CVE-2026-92058

A use-after-free vulnerability exists in the Graphics component of the Firefox browser and Thunderbird. This flaw has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While one connected document (MGASA-2026-0441) characterizes this specific CVE ID as

CVE-2026-92069

This vulnerability involves a spoofing issue within the DOM: Navigation component . The flaw has been addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While multiple connected documents list this CVE, they do not provide specific tec...

CVE-2007-5896

Mozilla Firefox 2.0.0.9 is affected by CVE-2007-5896 where an iframe with JavaScript can trigger a denial of service by redirecting document.location to include a leading NULL byte with URIs such as res://, about:config, or file:///. The vulnerability allows remote attackers to cause CPU consumpt...

CVE-2008-3444

The connected records confirm a vulnerability in Mozilla Firefox 3.0 and 3.0.1 where the content layout component can be triggered by a crafted but well-formed HTML page containing a simple set of legitimate tags. This leads to a NULL pointer dereference and a browser crash, i.e., a denial of ser...

CVE-2025-10529

A same-origin policy bypass exists in the Layout component of Mozilla Firefox , Firefox ESR , and Thunderbird . The vulnerability is caused by the use of an untrusted intermediate policy file , which can allow a remote attacker to execute arbitrary code . Affected versions include Firefox < 14...

CVE-2025-11714

Mozilla Firefox and Thunderbird are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . Affected versions include Firefox ESR 115.28 , Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , ...

CVE-2025-13016

Mozilla Firefox and Firefox ESR browsers are vulnerable to a buffer overflow flaw caused by incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability allows a remote attacker to trigger a service failure (application crash) or potentially execute arbitrary code on...

CVE-2026-100756

The Audio/Video: Playback component is vulnerable to incorrect boundary conditions . An attacker could trigger a heap buffer overflow by inducing a user to open an email with a size greater than or equal to 2GB . Impacted products include Firefox (versions 157, ESR 115.42, 140.17, and 153.4) and ...

CVE-2026-4700

CVE-2026-4700 affects Firefox and Thunderbird; mitigation bypass in the Networking: HTTP component was fixed in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The CVSS 3.1 score is 9.8 (CRITICAL) with NETWORK attack vector and no user interaction. Remediation per provided docs: upgrade to F...

CVE-2026-8967

The Firefox web browser and Thunderbird email client are vulnerable to an information disclosure vulnerability within the Graphics: WebGPU component. This flaw allows a remote attacker to gain access to confidential data . The issue was addressed in Firefox 151 and Thunderbird 151 . No specific e...

CVE-2026-92013

Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions within the Graphics: CanvasWebGL component. This flaw impacts multiple versions of the software, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and corres...

CVE-2026-92023

A Use-after-free vulnerability exists in the XML component of the Mozilla Firefox and Thunderbird applications. This flaw could potentially allow an attacker to cause a crash or achieve arbitrary code execution. The issue has been addressed in the following versions: Firefox 156 , Firefox ESR 115...

CVE-2006-5783

CVE-2006-5783 affects Firefox 1.5.0.7 on Kubuntu Linux and is triggered by a long URL in an A tag, causing a denial of service (crash). The report is disputed by several vendors who could not reproduce it, and CVE notes the impact scope (system freeze) may not be Firefox-related; no fix/version i...

CVE-2026-4685

Summary: CVE-2026-4685 concerns the Graphics: Canvas2D component with incorrect boundary conditions. Affects Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9. Root cause described as incorrect boundary conditions in the Canvas2D implementation. References include ...

CVE-2026-4708

CVE-2026-4708 is an incorrect boundary conditions vulnerability in Mozilla Firefox’s Graphics component (Canvas2D) affecting Firefox < 149 and Firefox ESR

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-92020

The Graphics: WebRender component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This issue affects several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird...

CVE-2026-92022

A use-after-free vulnerability exists in the DOM: HTML Parser component of Mozilla Firefox and Thunderbird . This flaw can be triggered during the parsing of HTML content. The issue has been addressed in several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox E...

CVE-2026-92026

A use-after-free vulnerability exists in the Networking component of the Mozilla Firefox and Thunderbird applications. This issue is addressed in the following versions: Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . No specif...

CVE-2026-92073

CVE-2026-92073 is a privilege escalation vulnerability within the Enterprise Policies component of the Mozilla Firefox browser. This issue was addressed in Firefox version 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While various security advisories and package updates (su...

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2025-9186

A spoofing issue exists in the Address Bar component of Firefox Focus for Android . This vulnerability allows for the misrepresentation of critical information to the user. The issue was addressed in Firefox 142 . Exploitation details are not provided in the documents.

CVE-2026-0881

A sandbox escape vulnerability exists in the Messaging System component of Mozilla Firefox and the Thunderbird email client. The flaw originates from a weakness in data protection mechanisms , which could allow an attacker to bypass security restrictions and execute arbitrary code remotely . This...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2026-92011

The Graphics: CanvasWebGL component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This security flaw affects multiple versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 1...

CVE-2025-13022

Mozilla Firefox and the Thunderbird email client are vulnerable to a buffer overflow due to incorrect boundary conditions in the Graphics: WebGPU component. This flaw can lead to an attacker executing arbitrary code on the system, causing an application crash, or compromising the confidentiality,...

CVE-2025-54145

Mozilla Firefox for iOS versions prior to 141 are vulnerable to a security bypass where the QR scanner can be used to open arbitrary websites. The vulnerability occurs if a user is tricked into scanning a malicious link that leverages Firefox's open-text URL scheme . An attacker could exploit thi...

CVE-2025-55031

This vulnerability affects Firefox for iOS and Focus for iOS versions prior to 142 . Malicious pages can exploit the browser to pass FIDO: links to the OS, triggering the hybrid passkey transport . An attacker within Bluetooth range could leverage this to trick a user into using their passkey to ...

CVE-2026-100787

A sandbox escape vulnerability exists in the XUL component affecting Mozilla Firefox and Thunderbird . The flaw allows for a sandbox escape, and the issue has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the...

CVE-2026-3847

The Mozilla Firefox browser is affected by memory safety bugs in versions prior to 148.0.2 . Specifically, the CSS analysis and calculation components are susceptible to memory corruption caused by executing operations beyond the buffer boundaries. If successfully exploited, a remote attacker cou...

CVE-2026-4709

CVE-2026-4709 involves Firefox and Thunderbird components, specifically an incorrect boundary condition in the Audio/Video: GMP path. The vulnerability affects Firefox and Thunderbird releases prior to the fixes, with patches noted in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149 and...

CVE-2026-92076

CVE-2026-92076 is a vulnerability in the Networking component of Firefox and Thunderbird caused by incorrect boundary conditions . The issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the initial description notes the Networking compone...

CVE-2025-13020

A use-after-free vulnerability exists in the WebRTC: Audio/Video component of Mozilla Firefox and Thunderbird . The issue is caused by the reuse of memory after it has been freed, which could allow a remote attacker to cause service interruptions or, in some cases, achieve arbitrary code executio...

CVE-2026-12330

The Internationalization component in Mozilla Firefox and Mozilla Thunderbird contains a vulnerability due to incorrect boundary conditions . This issue affects various versions, including Firefox ESR 115.37 , Firefox ESR 140.12 , and Thunderbird 140.12 . Remediation is available in the specified...

CVE-2026-4717

CVE-2026-4717: Privilege escalation in the Netmonitor component. According to the provided advisories, Firefox and Firefox ESR are affected and the issue is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability originated in the Netmonitor component an...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2026-6781

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Playback component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an uncontrolled resource consumption issue within the playback functions, which could allow an attacker to trigger a service failure or service inte...

CVE-2026-92021

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox browser and Thunderbird mail client. This flaw was addressed in Firefox ESR 140.16 and Thunderbird 140.16 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-92029

A use-after-free vulnerability exists in the SVG component of Mozilla Firefox and Mozilla Thunderbird . This flaw can potentially lead to memory corruption or execution flow issues. Affected versions include various releases, and the vulnerability has been addressed in Firefox 156 , Firefox ESR 1...

CVE-2026-92072

This vulnerability exists in the Safe Browsing component due to incorrect boundary conditions . The flaw affects Mozilla Firefox and Thunderbird software. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Exploitation details are not provided ...

CVE-2025-11721

CVE-2025-11721 describes a memory safety bug in Firefox 143 and Thunderbird 143, with evidence of memory corruption and potential arbitrary-code execution. Affected versions include Firefox < 144 and Thunderbird

CVE-2025-13025

The Graphics: WebGPU component in Mozilla Firefox and Thunderbird versions prior to 145 is affected by incorrect boundary conditions. While the root cause is attributed to these boundary condition errors, related documentation indicates the vulnerability may involve the improper use of standard r...

CVE-2026-0889

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a Denial-of-Service (DoS) attack. The root cause is an error in the DOM: Service Workers component involving uncontrolled resource consumption . A malicious actor can exploit this flaw to cause the browser to c...

CVE-2026-5732

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by an integer overflow and incorrect boundary conditions within the Graphics: Text component. This vulnerability could potentially allow an attacker to execute arbitrary code remotely . Impacted versions include Firefox < 149.0.2, Fi...

CVE-2026-6756

The Firefox for Android browser is affected by a mitigation bypass vulnerability. This issue has been addressed in Firefox version 150 . For users on Fedora distributions (42, 43, and 44), it is recommended to update to Firefox 150.0 and NSS to 3.122.1 to remediate this and related vulnerabilitie...

CVE-2026-92039

A mitigation bypass exists in the DOM: Notifications component of the Mozilla Firefox browser and Thunderbird. This vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific details regarding the root cause or exploit vectors are provid...

CVE-2026-92077

A Denial-of-Service (DoS) vulnerability exists in the SVG component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is confirmed to affect the SVG component and was addressed in several security updates. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird...

CVE-2008-2014

CVE-2008-2014 affects Mozilla Firefox 3.0 beta 5. The vulnerability allows a remote attacker to cause a denial of service (application crash) by sending JavaScript that calls document.write in an infinite loop. Exploitation details and exact impact are described in the NVD entry; other connected ...

CVE-2025-11718

CVE-2025-11718 affects Mozilla Firefox versions earlier than 144. The issue allows a malicious page to spoof the address bar by creating a fake bar in response to a visibilitychange event when the Android address bar is hidden after scrolling. Impact is spoofing UI and potential user deception; n...