21168-1RHSA-2026:19153RHSA-2026:19157RHSA-2026:19348RHSA-2026:19370RHSA-2026:19588RHSA-2026:20586RHSA-2026:21743RHSA-2026:22324RHSA-2026:22408RHSA-2026:22409RHSA-2026:22410RHSA-2026:22708RHSA-2026:22712RHSA-2026:22847RHSA-2026:24345RHSA-2026:24717RHSA-2026:24718RHSA-2026:24719RHSA-2026:24721RHSA-2026:24844RHSA-2026:24846RHSA-2026:25014CGA-63WJ-5V4F-22W3
Timeline
- 28-04-2026PublishedVulnerability first disclosed.
- 30-04-2026Last modifiedVulnerability information updated.
Description
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
CVSS metrics
3 scores · 3 sources · 1 versionCritical 9.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.19 pp
From 0.26% on 21-09-2026
21-09-202621-10-2026
EPSS score0.45%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- firefox< 140.10.1-r0
- firefox-esr< 140.10.1-r0
Debian2 products
- firefox-esr< 140.10.1esr-1~deb12u1 | < 140.10.1esr-1~deb13u1 | < 140.10.1esr-1
- thunderbird< 1:140.10.1esr-1~deb12u1 | < 1:140.10.1esr-1~deb13u1 | < 1:140.10.1esr-1
Mozilla2 products
- firefox< 140.10.1 | < 150.0
- thunderbird< 140.10.1 | < 150.0
Wolfi1 product
- firefox< 140.10.1-r0
4 vendors · 7 products
References
6 links- bugzilla.mozilla.org/show_bug.cgi?id=2029461Permissions Required
- www.mozilla.org/security/advisories/mfsa2026-30/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-33/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-36/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-39/Vendor Advisory
