CVE-2025-10534

CVE-2025-10534 is a spoofing vulnerability in the Site Permissions component affecting Mozilla Firefox and Mozilla Thunderbird. Affected versions are Firefox < 143 and Thunderbird

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2025-11717

CVE-2025-11717 affects Mozilla Firefox versions earlier than 144. The issue occurs when switching between Android apps via the card carousel, causing a black screen for the card image if a password-related screen was the last used; before 144, the password edit screen was visible. Practical impac...

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-16374

The CVE-2026-16374 entry concerns information disclosure in the Framework component of Firefox DevTools. Affected product: Mozilla Firefox (DevTools Framework). Root cause/impact: information disclosure; CVSS_BASE score 7.5 (HIGH) with network access and no user interaction. Mitigation: upgrade t...

CVE-2026-2773

CVE-2026-2773 is a Chrome-like vulnerability in Firefox’s Web Audio component caused by incorrect boundary conditions, fixed in Firefox 148 and corresponding ESR releases (ESR 115.33 and ESR 140.8). The issue is documented across multiple advisories (Firefox security notes and vendor feeds) and i...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-2794

CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. Affected: Firefox/Firefox Focus for Android; root cause is uninitialized memory. Status: fixed in Firefox 148.0. Remediation: upgrade to Firefox 148 or later (per Mozilla advisory). Practic...

CVE-2026-4707

CVE-2026-4707 is a vulnerability in the Graphics: Canvas2D component caused by incorrect boundary conditions. It affects Firefox (pre-149), Firefox ESR (pre-115.34 and pre-140.9) and is also listed similarly in related advisories. The issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9. If...

CVE-2026-74946

A privilege escalation flaw in Firefox/Thunderbird's Graphics: CanvasWebGL component stems from incorrect boundary conditions. CVSS 8.8 (HIGH) with no privileges required and user interaction needed. Patched in Firefox 154, ESR 115.39/140.14/153.1, and Thunderbird 154/140.14/153.1. No active expl...

CVE-2026-74983

CVE-2026-74983 is a mitigation bypass in the Data Loss Prevention component of Mozilla Firefox and Thunderbird. The vulnerability allows an attacker to circumvent the DLP mechanism, potentially enabling unauthorized data exfiltration. The CVSS v3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/P...

CVE-2026-74988

CVE-2026-74988 covers internally found bugs in Thunderbird ESR 153.0 , Thunderbird 153 , Firefox ESR 153.0 , and Firefox 153 . Some of these bugs showed evidence of memory corruption or another security-relevant defect, and Mozilla presumes that with enough effort some could have been exploited. ...

CVE-2026-8951

The CVE-2026-8951 entry describes a Spoofing issue in the Toolbar component of Firefox for Android. The connected documents consistently identify the affected software as Firefox for Android and state the vulnerability was fixed in Firefox 151. There are no explicit technical details about the ro...

CVE-2026-9309

CVE-2026-9309 affects Firefox for iOS Reader View. The issue is improper escaping of HTML tags in JSON-LD metadata, enabling a malicious page to inject markup that leaks sensitive URL parameters and could lead to arbitrary JavaScript execution in an internal origin. Impact is described as access ...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2025-13016

CVE-2025-13016 is a Mozilla Firefox/Firefox ESR JavaScript: WebAssembly component boundary-condition vulnerability. Connected advisories confirm the flaw affects Firefox <145 and ESR

CVE-2025-14860

CVE-2025-14860 is a use-after-free vulnerability in Mozilla Firefox’s Disability Access APIs component, affecting Firefox versions earlier than 146.0.1. The available documents consistently identify the root cause as a use-after-free problem in Disability Access APIs, leading to either denial of ...

CVE-2026-12323

CVE-2026-12323 describes a spoofing issue in the DOM: Core & HTML component. The vulnerability affected Mozilla Firefox and Thunderbird and was fixed in Firefox 152 and Thunderbird 152. The available references confirm the DOM spoofing flaw and its patch in version 152. Practical impact is modest...

CVE-2026-16408

CVE-2026-16408 describes an Integer overflow in the Audio/Video: Playback component. Affected software is Mozilla Firefox; fixed in Firefox 153. CVSS: 3.1, CRITICAL (9.8), Network attack, no user interaction, impact on confidentiality, integrity, and availability HIGH. Other sources corroborate t...

CVE-2026-4699

CVE-2026-4699: Incorrect boundary conditions in Firefox/Thunderbird Layout: Text and Fonts. Affected products include Firefox (pre-149, ESR 115.34/140.9) and Thunderbird (pre-149/140.9). A fix is available in Firefox 149, ESR 115.34, 140.9 and Thunderbird 149, 140.9. Upgrade to the patched releas...

CVE-2026-74964

An integer overflow in Firefox/Thunderbird's Graphics component (CVSS 9.8 critical, network-exploitable with no privileges) enables arbitrary code execution, information disclosure, and denial of service. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154/140.14/153.1; Debian stable ...

CVE-2025-11153

CVE-2025-11153 describes a JIT miscompilation in the JavaScript Engine (JIT component) of Mozilla Firefox . The vulnerability affects Firefox versions earlier than 143.0.3 . The reported impact is a partial escalation path with remote/network exposure and high partial impact on integrity , per CV...

CVE-2025-14325

CVE-2025-14325 is a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146 and Firefox ESR

CVE-2025-55029

CVE-2025-55029 affects Mozilla Firefox for iOS prior to version 142. The issue allows malicious scripts to bypass the popup blocker and spam new tabs, potentially leading to a denial-of-service condition. Root cause is exploitation of popup-blocking bypass in Firefox for iOS; median impact is ava...

CVE-2026-0881

CVE-2026-0881 describes a sandbox escape in the Messaging System component affecting Mozilla Firefox and Mozilla Thunderbird before version 147. The root cause is a vulnerability in the Messaging System that can lead to arbitrary code execution with total impact (confidentiality, integrity, and a...

CVE-2026-12303

CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...

CVE-2026-16382

CVE-2026-16382 is a critical mitigation-bypass vulnerability in the Firefox DOM: Service Workers component. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation details are not provided in t...

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-4725

CVE-2026-4725 describes a sandbox escape due to a use-after-free in the Graphics: Canvas2D component, affecting Firefox versions older than 149. The vulnerability impact is described in public CVE records; no exploitation details are provided in the connected documents. Affected software: Firefox...

CVE-2026-74971

Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...

CVE-2025-11714

CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2025-54143

CVE-2025-54143 is tied to Firefox for iOS prior to version 141. The issue arises from sandboxed iframes on web pages that could bypass the parent page’s sandbox restrictions, potentially allowing downloads to the device. Affected product: Firefox for iOS

CVE-2025-54144

Summary: CVE-2025-54144 affects Firefox for iOS before version 141. The URL scheme used to facilitate searching of text queries could be abused to open arbitrary website URLs or internal pages if a user is tricked into clicking a link. This is described as a security bypass in Firefox for iOS pri...

CVE-2025-9186

CVE-2025-9186 concerns a spoofing vulnerability in the Address Bar of Firefox Focus for Android. Affected: Firefox versions earlier than 142.0. Root cause: spoofing in the Address Bar component. Impact per sources: potential spoof UI exploitation; no explicit exploitation details provided. Remedi...

CVE-2026-12300

CVE-2026-12300 describes a memory-safety issue that was fixed in Firefox 152 and Thunderbird 152. The available sources confirm the affected products are Mozilla Firefox/Thunderbird, with the underlying problem labeled as a memory safety bug. The CVSS metrics in the initial document indicate a ba...

CVE-2026-3847

Memory safety bugs exist in Firefox 148.0.2, with some signs of memory corruption. The CVE-2026-3847 issue affects Firefox and was fixed in version 148.0.2. It is described as memory safety-related, potentially enabling arbitrary code execution in some cases, though no exploit details are provide...

CVE-2026-4706

CVE-2026-4706: In Graphics: Canvas2D, a boundary-condition issue could affect Firefox/Thunderbird before certain releases. Public advisories indicate fixes in Firefox 149, ESR 115.34 and ESR 140.9, and Thunderbird 149 and 140.9. Upgrading to these versions (or later) is the advised remediation pe...

CVE-2026-4708

CVE-2026-4708 is an incorrect boundary conditions vulnerability in Mozilla Firefox’s Graphics component (Canvas2D) affecting Firefox < 149 and Firefox ESR

CVE-2026-4715

CVE-2026-4715 involves uninitialized memory in the Graphics: Canvas2D component. Affected products are Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 140.9. The connected records (NVD and CVE/CVE List entries) confirm the vulnerability and its scope but do not provide deta...

CVE-2026-74945

CVE-2026-74945 is an information disclosure vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating a network-exploitable issue requiring user interaction that results in ...

CVE-2026-74976

CVE-2026-74976 is a JIT miscompilation in the JavaScript Engine: JIT component of Mozilla Firefox and Thunderbird. The vulnerability can lead to high confidentiality impact (information disclosure) with no integrity or availability impact, per the CVSS 3.1 score of 6.5 (MEDIUM) . Attack requires ...

CVE-2026-12319

CVE-2026-12319 is a reported DoS in the Audio/Video: Playback component. Multiple connected sources confirm the issue affects Firefox and Thunderbird and that it was fixed in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges...

CVE-2026-4700

CVE-2026-4700 affects Firefox and Thunderbird; mitigation bypass in the Networking: HTTP component was fixed in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The CVSS 3.1 score is 9.8 (CRITICAL) with NETWORK attack vector and no user interaction. Remediation per provided docs: upgrade to F...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-74970

A site isolation flaw in Mozilla's Graphics component affects Firefox and Thunderbird. The issue allows a remote, unauthenticated attacker to potentially access or modify data in other process contexts via a crafted web page. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbi...

CVE-2026-74974

The vulnerability is a same-origin policy bypass in the Graphics: ImageLib component of Firefox and Thunderbird. Affected versions include Firefox ESR 140.13, ESR 153.0, and Thunderbird ESR 140.13, ESR 153.0. Remediation is to upgrade to Firefox ESR 140.14, ESR 153.1, Thunderbird 140.14, or Thund...

CVE-2026-8960

Summary: CVE-2026-8960 is a spoofing issue in WebExtensions that affects Firefox (and Thunderbird per NVD) and was fixed in Firefox 151 and Thunderbird 151. According to the sources, the vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no p...