CVE-2026-8964

The CVE-2026-8964 entry describes a spoofing issue in the Popup Blocker component. The vulnerability is stated to be fixed in Firefox 151 and Thunderbird 151, indicating a patch/upgrade is available for mitigation. The available data list the impact as high (I: High) with a network attack vector ...

CVE-2026-8969

CVE-2026-8969 is a mitigation bypass in the DOM: Security component that was fixed in Firefox 151 and Thunderbird 151. The CVSS 3.1 base vector indicates Network attack vector, no privileges required, user interaction required, with high impact to confidentiality and integrity and no impact on av...

CVE-2025-13020

CVE-2025-13020 is a use-after-free vulnerability in the WebRTC: Audio/Video component of Mozilla Firefox/Thunderbird. Affected: Firefox <145, Firefox ESR <140.5, Thunderbird

CVE-2025-13022

CVE-2025-13022 is a boundary-condition flaw in the Graphics: WebGPU component that affects Firefox and Thunderbird, both prior to version 145. Root cause: incorrect boundary handling in WebGPU. Impact: high-severity potential for crashes or arbitrary code execution per the CVSS data. Affected pro...

CVE-2025-13026

The CVE-2025-13026 entry concerns a sandbox escape caused by incorrect boundary conditions in the Graphics: WebGPU component. Affected products are Mozilla Firefox and Thunderbird listed as <145 versions (Firefox <145 and Thunderbird

CVE-2025-14323

CVE-2025-14323 describes a privilege-escalation vulnerability in the DOM: Notifications component affecting Firefox < 146, Firefox ESR < 115.31, and Firefox ESR

CVE-2025-55031

CVE-2025-55031 affects Firefox for iOS and Firefox Focus for iOS prior to version 142. A malicious page can trigger FIDO/hybrid passkey transport by passing FIDO links to the OS, and an attacker within Bluetooth range could coerce a user into using their passkey to sign into the attacker’s machin...

CVE-2026-0882

CVE-2026-0882 : Use-after-free in the IPC component exposed in Firefox < 147, Firefox ESR < 115.32 and < 140.7, Thunderbird < 147 and

CVE-2026-16393

CVE-2026-16393 affects the Graphics: WebGPU component in Firefox. The root cause is incorrect boundary conditions in this component, leading to a potential impact on confidentiality and availability (C:H I:N A:H) with a high-severity rating (CVSS 3.1: 9.1, Network attack, no user interaction). Th...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2026-74959

CVE-2026-74959 is a mitigation bypass in the Storage: Cache API component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 9.1 (CRITICAL) with a network attack vector, low complexity, no privileges or user interaction required, and high impact on both confidentiality and integrity. CISA...

CVE-2026-74967

Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...

CVE-2026-74969

CVE-2026-74969 is a use-after-free vulnerability in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird. It carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector, low complexity, no privileges required, and user interaction required, impacting confidentiality, in...

CVE-2026-8965

CVE-2026-8965 is an information-disclosure vulnerability in the DOM: Security component, affecting Mozilla Firefox and Mozilla Thunderbird up to version 151. The issue is fixed in Firefox 151 and Thunderbird 151. Affected products include Mozilla Firefox earlier than 151.0 and Mozilla Thunderbird...

CVE-2025-13025

CVE-2025-13025 describes incorrect boundary conditions in the Graphics: WebGPU component. Affected are Firefox and Thunderbird versions earlier than 145. Access vector/exploitation details are not provided in the documents, but advisories indicate the issue is addressed by updating to Firefox/Thu...

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2025-54145

The CVE-2025-54145 issue affects Mozilla Firefox for iOS, specifically versions before 141. The vulnerability arises from the QR scanner and Firefox’s open-text URL scheme, which could cause a user to load arbitrary websites. Documented impact is high (H) with user interaction required and no pri...

CVE-2026-0892

CVE-2026-0892 concerns memory safety bugs in Mozilla Firefox and Thunderbird prior to version 147. The CVE description notes memory corruption with potential for arbitrary code execution, affecting Firefox < 147 and Thunderbird

CVE-2026-5732

CVE-2026-5732 describes an issue with incorrect boundary conditions and an integer overflow in the Graphics: Text component. Affected products include Firefox and Thunderbird (and their ESR releases). The vulnerability impacts versions older than Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird ...

CVE-2025-13014

CVE-2025-13014 is a use-after-free in the Audio/Video component affecting Firefox < 145, Firefox ESR < 140.5, and Thunderbird < 145 /

CVE-2026-16376

CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Firefox. Affected software refers to Mozilla Firefox before version 153, where the issue was fixed in Firefox 153. The available sources confirm a DoS impact in the Graphics: WebGPU pipeline but do not provid...

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-16398

CVE-2026-16398 is a site isolation issue in Firefox's Graphics component. Affected product: Mozilla Firefox prior to version 153. Root cause: site isolation in the Graphics component. Impact: confidentiality impact (C), no integrity or availability impact described; CVSSv3.1 shows 7.5 (HIGH) with...

CVE-2026-16399

Technical details about CVE-2026-16399 are not publicly available in the provided documents. The sources summarize a site isolation issue in the DOM: Navigation component with Firefox fix in version 153. Monitor for updates.

CVE-2026-16402

CVE-2026-16402 describes an integer overflow in the Graphics: ImageLib component. The vulnerability is confirmed across multiple advisories and vendors (SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, CVE.org, etc.). The issue is fixed in Firefox version 153. The available connected sources do not provide...

CVE-2026-16409

CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....

CVE-2026-4685

Summary: CVE-2026-4685 concerns the Graphics: Canvas2D component with incorrect boundary conditions. Affects Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9. Root cause described as incorrect boundary conditions in the Canvas2D implementation. References include ...

CVE-2026-74948

CVE-2026-74948 is an information disclosure vulnerability in the Graphics component of Mozilla Firefox and Thunderbird. The CVSS 3.1 base score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, meaning a remote attacker with user interaction can achieve high confidentiality im...

CVE-2026-74973

CVE-2026-74973 is a race condition leading to use-after-free in the Graphics component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 4.2 (Medium) , reflecting a network attack vector with high complexity, required user interaction, and low impact on confidentiality and integrity with ...

CVE-2026-12321

Summary: CVE-2026-12321 is a JIT miscompilation in the JavaScript: WebAssembly component. Affected products: Firefox and Thunderbird (WebAssembly/JS engine). Root cause: JIT miscompilation in the WebAssembly component. Impact: Not explicitly quantified beyond miscompilation; CVSS v3.1 base score ...

CVE-2026-16397

CVE-2026-16397 describes a clickjacking vulnerability in the WebExtensions component of Firefox for Android. The issue affects the WebExtensions surface and was addressed with a product update, fixed in Firefox 153. The CVSS 3.1 vector indicates network access, low attack complexity, no privilege...

CVE-2026-4697

CVE-2026-4697 concerns incorrect boundary conditions in the Audio/Video: Web Codecs component. Public advisories list affected products as Firefox (pre-149 and ESR 140.9), and Thunderbird alongside Firefox fixes. The issue is defined as a boundary-condition flaw in the WebCodecs path, with fixed ...

CVE-2026-4714

CVE-2026-4714 is an Audio/Video boundary-condition vulnerability present in Mozilla Firefox/Thunderbird stack. The initial entry states impact as high (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 3.1 base 7.5) with exploitation not described in the sources. Connected advisories confirm the issue af...

CVE-2026-4717

CVE-2026-4717: Privilege escalation in the Netmonitor component. According to the provided advisories, Firefox and Firefox ESR are affected and the issue is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability originated in the Netmonitor component an...

CVE-2026-74972

Information disclosure in Firefox/Thunderbird's DOM: Push Subscriptions component exposes sensitive data to malicious sites. CVSS 4.3 (MEDIUM), network-reachable with user interaction required. Fixed in Firefox 154, ESR 140.14/153.1, Thunderbird 154/140.14/153.1. No in-the-wild exploitation repor...

CVE-2025-11713

CVE-2025-11713: Potential user-assisted code execution via the Copy as cURL feature. Affected products per the sources include Firefox versions prior to 144, Firefox ESR prior to 140.4, Thunderbird versions prior to 144, and Thunderbird prior to 140.4. Root cause: insufficient escaping in the Cop...

CVE-2025-13023

CVE-2025-13023 is a sandbox-escape vulnerability in Graphics: WebGPU, affecting Firefox < 145 and Thunderbird

CVE-2025-55030

CVE-2025-55030 concerns Firefox for iOS where a mis-handling of the Content-Disposition header (Attachment) allows inline content display and potential XSS. Affected: Firefox for iOS versions prior to 142. Root cause: improper handling of the Content-Disposition header for certain MIME types. Imp...

CVE-2026-0889

CVE-2026-0889 describes a Denial-of-Service in the DOM: Service Workers component, affecting Mozilla Firefox and Mozilla Thunderbird versions earlier than 147. The CVE’s publicly documented impact is DoS with the DOM Service Workers, and the related advisory notes advise updating to the latest ve...

CVE-2026-4712

The CVE covers an information-disclosure vulnerability in the Widget: Cocoa component affecting Firefox before 149 and Firefox ESR before 140.9. Affected product/component: Firefox/Firefox ESR on Cocoa widgets; vulnerability details (root cause, exploitability) are not provided in the supplied do...

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2026-74942

A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...

CVE-2026-74968

Firefox's WebRender component has a site isolation flaw allowing cross-site data access or tampering, rated CVSS 5.4 (Medium). Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported. Users should update immediately. Mozilla advisories: mfsa2026-74, mfsa2026-77.

CVE-2026-74977

CVE-2026-74977 is an integer overflow in the Graphics component of Firefox and Thunderbird , rated CVSS 7.5 (High) with a network attack vector requiring no user interaction or privileges, resulting in a high availability impact (denial of service). CISA SSVC assesses no known exploitation , auto...

CVE-2025-11715

CVE-2025-11715 is part of a family of memory-safety issues affecting Mozilla Firefox and Thunderbird. Connected sources confirm memory safety bugs and memory corruption with potential to execute arbitrary code, affecting Firefox/Thunderbird and their ESR releases prior to version 144 (and ESR 140...

CVE-2026-4687

CVE-2026-4687 describes a sandbox-escape vulnerability in the Mozilla Firefox/Thunderbird Telemetry component caused by incorrect boundary conditions. Connected advisories confirm the issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9, Thunderbird 149 and Thunderbird 140.9, with related e...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-74963

Firefox and Thunderbird suffer a same-origin policy bypass in their Networking: Cookies component, allowing cross-origin access to cookies. CVSS 5.4 (Medium). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, 153.1. No in-the-wild exploitation reported; user interaction requir...

CVE-2026-74984

A race condition in the Firefox/Thunderbird JavaScript Engine allows remote attackers (with user interaction) to achieve high confidentiality and integrity impact. CISA reports no exploitation. Remediation: upgrade to Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbird 153.1.