CVE-2025-10528

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape due to undefined behavior and an invalid pointer within the Graphics: Canvas2D component. This flaw allows an attacker to bypass the sandbox, potentially leading to privilege escalation. The vulnerability affects v...

CVE-2025-13019

A same-origin policy bypass exists in the DOM: Workers component of Mozilla Firefox and Firefox ESR . This vulnerability allows an attacker to remotely bypass existing security restrictions. Affected versions include Firefox < 145 and Firefox ESR

CVE-2025-8041

Mozilla Firefox for Android versions prior to 141 are vulnerable to a security bypass and UI spoofing issue. The vulnerability stems from the address bar improperly truncating URLs from the end instead of prioritizing the origin. This allows an attacker to bypass security restrictions and spoof t...

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-8952

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a privilege escalation flaw within the Application Update component. Insecure management of privileges allows a malicious actor to trigger service interruptions or cause a service failure. The vulnerability aff...

CVE-2026-92045

CVE-2026-92045 involves a sandbox escape vulnerability caused by incorrect boundary conditions in the WebRTC component . This flaw impacts multiple products including Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderb...

CVE-2026-92059

The DOM: Editor component in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to incorrect boundary conditions . This security issue has been addressed in versions Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the vulnerability is listed ...

CVE-2026-92079

A mitigation bypass exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird . This vulnerability impacts several versions and was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific root cause is not detailed beyond the comp...

CVE-2005-1575

The CVE-2005-1575 issue concerns Mozilla Firefox for Windows (versions 0.10.1 and 1.0) where the file download dialog could misrepresent a file’s type. The root cause described across connected records is that a malicious HTTP Content-Type header combined with a filename containing whitespace, do...

CVE-2007-1762

Summary : CVE-2007-1762 affects Mozilla Firefox 2.0.0.1–2.0.0.3. The issue is that Firefox does not canonicalize URLs before checking them against the phishing site blacklist, enabling a remote attacker to bypass phishing protection by using multiple slashes in the URL. Impact (as stated) : Phish...

CVE-2007-5341

CVE-2007-5341 (Firefox Venkman RCE) : The connected documents confirm a remote code execution vulnerability in the Venkman script debugger of Mozilla Firefox, affecting versions before 2.0.0.8. They identify the affected component and vulnerable version but do not provide the underlying root caus...

CVE-2009-5017

Technical details about CVE-2009-5017 are not provided in the given documents. Monitor for updates.

CVE-2025-10537

Mozilla Firefox and Thunderbird are affected by memory safety bugs that exhibit evidence of memory corruption . These vulnerabilities could potentially be exploited to execute arbitrary code or cause service interruptions by performing operations outside of the buffer in memory. The affected vers...

CVE-2025-11709

Mozilla Firefox and Thunderbird are vulnerable to out-of-bounds reads and writes in a privileged process caused by manipulated WebGL textures . The vulnerability exists in the WebGL Texture Handler component, where a compromised web process can trigger memory corruption to execute arbitrary code ...

CVE-2026-16399

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-3846

Mozilla Firefox versions prior to 148.0.2 are vulnerable to a Same-Origin Policy (SOP) bypass within the CSS Parsing and Computation component. The root cause is attributed to a lack of verification regarding the reliability of data sources or messages, which allows attackers to bypass existing s...

CVE-2026-4702

CVE-2026-4702 is a JIT miscompilation in the JavaScript Engine component. The primary entry states it is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Connected advisories consistently reference the same JIT/memory-safety context across Firefox/Thunderbird relea...

CVE-2026-4704

Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) affects Firefox/Firefox ESR and Thunderbird prior to fixed versions. Multiple documents confirm the issue and indicate fixes in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is associa...

CVE-2026-4716

CVE-2026-4716 is a boundary-condition and uninitialized-memory issue in the JavaScript Engine. Connected advisories associate it with Firefox/Thunderbird, stating it affects Firefox < 149 and Firefox ESR

CVE-2026-84125

A use-after-free vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Mozilla Thunderbird . This flaw affects the core browser engine and was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wil...

CVE-2026-8971

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a same-origin policy bypass within the Networking: JAR component. The root cause is attributed to a lack of source verification mechanism in the networking component. If exploited, an attacker can bypass securi...

CVE-2026-92041

A mitigation bypass vulnerability exists in the DOM: Networking component of the Firefox browser. This issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While specific technical root causes or exploit details are not provided, the vulnerability is ...

CVE-2026-92052

A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component due to uninitialized memory . This issue impacts Mozilla Firefox , Mozilla Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thund...

CVE-2007-5967

CVE-2007-5967 describes a flaw in Mozilla’s embedded certificate code that could allow a website to install root certificates on a device without user approval. Connected sources consistently reference Mozilla Firefox and the trust-management issue as the underlying root cause, with the impact de...

CVE-2010-1122

Technical details for CVE-2010-1122 are not provided in the connected documents. The materials reference other Firefox/WOFF issues but do not disclose affected components, versions, or fixes for this CVE. Monitor for updates.

CVE-2025-13024

Mozilla Firefox and Thunderbird are affected by a JIT miscompilation vulnerability within the JavaScript Engine: JIT component . This flaw arises from a compilation error that allows operations to be executed beyond memory buffer boundaries. A remote attacker can exploit this vulnerability to ach...

CVE-2026-0887

CVE-2026-0887 involves a clickjacking issue and information disclosure within the PDF Viewer component of Mozilla products. This vulnerability impacts Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird versions prior to 140.7. Ex...

CVE-2026-12319

The Firefox web browser and Thunderbird email client are affected by a Denial-of-Service (DoS) vulnerability in the Audio/Video: Playback component. The flaw is caused by an uncontrolled consumption of resources , which can allow a remote attacker to trigger service interruptions or cause a servi...

CVE-2026-16376

Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-4711

CVE-2026-4711 describes a use-after-free in the Cocoa-based Widget component affecting Mozilla Firefox before 149 and Firefox ESR before 140.9. The available sources consistently state the vulnerability type and affected versions but do not provide payload details, implicated files, root cause be...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability affecting the Networking: HTTP component in Mozilla products. This flaw impacts Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . N...

CVE-2026-92061

The Security: Process Sandboxing component in Firefox and Thunderbird is vulnerable due to incorrect boundary conditions . This flaw can potentially impact security boundaries within the sandboxing environment. The vulnerability was addressed and fixed in Firefox 156 and Thunderbird 156 . While t...

CVE-2026-92064

The Widget: Win32 component in Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to a sandbox escape caused by incorrect boundary conditions. This vulnerability affects various versions, with fixes available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and ...

CVE-2007-5414

CVE-2007-5414 describes a cross-site scripting (XSS) vulnerability in Mozilla Firefox prior to version 2.0. The issue arises when UTF-7 document content is rendered directly in UTF-7, allowing remote attackers to inject arbitrary script or HTML via a gopher URI that uses single quote characters t...

CVE-2008-0367

CVE-2008-0367 affects Mozilla Firefox (2.0.0.11, 3.0b2, and possibly earlier) in the HTTP Basic Authentication prompt, where prompting for credentials causes the realm text to display after the site, potentially enabling phishing/spoofing by remote servers. The available connected documents descr...

CVE-2011-4688

CVE-2011-4688 affects Mozilla Firefox 8.0.1 and earlier. The issue enables an attacker to infer whether a document is present in the browser cache by observing data related to the timing of Same Origin Policy violations during iframe load attempts, via crafted JavaScript. The OpenVAS entries corr...

CVE-2025-11711

This vulnerability exists in Mozilla Firefox and Thunderbird due to a flaw that allows an attacker to modify the values of JavaScript Object properties that are intended to be non-writeable. Affected versions include Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird &...

CVE-2025-13015

Mozilla Firefox and Firefox ESR are affected by a spoofing vulnerability caused by errors in the user interface's information representation. This flaw allows a remote attacker to conduct spear-phishing attacks . The issue impacts versions of Firefox prior to 145 , Firefox ESR prior to 140.5 , an...

CVE-2026-12323

The Firefox web browser and Thunderbird email client are affected by a DOM spoofing issue within the Core & HTML components. The root cause is attributed to improper restrictions on the visible layers of the user interface , which could allow a remote attacker to trigger service interruptions . R...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-92034

A site isolation issue exists in the Graphics component of Firefox and Thunderbird . This vulnerability is addressed in Firefox 156 and Thunderbird 156 . No specific root cause or exploitation details are provided in the documentation, but the issue has been identified in several distributions an...

CVE-2026-92043

The Audio/Video component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This issue impacts Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Remediation is available via patches in versions Firefox 156 , F...

CVE-2026-92046

A Use-after-free vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird . The issue affects these applications across various distributions, including openSUSE and SUSE Linux. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbir...