CVE-2026-8947

HighCVSS 7.3/10Last modified Oct 14, 2026

Description

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-416CWE-825

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2026
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-894708.4In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS CuCVE-2026-894718.4In the Linux kernel, the following vulnerability has been resolved: power: supply: cros_usbpd-charger: bound the EC-reported port count crCVE-2026-894727.8In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysCVE-2026-89473In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power_supply reference leak bq25890_fw_proCVE-2026-89474In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The CVE-2026-89475In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin inteCVE-2026-894767.5In the Linux kernel, the following vulnerability has been resolved: sctp: fix stream->outcnt underflow on duplicate RECONF responses A cacCVE-2026-894777.5In the Linux kernel, the following vulnerability has been resolved: sctp: fix NULL deref on untransmitted RECONF completion sctp_process_sCVE-2026-894789.8In the Linux kernel, the following vulnerability has been resolved: sctp: drop a chunk if its transport was removed sctp_rcv() resolves thCVE-2026-894799.8In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_enCVE-2026-89489.1Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.CVE-2026-894807.5In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_d
CVE-2026-8947: High severity, CVSS 7.3 | Vulnix