3269 matches found
CVE-2026-8401
CVE-2026-8401 is a Firefox vulnerability describing a sandbox escape in the Profile Backup component. The issue is fixed in Firefox 150.0.3 per MFSA2026-45 and EU/OSV/NVD entries. Affected product: Mozilla Firefox (Profile Backup sandbox escape). Root cause details are not elaborated beyond the c...
CVE-2026-8962
CVE-2026-8962 is a mitigation bypass in the DOM: Security component affecting Firefox/Thunderbird. It was fixed in Firefox 151 and Firefox ESR 140.11, and in Thunderbird 151 and Thunderbird 140.11. CVSSv3.1 shows a HIGH base score (8.1) with NETWORK attack vector, LOW attack complexity, NONE requ...
CVE-2025-11719
CVE-2025-11719 affects Mozilla Firefox and Thunderbird. On Windows, use of the native messaging API by web extensions can trigger use-after-free memory corruption, leading to crashes. Affected versions: Firefox < 144 and Thunderbird
CVE-2025-13018
CVE-2025-13018 is a mitigation bypass in the DOM: Security component that affects Firefox <145, Firefox ESR <140.5, Thunderbird <145, and Thunderbird
CVE-2025-8364
Summary: CVE-2025-8364 affects Mozilla Firefox for Android (pre-141) due to a crafted blob: URI that can hide the page’s true origin, enabling potential spoofing. The issue is Android-only; other OSes are unaffected. Affected component is the browser’s handling of blob: URLs, with the root cause ...
CVE-2026-12306
CVE-2026-12306 is a memory-safety vulnerability fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The connected sources confirm the affected products and versions, with the Debian Fedora OSV entries echoing the same remediation. Practical impact is a potential sec...
CVE-2026-16352
CVE-2026-16352 is a sandbox-escape vulnerability due to a use-after-free in the Disability Access APIs component of Mozilla Firefox. The issue is fixed in Firefox 153 , and in Firefox ESR 115.38 and 140.13 . Affected product is Mozilla Firefox ESR (earlier than 115.38 per related advisory). The p...
CVE-2026-2769
CVE-2026-2769 is a use-after-free vulnerability in Firefox’s Storage: IndexedDB component. Affected products are Firefox versions earlier than 148, Firefox ESR earlier than 115.33, and Firefox ESR earlier than 140.8. The issue arises from a memory safety flaw in IndexedDB storage handling, leadin...
CVE-2026-2804
CVE-2026-2804 describes a use-after-free vulnerability in the JavaScript: WebAssembly component that affects Mozilla Firefox and Mozilla Thunderbird. The issue is fixed in Firefox 148 and Thunderbird 148. Connected advisories reaffirm the same root cause (memory management issue in the WebAssembl...
CVE-2026-4689
CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....
CVE-2026-4702
CVE-2026-4702 is a JIT miscompilation in the JavaScript Engine component. The primary entry states it is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Connected advisories consistently reference the same JIT/memory-safety context across Firefox/Thunderbird relea...
CVE-2026-4719
CVE-2026-4719 is a vulnerability described as incorrect boundary conditions in the Graphics: Text component. The connected advisories show affected products as Firefox (and Firefox ESR) and Thunderbird, with fixes implemented in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140...
CVE-2026-74950
A privilege escalation flaw in the Downloads API component of Firefox and Thunderbird allows network-based attackers to gain elevated privileges with user interaction. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1; no exploitation evidence reported by CISA. Updat...
CVE-2026-74965
A privilege escalation vulnerability exists in the Shell Integration component of Firefox and Thunderbird. CVSS 8.8 (HIGH) with network attack vector, no privileges required and user interaction needed. CISA reports no known exploitation. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbir...
CVE-2026-74985
Privilege escalation in the Enterprise Policies component of Firefox and Thunderbird allows an attacker with no privileges to gain elevated access. Affected products include Firefox (all versions below 154), Firefox ESR (below 153.1), Thunderbird (below 154), and Thunderbird ESR (below 153.1). Th...
CVE-2026-8961
CVE-2026-8961 is a spoofing issue in the Mozilla form autofill component. Publicly documented fixes apply to Firefox and Thunderbird updates: Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. OpenSUSE and Slackware advisories list Firefox ESR/Thunderbird updates (e.g., fir...
CVE-2026-8972
The CVE-2026-8972 issue affects the WebRTC: Audio/Video component in Mozilla Thunderbird (and Firefox) and is described as a privilege-escalation vulnerability. Technical sources consistently state it was fixed in Firefox 151 and Thunderbird 151. The available documents do not provide deeper root...
CVE-2025-11721
CVE-2025-11721 describes a memory safety bug in Firefox 143 and Thunderbird 143, with evidence of memory corruption and potential arbitrary-code execution. Affected versions include Firefox < 144 and Thunderbird
CVE-2026-0886
CVE-2026-0886 : The vulnerability arises from incorrect boundary conditions in the Graphics component, affecting Firefox versions below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. The connected documents confirm the same issue is referenced across Mozilla advisor...
CVE-2026-0887
CVE-2026-0887: Clickjacking information disclosure in the PDF Viewer component. Affected products per the CVE entry include Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird
CVE-2026-13356
The CVE-2026-13356 issue affects Firefox for iOS and centers on a malicious webpage that interrupts a pending navigation by enqueuing a synchronous JavaScript dialog. This side effect causes the browser UI to display the destination origin in the address bar while attacker-controlled content cont...
CVE-2026-16386
CVE-2026-16386 : Information disclosure caused by uninitialized memory in the Graphics: WebGPU component of Firefox. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to leakage of information. Impact as per source: Confidentiality impact HIGH; overall CVSSv3....
CVE-2026-16388
CVE-2026-16388 concerns a sandbox escape in the DOM within Firefox’ s Networking component. The available documents identify the affected software as Mozilla Firefox (DOM/Networking code path) and state the vulnerability was fixed in Firefox 153. The description provided does not reveal a detaile...
CVE-2026-2032
CVE-2026-2032 concerns Mozilla Firefox for iOS. The issue involves malicious scripts that interrupt new tab page loading, causing desynchronization between the address bar and page content. This can allow an attacker to forge arbitrary HTML under a trusted domain. The vulnerability affects Firefo...
CVE-2026-2785
CVE-2026-2785 is an Invalid pointer vulnerability in the Firefox JavaScript Engine. Connected sources show it being addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Debian/ALMA and Amazon Linux advisories enumerate Firefox-related fixes including this CVE and l...
CVE-2026-2807
CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...
CVE-2026-4696
The CVE-2026-4696 entry describes a Use-after-free in Firefox’s Layout: Text and Fonts component. Affected products are Firefox versions newer than? actually older than 149 for Firefox, and ESR variants: <115.34 and
CVE-2026-4716
CVE-2026-4716 is a boundary-condition and uninitialized-memory issue in the JavaScript Engine. Connected advisories associate it with Firefox/Thunderbird, stating it affects Firefox < 149 and Firefox ESR
CVE-2026-6780
CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...
CVE-2026-74954
A side-channel flaw in Firefox/Thunderbird's Storage: Cache API enables network-based information disclosure. Affected versions are fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. No public exploit or in-the-wild exploitation is reported. Users should upgrade to t...
CVE-2025-13015
CVE-2025-13015 is a spoofing vulnerability in Firefox affecting Firefox < 145, Firefox ESR < 140.5, and Firefox ESR
CVE-2025-13024
CVE-2025-13024 is caused by a JIT miscompilation in the JavaScript Engine: JIT component. It affects Mozilla Firefox and Mozilla Thunderbird prior to version 145. The reported impact is arbitrary code execution via the JIT issue, with memory-related concerns noted in related advisories. Remediati...
CVE-2025-14333
CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...
CVE-2025-55028
CVE-2025-55028 affects Mozilla Firefox for iOS. The issue arises from malicious scripts using repetitive JavaScript alerts that can prevent user interaction, potentially enabling denial-of-service scenarios. Affected version range is Firefox for iOS before 142. The available connected documents c...
CVE-2026-10701
CVE-2026-10701 relates to an Incorrect boundary condition in Firefox’s Graphics: Text component. Connected sources confirm this is addressed by the Firefox 151.0.3 update, fixing the vulnerability. The issue is described as a boundary condition problem within the Graphics: Text component and is i...
CVE-2026-16366
CVE-2026-16366 describes a privilege escalation in the DOM: Navigation component. Affected products are Firefox and Thunderbird before version 153; the issue is fixed in Firefox 153 and Thunderbird 153. The CVSS 3.1 base metrics indicate a High impact with network access as the attack vector, req...
CVE-2026-2764
CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR
CVE-2026-3845
CVE-2026-3845 : A heap buffer overflow in the Firefox for Android Audio/Video: Playback component was fixed in Firefox 148.0.2. The advisory reports a high-severity issue (CVSS v3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requiring user interaction. Affected product: Firefox for Android; vulne...
CVE-2026-4711
CVE-2026-4711 describes a use-after-free in the Cocoa-based Widget component affecting Mozilla Firefox before 149 and Firefox ESR before 140.9. The available sources consistently state the vulnerability type and affected versions but do not provide payload details, implicated files, root cause be...
CVE-2026-4713
CVE-2026-4713 is a Firefox graphics vulnerability: incorrect boundary conditions in the Graphics component. Affected: Firefox versions before 149 and ESR before 140.9. Mitigation: update to Firefox 149 or ESR 140.9 (patched). Details on exploitability or broader impact are not provided in the sup...
CVE-2026-74940
CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird . It carries a CVSS 3.1 score of 9.8 (Critical) with a network attack vector requiring no privileges or user interaction. The Debian advisory notes that the vulnerability could pote...
CVE-2026-74962
CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...
CVE-2026-8963
CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...
CVE-2026-8973
CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...
CVE-2025-8042
CVE-2025-8042 affects Mozilla Firefox for Android up to version 141. A sandboxed iframe without the allow-downloads attribute could initiate downloads, enabling information disclosure and potentially arbitrary code execution. CVSSv3.1 is high/critical with network vector, no user interaction. Rem...
CVE-2026-16359
CVE-2026-16359 concerns Mozilla Firefox’s Audio/Video: GMP component. The root cause is described as incorrect boundary conditions in this GMP-related path. The vulnerability is rated with CVSS 3.1 base score 9.1 (Network, Low Attack Complexity, No Privileges Required, User Interaction None, Conf...
CVE-2026-16362
CVE-2026-16362 is a use-after-free in Firefox’s WebRTC Audio/Video component. The issue affects Firefox and Firefox ESR prior to the listed fixes, with the vulnerability fixed in Firefox 153 and Firefox ESR 140.13. The CVSS–3.1 metrics indicate network attack vector, no privileges, user interacti...
CVE-2026-16364
CVE-2026-16364 describes incorrect boundary conditions in Mozilla Firefox's Audio/Video: Playback component, with impact per sources as a high-severity issue fixed in Firefox 153. Affected product: Mozilla Firefox versions earlier than 153.0. Root cause: boundary-condition error in the Playback s...
CVE-2026-16407
The CVE-2026-16407 entry describes a mitigation bypass in the DOM: Service Workers component. Affected software is Mozilla Firefox (and dependent Thunderbird) prior to version 153, with the underlying issue addressed by fixes in Firefox 153/Thunderbird 153. The practical impact is a bypass of mit...