CVE-2021-23987

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1513519%2C1683439%2C1690169%2C1690718Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1513519%2C1683439%2C1690169%2C1690718Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-10/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-12/Vendor Advisory

Published

Mar 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23981A texture upload of a Pixel Buffer Object could have confuse…8.1
• CVE-2021-23982Using techniques that built on the slipstream research, a ma…6.5
• CVE-2021-23983By causing a transition on a parent node by removing a CSS r…6.5
• CVE-2021-23984A malicious extension could have opened a popup window lacki…6.5
• CVE-2021-23985If an attacker is able to alter specific about:config values…6.5
• CVE-2021-23986A malicious extension with the 'search' permission could hav…6.5
• CVE-2021-23988Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-2399Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23991If a Thunderbird user has previously imported Alice's OpenPG…6.8
• CVE-2021-23992Thunderbird did not check if the user ID associated with an …4.3
• CVE-2021-23993An attacker may perform a DoS attack to prevent a user from …6.5
• CVE-2021-23994A WebGL framebuffer was not initialized early enough, result…8.8