Code Injection in firefox (CVE-2026-8094, CVSS 9.8)

Summary

code injection in firefox (CVE-2026-8094). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability has been identified in Firefox's WebRTC component that could allow attackers to execute malicious code without any special actions. This has been resolved in the latest Firefox ESR 140.10.2, and prompt updating is advised. Similar issues in the past have led to data breaches.

CVE-2026-8094 is a vulnerability in Firefox's WebRTC component where improper control of code generation may allow remote, network-based arbitrary code execution. While specific affected versions are unspecified, it has been patched in Firefox ESR 140.10.2. No workarounds are provided; applying the latest patches is critical.

❓ What is the problem

Improper Control of Generation of Code ('Code Injection') in WebRTC component of Firefox.

📍 Affected scope

Firefox WebRTC component; specific function or endpoint not detailed

🔥 Severity

Critical severity with CVSS 9.8, allowing for remote code execution without user interaction.

🔧 How to fix

Update to Firefox ESR 140.10.2 or later.

🛡️ Workaround

No workaround provided.

🔍 Detection

No specific detection method provided.

Related past incidents Similar incidents extracted from past CVEs

Heartbleed

Similar in criticality and impact to OpenSSL's flaw allowing memory exposure and data leak.

CVE-2021-22922

A similar arbitrary code execution issue in a web component.

CVE-2023-4863

A recent critical exploit in similar environment, reflective of its high risk nature.

If this happens at your company Expected impact per business scenario

📌 Online media services reliant on WebRTC for video communications

Unauthorized code execution leading to data theft and service disruption.

📌 Corporate environments using integrated Firefox ESR for secure browsing

Potential breach of sensitive corporate information if exploited.

📌 Web development agencies relying on WebRTC functionalities

Code integrity and confidentiality compromises affecting client projects.

Recommended action

Promptly update all Firefox ESR installations to version 140.10.2 or later to mitigate the vulnerability risk.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-8094 firefox-esr Fixed in: 140.10.2esr-1~deb11u1

Code Injection in firefox (CVE-2026-8094)