Vulnerability · Published Mar 10, 2026 · Assigned by mozilla

CVE-2026-3845Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android

High 8.8

In plain English

A high-severity heap buffer overflow in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2.

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	see references

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2020174
https://www.mozilla.org/security/advisories/mfsa2026-19/