CVE-2026-8972 - Privilege escalation in the WebRTC: Audio/Video component

HIGH

Privilege escalation in the WebRTC: Audio/Video component

Published May 19, 2026

8.8

HIGH

CVSS 3.1

EPSS 0.44%

Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	rhel10/thunderbird-flatpak	Not affected	n/a
Red Hat Enterprise Linux 10	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 6	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 8	firefox	Not affected	n/a
Red Hat Enterprise Linux 8	thunderbird	Not affected	n/a
Red Hat Enterprise Linux 9	firefox	Not affected	n/a
Red Hat Enterprise Linux 9	thunderbird	Not affected	n/a

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-269

Improper Privilege Management

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-8972		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2033275		Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2479834		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30924		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8972
https://www.cve.org/CVERecord?id=CVE-2026-8972
https://www.mozilla.org/security/advisories/mfsa2026-46/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-46/#CVE-2026-8972
https://www.mozilla.org/security/advisories/mfsa2026-50/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-50/#CVE-2026-8972