CVE-2025-10859

CVE-2025-10859 affects Mozilla Firefox for iOS (pre-143.1). The issue is an information disclosure caused by cookie storage for non-HTML temporary documents being shared with normal browsing content, allowing data from private/incognito tabs to be exposed even after all tabs are closed. Impact de...

CVE-2025-13021

CVE-2025-13021 is an active issue affecting Firefox and Thunderbird prior to version 145, caused by incorrect boundary conditions in the Graphics: WebGPU component. Public advisories (mfsa2025-90) reference memory-safety concerns in Firefox/Thunderbird around 144 as context, and Fedora/Mozilla ad...

CVE-2025-55028

CVE-2025-55028 affects Mozilla Firefox for iOS. The issue arises from malicious scripts using repetitive JavaScript alerts that can prevent user interaction, potentially enabling denial-of-service scenarios. Affected version range is Firefox for iOS before 142. The available connected documents c...

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-16380

CVE-2026-16380 describes a mitigation bypass in the Networking component of Mozilla Firefox. The issue is characterized in the sources as a bypass vulnerability that was fixed in Firefox 153. The affected product is Mozilla Firefox; detailed root cause and affected subcomponents are not explicitl...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-16406

CVE-2026-16406: A mitigation bypass in the Networking component was reported for Firefox; the vulnerability is addressed by Firefox 153. The available sources do not specify the exact root cause, affected subcomponents, or exploitation details beyond the fix version. CVSSv3.1 metrics are provided...

CVE-2026-74948

CVE-2026-74948 is an information disclosure vulnerability in the Graphics component of Mozilla Firefox and Thunderbird. The CVSS 3.1 base score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning a remote attacker with user interaction can achieve high confidentiality im...

CVE-2026-74977

CVE-2026-74977 is an integer overflow in the Graphics component of Firefox and Thunderbird , rated CVSS 7.5 (High) with a network attack vector requiring no user interaction or privileges, resulting in a high availability impact (denial of service). CISA SSVC assesses no known exploitation , auto...

CVE-2026-84121

CVE-2026-84121 is a sandbox escape in Mozilla Firefox caused by a use-after-free in the DOM: Security component. A successful exploit allows an attacker to escape the browser sandbox, resulting in total technical impact (high confidentiality, integrity, and availability impact) across a changed s...

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2008-2014

CVE-2008-2014 affects Mozilla Firefox 3.0 beta 5. The vulnerability allows a remote attacker to cause a denial of service (application crash) by sending JavaScript that calls document.write in an infinite loop. Exploitation details and exact impact are described in the NVD entry; other connected ...

CVE-2025-11152

CVE-2025-11152: Firefox's Graphics: Canvas2D contains an integer overflow that enables sandbox escape in versions prior to 143.0.3. The affected component and root cause are described across multiple sources; exploitation status is not detailed in the provided documents; no explicit remediation i...

CVE-2025-11153

CVE-2025-11153 describes a JIT miscompilation in the JavaScript Engine (JIT component) of Mozilla Firefox . The vulnerability affects Firefox versions earlier than 143.0.3 . The reported impact is a partial escalation path with remote/network exposure and high partial impact on integrity , per CV...

CVE-2025-11717

CVE-2025-11717 affects Mozilla Firefox versions earlier than 144. The issue occurs when switching between Android apps via the card carousel, causing a black screen for the card image if a password-related screen was the last used; before 144, the password edit screen was visible. Practical impac...

CVE-2026-12301

CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...

CVE-2026-12330

CVE-2026-12330 corresponds to an issue in the Internationalization component with incorrect boundary conditions. Public disclosures in connected advisories confirm multiple Mozilla products are affected, including Firefox ESR and Thunderbird. Debian’s advisory shows the vulnerability affecting fi...

CVE-2026-16374

The CVE-2026-16374 entry concerns information disclosure in the Framework component of Firefox DevTools. Affected product: Mozilla Firefox (DevTools Framework). Root cause/impact: information disclosure; CVSS_BASE score 7.5 (HIGH) with network access and no user interaction. Mitigation: upgrade t...

CVE-2026-4693

CVE-2026-4693: Affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2026-4699

CVE-2026-4699: Incorrect boundary conditions in Firefox/Thunderbird Layout: Text and Fonts. Affected products include Firefox (pre-149, ESR 115.34/140.9) and Thunderbird (pre-149/140.9). A fix is available in Firefox 149, ESR 115.34, 140.9 and Thunderbird 149, 140.9. Upgrade to the patched releas...

CVE-2026-74959

CVE-2026-74959 is a mitigation bypass in the Storage: Cache API component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 9.1 (CRITICAL) with a network attack vector, low complexity, no privileges or user interaction required, and high impact on both confidentiality and integrity. CISA...

CVE-2026-8952

CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2025-14325

CVE-2025-14325 is a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146 and Firefox ESR

CVE-2026-12303

CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...

CVE-2026-12322

CVE-2026-12322 is a clickjacking vulnerability in the Gtk Widget component affecting Mozilla Firefox and Thunderbird. The issue, described across multiple sources, is due to a UI framing/embedding flaw that could enable deceptive UI interaction. Affected products were updated to mitigate the vuln...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-4706

CVE-2026-4706: In Graphics: Canvas2D, a boundary-condition issue could affect Firefox/Thunderbird before certain releases. Public advisories indicate fixes in Firefox 149, ESR 115.34 and ESR 140.9, and Thunderbird 149 and 140.9. Upgrading to these versions (or later) is the advised remediation pe...

CVE-2026-4715

CVE-2026-4715 involves uninitialized memory in the Graphics: Canvas2D component. Affected products are Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 140.9. The connected records (NVD and CVE/CVE List entries) confirm the vulnerability and its scope but do not provide deta...

CVE-2026-4725

CVE-2026-4725 describes a sandbox escape due to a use-after-free in the Graphics: Canvas2D component, affecting Firefox versions older than 149. The vulnerability impact is described in public CVE records; no exploitation details are provided in the connected documents. Affected software: Firefox...

CVE-2026-74971

Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...

CVE-2026-84119

CVE-2026-84119 is a sandbox escape in Mozilla Firefox caused by a use-after-free bug in the DOM: Navigation component. An attacker can exploit this via a network vector with low complexity and user interaction to gain full confidentiality, integrity, and availability impact (scope changed), yield...

CVE-2025-13016

CVE-2025-13016 is a Mozilla Firefox/Firefox ESR JavaScript: WebAssembly component boundary-condition vulnerability. Connected advisories confirm the flaw affects Firefox <145 and ESR

CVE-2026-12319

CVE-2026-12319 is a reported DoS in the Audio/Video: Playback component. Multiple connected sources confirm the issue affects Firefox and Thunderbird and that it was fixed in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges...

CVE-2026-16408

CVE-2026-16408 describes an Integer overflow in the Audio/Video: Playback component. Affected software is Mozilla Firefox; fixed in Firefox 153. CVSS: 3.1, CRITICAL (9.8), Network attack, no user interaction, impact on confidentiality, integrity, and availability HIGH. Other sources corroborate t...

CVE-2026-16409

CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....

CVE-2026-4707

CVE-2026-4707 is a vulnerability in the Graphics: Canvas2D component caused by incorrect boundary conditions. It affects Firefox (pre-149), Firefox ESR (pre-115.34 and pre-140.9) and is also listed similarly in related advisories. The issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9. If...

CVE-2026-74942

A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...

CVE-2026-74966

Firefox and Thunderbird are vulnerable to information disclosure via the Form Autofill component. CVSS 7.5 (network, no auth/interaction required) rates it HIGH for confidentiality. CISA SSVC marks exploitation as none. Fix: upgrade to Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbi...

CVE-2026-74967

Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...

CVE-2026-74972

Information disclosure in Firefox/Thunderbird's DOM: Push Subscriptions component exposes sensitive data to malicious sites. CVSS 4.3 (MEDIUM), network-reachable with user interaction required. Fixed in Firefox 154, ESR 140.14/153.1, Thunderbird 154/140.14/153.1. No in-the-wild exploitation repor...

CVE-2025-11714

CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2026-0882

CVE-2026-0882 : Use-after-free in the IPC component exposed in Firefox < 147, Firefox ESR < 115.32 and < 140.7, Thunderbird < 147 and

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...