CVE-2026-74976

The JavaScript Engine: JIT component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a JIT miscompilation flaw (CVE-2026-74976). This issue is addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While sever...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2024-0752

CVE-2024-0752 refers to a use-after-free crash in Mozilla Firefox that could occur on macOS when applying a Firefox update on a very busy system, leading to an exploitable crash. Affected products: Firefox versions earlier than 122. Root cause: use-after-free in the update path on high system loa...

CVE-2025-6432

Mozilla Firefox and Thunderbird are affected by a security bypass vulnerability in the Multi-Account Containers function. When this feature is enabled, DNS requests can bypass a configured SOCKS proxy if the domain name is invalid or the proxy is non-responsive. This flaw allows a malicious actor...

CVE-2025-8038

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a data forgery issue where Thunderbird ignores paths during frame navigation validity checks. Specifically, the CSP frame-src was not correctly enforced for paths. This vulnerability stems from insufficient verific...

CVE-2026-16408

A vulnerability exists in the Audio/Video: Playback component due to an integer overflow . This issue affects Mozilla Firefox and Mozilla Thunderbird . The vulnerability has been addressed in versions Firefox 153 and Thunderbird 153 . Specific details regarding exploitation or impact are not prov...

CVE-2026-74981

A site isolation issue exists in the Audio/Video: Web Codecs component of certain Mozilla products. This vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the provided documents confirm the existence of the vulnerability and the ...

CVE-2026-84126

The Firefox and Thunderbird browsers are affected by a vulnerability involving incorrect boundary conditions in the Layout: Grid component . The issue has been remediated in Firefox 155 and Thunderbird 155 . While the vulnerability was identified as having a Medium base severity (CVSS 4.3) and a ...

CVE-2026-92051

The Mozilla Firefox and Thunderbird applications are affected by a spoofing issue within the Graphics component caused by an invalid pointer . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided in the documents, the vulnerability ...

CVE-2020-12413

The CVE-2020-12413 case covers a timing attack on DHE ciphersuites in TLS (the Raccoon attack). Affected component is the DHE-based TLS handshake; underlying impact is a potential loss of confidentiality if DHE ciphersuites are used. Mitigation observed in sources: Firefox disabled support for DH...

CVE-2024-31393

Mozilla Firefox for iOS versions

CVE-2026-12325

A Denial-of-service vulnerability exists in the Graphics: ImageLib component of Mozilla products, including Firefox and Thunderbird . Attackers can exploit this flaw to cause a denial-of-service attack. This issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thund...

CVE-2026-12327

Memory safety bugs exist in Firefox ESR 140.11 , Thunderbird ESR 140.11 , Firefox 151 , and Thunderbird 151 . These vulnerabilities involved memory corruption , which could potentially be exploited with sufficient effort to execute arbitrary code . The issues have been addressed in the following ...

CVE-2026-16385

The Graphics: WebGPU component in Mozilla Firefox and Thunderbird is vulnerable to an information disclosure due to uninitialized memory . This vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or practical exploitation instructions are provided in the d...

CVE-2026-6764

Mozilla Firefox and the Thunderbird email client are vulnerable to incorrect boundary conditions within the DOM: Device Interfaces component. This flaw can allow a remote attacker to compromise the integrity and accessibility of protected information. The issue has been addressed in Firefox 150 ,...

CVE-2026-74972

A vulnerability in the DOM: Push Subscriptions component of the Mozilla Firefox browser and Mozilla Thunderbird mail client leads to information disclosure . This issue was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 1...

CVE-2026-74982

CVE-2026-74982 describes a Denial-of-Service (DoS) vulnerability within the Widget component of the Mozilla software suite. This issue was addressed in several versions, including Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . The vulnerability is associated with CWE-...

CVE-2026-8706

Firefox for iOS is affected by a vulnerability in its hosted Reader mode when running on an unauthenticated local web server. This flaw allows another application on the same device to request arbitrary URLs and receive responses rendered with the signed-in user's cookies , potentially leading to...

CVE-2026-92059

The DOM: Editor component in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to incorrect boundary conditions . This security issue has been addressed in versions Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the vulnerability is listed ...

CVE-2025-6433

Mozilla Firefox and Thunderbird versions prior to 140 are vulnerable to a security flaw where a webpage can present a WebAuthn challenge even when the site uses an invalid TLS certificate that the user has manually excepted. This behavior violates the WebAuthn specification, which mandates a secu...

CVE-2026-16403

A spoofing issue exists in the Address Bar component of the Firefox and Thunderbird web browsers. This vulnerability has been addressed and fixed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the documentation.

CVE-2026-6748

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a flaw in the Audio/Video: Web Codecs component due to uninitialized memory . In certain instances, this vulnerability can be exploited by a remote attacker to execute arbitrary code . The issue has been addressed ...

CVE-2026-74973

A race condition and use-after-free vulnerability exists in the Graphics component of Firefox and Thunderbird . This flaw affects several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , and the corresponding versions of Thunderbird . Remediation is ...

CVE-2026-8091

The Audio/Video: Playback component in Firefox , Firefox ESR , and Thunderbird is vulnerable to incorrect boundary conditions due to insufficient checking of unusual or exceptional states. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibi...

CVE-2026-84130

A vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure . This issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Exploitation details are not provided in the documents.

CVE-2026-92041

A mitigation bypass vulnerability exists in the DOM: Networking component of the Firefox browser. This issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While specific technical root causes or exploit details are not provided, the vulnerability is ...

CVE-2009-2466

The CVE-2009-2466 issue affects Mozilla Firefox (and Thunderbird) up to version prior to 3.0.12, where the JavaScript engine can be abused to cause memory corruption, a crash, or potentially arbitrary code execution. The described vectors involve the engine internals in nsDOMClassInfo.cpp, JS_Has...

CVE-2026-12297

Mozilla products Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by incorrect boundary conditions in the Networking component . This security flaw was addressed in the release of Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbir...

CVE-2026-16362

A use-after-free vulnerability exists in the WebRTC: Audio/Video component of the Mozilla Firefox and Thunderbird browsers. This security flaw could potentially allow for the execution of arbitrary code. The issue has been resolved in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 ...

CVE-2026-16395

A critical integer overflow vulnerability exists in the Audio/Video component of Mozilla Firefox and Mozilla Thunderbird . The issue was addressed in Firefox 153 and Thunderbird 153 . Specific vulnerability details, such as the root cause or precise technical impact, are not provided in the avail...

CVE-2026-2634

The vulnerability CVE-2026-2634 affects Firefox for iOS . Malicious scripts could cause desynchronization between the address bar and web content before a response is received, allowing attacker‑controlled pages to be displayed under spoofed domains. The vulnerability is stated to be fixed in Fir...

CVE-2026-6762

A spoofing issue exists in the DOM: Core & HTML component of Mozilla Firefox and the Thunderbird email client. This vulnerability allows for remote spoofing attacks, potentially enabling attackers to bypass authentication procedures. The issue has been addressed in Firefox 150 , Firefox ESR 115.3...

CVE-2026-84122

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The issue is resolved in Firefox 155 , Firefox ESR 140.1...

CVE-2026-8954

The Audio/Video component in Firefox and Thunderbird is vulnerable to an integer overflow caused by incorrect boundary conditions . This flaw allows attackers to perform operations beyond the buffer limits in memory, which can lead to the access of confidential data . Affected versions include Fi...

CVE-2026-92019

A mitigation bypass vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Mozilla Thunderbird . This issue is present in various versions, including Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3, and Thunderbird 156, 140.16, and 153.3. The vulnerability was addresse...

CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2016-5298

CVE-2016-5298 affects Firefox for Android (Firefox

CVE-2017-7790

CVE-2017-7790 affects the Windows build of Mozilla Firefox prior to 55. The issue arises when non-null-terminated strings are copied into the crash reporter for certain registry keys, causing stack memory to be copied up to a null terminator. This could potentially expose private data from the lo...

CVE-2017-7845

CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox

CVE-2018-5124

CVE-2018-5124 affects Mozilla Firefox prior to 58.0.1. The issue arises from unsanitized output in the browser UI, where HTML fragments are left intact, enabling arbitrary code execution as described by the MFSA advisory and related references. The vulnerability is tied to sanitization of HTML fr...

CVE-2024-10941

CVE-2024-10941 affects Firefox versions prior to 126. The issue is triggered by a malicious website embedding an iframe with a malformed URI, resulting in a browser crash that is described as non-exploitable. Public details consistently reference Firefox

CVE-2026-12310

A memory safety bug exists in Firefox and Thunderbird , specifically affecting Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The vulnerability has been addressed in the specified versions. While the specific root cause component is not detailed in the primary descr...

CVE-2026-16386

CVE-2026-16386 is an information disclosure vulnerability caused by uninitialized memory within the Graphics: WebGPU component. This issue was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or technical root causes beyond the memory initialization error are provided in...

CVE-2026-74968

A site isolation issue exists in the Graphics: WebRender component of certain Mozilla products. This vulnerability is addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Information regarding specific exploit vectors or in-the-wild exploitation is not provided...

CVE-2026-92047

A privilege escalation vulnerability exists in the Crash Reporting component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The vulnerability was addressed in the aforementioned release...

CVE-2012-5840

CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...

CVE-2026-16359

The Audio/Video: GMP component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw can lead to security risks, including potential arbitrary code execution, as indicated by related security advisories. The vulnerability has been addressed in Firefox 153 , Firefox...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-6750

A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla Firefox and the Thunderbird email client. The root cause is attributed to deficiencies in access control , which could allow an attacker to enhance their privileges remotely. This vulnerability has been ad...

CVE-2026-6758

The Firefox web browser and Thunderbird email client are affected by a use-after-free vulnerability in the JavaScript: WebAssembly component . This flaw occurs when the software attempts to use memory after it has been freed, which could allow a remote attacker to trigger a service failure . The ...