CVE-2021-38498

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2.

• CWE-416

• https://bugzilla.mozilla.org/show_bug.cgi?id=1729642Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-43/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-45/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1729642Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-43/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-45/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2021-47/Vendor Advisory

Published

Nov 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38492When delegating navigations to the operating system, Firefox…6.5
• CVE-2021-38493Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38494Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38495Mozilla developers reported memory safety bugs present in Th…8.8
• CVE-2021-38496During operations on MessageTasks, a task may have been remo…8.8
• CVE-2021-38497Through use of reportValidity() and window.open(), a plain-t…6.5
• CVE-2021-38499Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-3850Authentication Bypass by Primary Weakness in GitHub reposito…9.1
• CVE-2021-38500Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38501Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2021-38502Thunderbird ignored the configuration to require STARTTLS se…5.9
• CVE-2021-38503The iframe sandbox rules were not correctly applied to XSLT …10