CVE-2026-100781

A sandbox escape vulnerability exists in the Graphics: WebRender component due to incorrect boundary conditions . This issue affects multiple Mozilla products, including Firefox ESR 115.42 , Firefox ESR 140.17 , Firefox 157 , Thunderbird 140.17 , Thunderbird 153.4 , and Thunderbird 157 . The vuln...

CVE-2026-92015

A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw was addressed in the following releases: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thu...

CVE-2025-13023

The Mozilla Firefox web browser and Thunderbird email client are vulnerable to a sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. In some cases, this is also attributed to the improper handling of exceptional states within the WebGPU API interface. Successful...

CVE-2025-13025

The Graphics: WebGPU component in Mozilla Firefox and Thunderbird versions prior to 145 is affected by incorrect boundary conditions. While the root cause is attributed to these boundary condition errors, related documentation indicates the vulnerability may involve the improper use of standard r...

CVE-2025-14744

The Firefox for iOS browser is vulnerable to a security flaw in its Downloads component due to the improper handling of Unicode RTLO (Right-to-Left Override) characters. This allows malicious websites to perform filename spoofing within the downloads UI, which could trick users into saving files ...

CVE-2026-5733

A buffer overflow vulnerability exists in the Graphics:WebGPU component of Mozilla Firefox and Mozilla Thunderbird . The flaw is caused by incorrect boundary conditions , which may allow a remote attacker to execute arbitrary code or cause the application to crash by performing operations beyond ...

CVE-2026-92078

A Denial-of-Service vulnerability exists in the Security component of Mozilla Firefox and Thunderbird . This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit information is provided in the documentation.

CVE-2025-13026

A sandbox escape vulnerability exists in the Graphics: WebGPU component of the Mozilla Firefox browser and Thunderbird mail client. The root cause is incorrect boundary conditions and the improper handling of exceptional states . This flaw allows an attacker to bypass sandboxing protection mechan...

CVE-2025-55030

Mozilla Firefox for iOS versions prior to 142 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper handling of the Content-Disposition header ; specifically, the browser fails to respect the Attachment type, causing content to be displayed inline rather tha...

CVE-2026-4723

CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox

CVE-2026-96869

The Networking component in Firefox is subject to an information disclosure vulnerability (CVE-2026-96869 ). This issue was reported by Carlo Di Dato and has a moderate impact. The vulnerability has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit d...

CVE-2025-11715

Memory safety bugs exist in Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , and Thunderbird 143 . These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issues have been addressed in Firefox 144 , Firefox ESR 140.4 , Thunderbir...

CVE-2025-13017

A same-origin policy (SOP) bypass exists in the DOM: Notifications component of Mozilla Firefox and Firefox ESR browsers. An attacker can exploit this vulnerability to remotely bypass existing security restrictions and violate data protection mechanisms. This issue affects Firefox versions prior ...

CVE-2026-0888

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by an information disclosure vulnerability within the XML component . This flaw allows a malicious actor to potentially gain access to confidential data . The vulnerability has been addressed in Firefox 147 and Thun...

CVE-2026-92040

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird . This flaw was addressed in versions 156 of both products. While the vulnerability is confirmed, specific details regarding the root cause, technical impact, or exploit availability ...

CVE-2025-13014

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Firefox ESR browsers, as well as the Thunderbird mail client. The flaw allows an attacker to access memory after it has been freed, potentially leading to service interruptions or, according to some repo...

CVE-2026-100782

The Firefox browser is affected by a privilege escalation vulnerability (CVE-2026-100782 ) caused by incorrect boundary conditions in the Graphics component . This flaw allows for unauthorized privilege escalation and has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 ,...

CVE-2026-100818

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free in the Widget: Gtk component. This vulnerability was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitation information are provide...

CVE-2026-4690

A sandbox escape vulnerability exists in the XPCOM component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is attributed to incorrect boundary conditions and an integer overflow . This flaw allows an attacker to bypass the sandbox, potentially compromisin...

CVE-2026-92016

A use-after-free vulnerability exists in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability is cha...

CVE-2026-92025

A use-after-free vulnerability exists in the DOM: Navigation component of the Mozilla Firefox and Thunderbird browsers. This security flaw impacts several versions of the software. Remediation is available in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird ...

CVE-2026-92068

A site isolation issue exists in the Reader Mode component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in Firefox versions 156 and ESR 153.3, and Thunderbird versions 156 and 153.3. No specific exploit details or in-the-wild exploitation information are provi...

CVE-2026-100810

An issue exists within the DevTools component in Mozilla Firefox and Thunderbird . This vulnerability affects versions prior to 157 . The impact of this vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8 , potentially leading to high confidentiality, integrity, and availability impac...

CVE-2026-92031

CVE-2026-92031 is an information disclosure vulnerability affecting the Graphics: ImageLib component in the Mozilla Firefox and Mozilla Thunderbird applications. The flaw allows for the unauthorized disclosure of information. Remediation is available in Firefox 156 , Firefox ESR 140.16 , Firefox ...

CVE-2026-92063

A Denial-of-service vulnerability exists in the Audio/Video component of Firefox and Thunderbird . This issue has been addressed in Firefox 156 and Thunderbird 156 . While specific technical root causes are not detailed in the provided documents, the vulnerability is confirmed to impact these spe...

CVE-2025-14326

CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird

CVE-2026-100785

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in various releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the memory sa...

CVE-2026-100816

A site isolation issue exists in the DOM: Networking component of Mozilla products. This vulnerability affects Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . The issue has been addressed in these specific versions. No specific exploit details or in-the-wild exploitati...

CVE-2026-100820

A privilege escalation vulnerability exists in the Address Bar component of the Firefox web browser. This flaw allows for elevated privileges during use. The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitat...

CVE-2026-106016

A security bypass vulnerability exists in the File Handling component of Mozilla Firefox (earlier than version 157.0.1 ). This flaw allows malicious users to bypass security restrictions, potentially enabling actions restricted by current security settings. The vulnerability is addressed in Firef...

CVE-2026-92014

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics component . This issue is addressed in Firefox ESR 115.41 , Firefox ESR 140.16 , and Thunderbird 140.16 . No specific exploit details or in-the-wild exp...

CVE-2026-100780

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific technical root cause is not detailed beyond the...

CVE-2026-100786

A sandbox escape vulnerability exists in the Graphics component of the Firefox browser due to a use-after-free condition. This flaw was addressed in multiple releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or external...

CVE-2026-100808

A mitigation bypass exists in the DOM: Service Workers component of the Mozilla Firefox web browser. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While specific technical root causes are not detailed in the provided documents...

CVE-2026-100813

The Firefox web browser is affected by an invalid pointer vulnerability within the JavaScript Engine: JIT component . This flaw was addressed in Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-100784

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Firefox browser. This flaw has a high impact and was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Specific details regarding the root ca...

CVE-2026-100814

The Firefox browser is affected by a vulnerability caused by incorrect boundary conditions within the JavaScript Engine: JIT component. This flaw allows for potential exploitation through the Just-In-Time compiler. Remediation is available in Firefox ESR 153.4 and Firefox 157 . No specific exploi...

CVE-2026-100832

Firefox is affected by a use-after-free vulnerability in the Graphics: Canvas2D component. This flaw was addressed in Firefox ESR 153.4 , Firefox ESR 115.42 , and Firefox ESR 140.17 . The vulnerability is associated with Bug 2072467 and is categorized as having high impact by the reporter. No spe...

CVE-2026-92070

CVE-2026-92070 involves an information disclosure vulnerability in the Networking component of Mozilla products. The issue is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the exact root cause is not specified in the provided documents, other repor...

CVE-2026-100815

A use-after-free vulnerability exists in the CSS Parsing and Computation component of the Firefox browser. This flaw was addressed and fixed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation records are provided in the documents.

CVE-2026-100770

A sandbox escape vulnerability exists in the DOM: Content Processes component of Firefox due to a use-after-free condition. This flaw has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the vulnerability's root ca...

CVE-2026-100768

A use-after-free vulnerability exists in the Graphics: WebGPU component of the Firefox browser. This issue was addressed and fixed in Firefox 157 . The vulnerability was reported by Yaqoub Aldurayhim and is associated with Bugzilla report Bug 2064832 . No specific exploitation details or direct l...

CVE-2026-100783

A high-impact uninitialized memory vulnerability exists in the Audio/Video component of Firefox . This flaw was addressed in several versions, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the uninitiali...

CVE-2026-100778

The Firefox browser is vulnerable to a sandbox escape caused by a use-after-free flaw in the DOM: Core & HTML component. This vulnerability was addressed in the following versions: Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While technical details regarding th...

CVE-2026-100779

Firefox is impacted by a use-after-free vulnerability in the XSLT component . This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or direct links to exploitation are provided in the docu...

CVE-2026-100809

A Same-origin policy bypass exists in the DevTools component of the Mozilla Firefox web browser and Mozilla Thunderbird mail client. This vulnerability is fixed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the documents. P...

CVE-2026-100774

A use-after-free vulnerability exists in the DOM: Core & HTML component of Firefox . This flaw was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the vulnerability is categorized as high impact with a CVSS score of 8....

CVE-2026-100812

A Denial-of-Service vulnerability exists in the Graphics component of Firefox . This flaw allows for an attack that impacts the availability of the application. The issue has been addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation information ...

CVE-2026-100769

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of the Firefox browser. This flaw was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . The vulnerability is reported to have a high impact. No specific exploit details or public proof-of-concepts...

CVE-2026-100775

This vulnerability involves a sandbox escape within the Graphics component of the Mozilla software suite. The issue affects multiple products, including Firefox , Firefox ESR , and Thunderbird . Practical consequences include bypassing security restrictions and potential arbitrary code execution ...