CVE-2026-74956 Same-origin policy bypass in the DOM: Service Workers component

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74955 Privilege escalation in the Request Handling component

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74958 Information disclosure in the WebRTC component

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74955 Privilege escalation in the Request Handling component

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74958 Information disclosure in the WebRTC component

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74950

A privilege escalation flaw in the Downloads API component of Firefox and Thunderbird allows network-based attackers to gain elevated privileges with user interaction. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1; no exploitation evidence reported by CISA. Updat...

CVE-2026-74952

Mozilla Firefox's Application Update component is affected by a privilege escalation flaw rated CVSS 8.8 (HIGH), exploitable remotely with no privileges but requiring user interaction. The vulnerability allows full confidentiality, integrity, and availability impact. It is fixed in Firefox 154 , ...

CVE-2026-74952 Privilege escalation in the Application Update component

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2...

CVE-2026-74951

CVE-2026-74951 is a clickjacking vulnerability in Firefox for Android , fixed in Firefox 154 . The flaw allows an attacker to trick a user into performing unintended actions by overlaying transparent or invisible UI elements. The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N...

CVE-2026-74947

A privilege escalation flaw in Firefox's Graphics component stems from an invalid pointer. CVSS 8.8 (HIGH) rates network attack vector with no privileges required. Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported; CISA SSVC marks it non-automatable with total techn...

CVE-2026-74947 Privilege escalation due to invalid pointer in the Graphics component

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74950 Privilege escalation in the Downloads API component

Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74950 Privilege escalation in the Downloads API component

Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74951 Clickjacking issue in Firefox for Android

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74951 Clickjacking issue in Firefox for Android

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74952 Privilege escalation in the Application Update component

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2...

CVE-2026-74990 Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was...

CVE-2026-74937 Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-75874 Sandbox escape in the Remote Settings Client component

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2...