CVE-2026-12308

CVE-2026-12308 is a memory-safety vulnerability affecting Mozilla Firefox and Thunderbird components. Connected advisories confirm the issue is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s DSA-6350-1 lists CVE-2026-12308 among multiple Firefox ESR fi...

CVE-2026-2771

CVE-2026-2771 is an undefined-behavior vulnerability in the DOM: Core & HTML component of Mozilla Firefox/Thunderbird family that was fixed in Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148 and 140.8. The issue is reported across multiple advisories (Astra Linux bulletin and Amazon Li...

CVE-2026-4691

The CVE-2026-4691 entry describes a use-after-free in Firefox’s CSS Parsing and Computation component. Affected products/versions, as documented across connected sources, include Firefox versions prior to 149 and Firefox ESR prior to 115.34 and 140.9. The root cause is a use-after-free in the CSS...

CVE-2026-74949

CVE-2026-74949 is a privilege escalation vulnerability in Mozilla Firefox and Thunderbird caused by a use-after-free in the Graphics: Canvas2D component. The CVSS 3.1 score is 8.8 (HIGH) , with a network attack vector requiring user interaction but no privileges. Successful exploitation could lea...

CVE-2025-10528

CVE-2025-10528 is a sandbox escape in Mozilla Firefox/Thunderbird caused by undefined behavior due to an invalid pointer in Graphics: Canvas2D. Affected products include Firefox < 143 and Firefox ESR < 140.3, Thunderbird < 143 and Thunderbird

CVE-2025-13019

CVE-2025-13019 is a same-origin policy bypass in the DOM: Workers component. Connected advisories confirm affected products as Mozilla Firefox and Firefox ESR, with impact on versions below Firefox 145 and Firefox ESR below 140.5. The Amazon Linux advisories (ALAS2-2025-3108, ALAS2FIREFOX-2025-04...

CVE-2025-14324

CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird

CVE-2026-12309

CVE-2026-12309 describes a memory-safety bug in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The Debian/Ubuntu/Nessus notes corroborate that Firefox ESR was updated to 140.12.x and Firefox to 152.x, indicating remediat...

CVE-2026-12316

CVE-2026-12316 describes a mitigation bypass in the DOM: Security component that was fixed in Mozilla Firefox 152 and Thunderbird 152. The connected documents confirm that this is a software-level patch by Mozilla, addressing a DOM-related security bypass. The vulnerability details in the public ...

CVE-2026-16369

CVE-2026-16369 : Integer overflow in the JavaScript: WebAssembly component of Mozilla Firefox. Affected: Firefox browser (WebAssembly/JavaScript engine). Root cause: integer overflow. Impact: fixed in Firefox 153 and Firefox ESR 140.13. Mitigation: upgrade Firefox to 153 (or ESR 140.13) to apply ...

CVE-2026-2766

CVE-2026-2766 is a use-after-free in the JavaScript Engine: JIT component of Firefox/Firefox ESR that was fixed in Firefox 148, ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products in the provided documents include Firefox-based browsers and Thunderbird; multiple advisories (Astra...

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-4688

CVE-2026-4688 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9. The available documents do not provide exploit details or specific remediation steps beyond...

CVE-2026-74956

Firefox and Thunderbird's DOM: Service Workers component has a same-origin policy bypass allowing cross-origin data access and manipulation. CVSS 9.1 (critical). Fixed in Firefox 154, ESR 153.1, Thunderbird 154, and 153.1. No exploitation reported in provided documents. Debian/Ubuntu users withou...

CVE-2025-10532

CVE-2025-10532 involves incorrect boundary conditions in the JavaScript: GC component affecting Firefox and Thunderbird products. Affected versions: Firefox and Thunderbird before 143, and ESR before 140.3. Connected advisories indicate fixes released as Firefox/Thunderbird updates (e.g., Firefox...

CVE-2025-11712

The CVE-2025-11712 entry is supported by connected documents describing the same issue across Mozilla products. Affected software for this CVE includes Firefox and Thunderbird prior to version 144 (Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, Thunderbird

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2025-8041

The CVE-2025-8041 entry concerns Mozilla Firefox for Android, where the address bar truncates URLs from the end instead of prioritizing the origin, allowing a security bypass in Firefox versions prior to 141. Affected product: Firefox for Android; vulnerable component: address bar URL rendering l...

CVE-2026-16354

CVE-2026-16354 affects Mozilla Firefox when using the Graphics: ImageLib component, causing information disclosure. The vulnerability is addressed in Firefox 153 and Firefox ESR 115.38 and 140.13. Connected sources corroborate that this issue is resolved by these version fixes; no exploitation st...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-74937

CVE-2026-74937 is a use-after-free vulnerability in the JavaScript: GC component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges required, but user interaction required, leading to high impact on confidentiality, in...

CVE-2026-8970

The CVE describes a privilege-escalation in the Firefox Security component. Concrete detail from sources: the flaw is fixed in Firefox 151 and Firefox ESR 140.11. Affected scope is stated only as the Security component; no deeper root cause, affected subcomponents, or explicit exploit paths are p...

CVE-2025-11709

CVE-2025-11709 is documented across multiple sources (Mozilla advisories and Amazon/Linux bulletins) as a memory-safety/out-of-bounds issue triggered by manipulated WebGL textures in a compromised web process, affecting Firefox and Thunderbird before version 144 (and ESR branches like ESR 115.29/...

CVE-2025-11711

The provided connected advisories confirm CVE-2025-11711 affects Firefox and Thunderbird across multiple versions (Firefox < 144, ESR < 140.4, Thunderbird < 144, ESR

CVE-2025-14861

Firefox versions prior to 146.0.1 are affected by memory safety bugs (CVE-2025-14861) that can lead to memory corruption and, with enough effort, arbitrary code execution. The issue is fixed in Firefox 146.0.1; affected products include Firefox

CVE-2025-8043

CVE-2025-8043 relates to Firefox and Thunderbird where URL truncation occurs toward the origin, with affected versions Firefox < 141 and Thunderbird

CVE-2026-0880

CVE-2026-0880 is a sandbox-escape vulnerability: sandbox escape due to an integer overflow in the Graphics component. Affected products include Firefox (<147), Firefox ESR (<115.32 and <140.7), Thunderbird (<147 and

CVE-2026-0884

CVE-2026-0884 is a use-after-free in the JavaScript Engine component. Affected products include Firefox (versions before 147 and ESR before 140.7) and Thunderbird (versions before 147 and ESR before 140.7). The issue is confirmed in multiple security advisories and Debian/Distro records. Remediat...

CVE-2026-12320

CVE-2026-12320 affects the Password Manager component in Firefox and Thunderbird. The vulnerability enables information disclosure and is documented with a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, low attack complexity, no privileges required, but user interaction is requi...

CVE-2026-12326

CVE-2026-12326 is a Firefox/Thunderbird memory-safety issue affecting Firefox 151 and Thunderbird 151. The available sources indicate memory corruption that could be exploited to run arbitrary code, with a fix delivered in Firefox 152 and Thunderbird 152. The vulnerability details include affecte...

CVE-2026-16403

CVE-2026-16403 affects Mozilla Firefox’s Address Bar spoofing functionality. The connected sources consistently identify a spoofing issue in the Address Bar component that was fixed in Firefox 153. Details across SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, and CVE listings corroborate the same root ca...

CVE-2026-2759

The CVE-2026-2759 issue is concrete: it concerns incorrect boundary conditions in the Graphics: ImageLib component affecting Firefox/Thunderbird products. The description explicitly states the vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thun...

CVE-2026-2795

CVE-2026-2795 is a use-after-free in the JavaScript: GC component affecting Mozilla Firefox and Mozilla Thunderbird. Technical details across connected sources consistently identify the flaw in the GC object handling, with exploitation risk implied by the high/critical CVSS data. The vulnerabilit...

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2026-2802

The CVE-2026-2802 entry describes a race condition in the JavaScript: GC component. Connected sources confirm this affects Firefox and Thunderbird and state the vulnerability was fixed in Firefox 148 and Thunderbird 148. Practical impact is a concurrency issue in the GC path; no exploitation deta...

CVE-2026-4722

CVE-2026-4722 describes a privilege escalation in the IPC component affecting Firefox

CVE-2026-8390

Mozilla Firefox is affected by a use-after-free in the JavaScript: WebAssembly component (CVE-2026-8390). The issue resides in WebAssembly within Firefox’s JavaScript engine and was fixed in version 150.0.3. Affected products are Firefox releases prior to 150.0.3, across platforms referenced in t...

CVE-2025-10537

CVE-2025-10537 involves memory-safety bugs in Mozilla Firefox and Thunderbird (Firefox ESR 140.2/ Thunderbird ESR 140.2; Firefox 142/ Thunderbird 142) with potential to corrupt memory and, with enough effort, could allow arbitrary code execution. Affected: Firefox < 143, Firefox ESR < 140.3...

CVE-2026-12305

Memory-safety vulnerability CVE-2026-12305 affecting Mozilla Firefox and Thunderbird, fixed in Firefox 152 (including ESR 140.12) and Thunderbird 152/140.12. Root cause stated as memory safety bug; no exploitation details provided. Remediation: upgrade to Firefox 152 / ESR 140.12 and Thunderbird ...

CVE-2026-12317

CVE-2026-12317 is a memory-safety vulnerability fixed in Firefox 152 and Thunderbird 152. Affected products are Firefox/Thunderbird; root cause is a memory-safety bug.remediation is to upgrade to Firefox 152 / Thunderbird 152 as indicated by multiple advisories (e.g., Mozilla MFSA advisories and ...

CVE-2026-16370

CVE-2026-16370 is a mitigation bypass vulnerability in the DOM Networking component of Mozilla Firefox. Affected product: Mozilla Firefox earlier than 153.0. Root cause: mitigation bypass in the DOM: Networking component, resolved by the Firefox 153 release. Impact as described in sources: high c...

CVE-2026-16400

Technical details (affected products, components, versions, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-2789

CVE-2026-2789 — Use-after-free in Graphics: ImageLib Affected software: Mozilla Firefox (and Firefox ESR) and Thunderbird. The vulnerability arises from a use-after-free in the Graphics: ImageLib component. Affected versions are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunder...

CVE-2026-2798

CVE-2026-2798 is a use-after-free in the DOM: Core & HTML components affecting Firefox and Thunderbird. It was fixed in Firefox 148 and Thunderbird 148. Public exploits exist. Remediation: update to the latest Firefox/Thunderbird versions (148+).

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-3846

CVE-2026-3846: A same-origin policy bypass in Firefox’s CSS Parsing and Computation component. Affected: Mozilla Firefox before 148.0.2. Root cause: bypass in CSS parsing/calculation logic. Impact: potential security restriction bypass (I: High per CVSS data). Status: fixed in Firefox 148.0.2; re...

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-6778

CVE-2026-6778 describes an invalid pointer in the Audio/Video: Playback component of Mozilla Firefox (and Thunderbird) that was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 5.3 (Medium) with availability impact Low; no exploit specifics are provided in the sources. OpenSUS...

CVE-2026-74961

CVE-2026-74961 is a side-channel vulnerability in the Web Audio component of Mozilla Firefox and Thunderbird. It is rated CVSS 9.1 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on both confidentiality and integrity. The flaw allows an attacke...