CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-6778

CVE-2026-6778 describes an invalid pointer in the Audio/Video: Playback component of Mozilla Firefox (and Thunderbird) that was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 5.3 (Medium) with availability impact Low; no exploit specifics are provided in the sources. OpenSUS...

CVE-2025-11712

The CVE-2025-11712 entry is supported by connected documents describing the same issue across Mozilla products. Affected software for this CVE includes Firefox and Thunderbird prior to version 144 (Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, Thunderbird

CVE-2025-14327

CVE-2025-14327 is a spoofing vulnerability in the Downloads Panel component affecting Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird

CVE-2026-12296

CVE-2026-12296 describes a sandbox escape in the Security: Process Sandboxing component. Affected products include Mozilla Firefox and Firefox ESR, and Mozilla Thunderbird with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The description does not ...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...

CVE-2026-2788

CVE-2026-2788 concerns incorrect boundary conditions in the Audio/Video: GMP component of Mozilla Firefox. Public advisories (e.g., Firefox/Firefox ESR updates in Firefox 148, ESR 115.33, ESR 140.8) and downstream Debian/AlmaLinux advisories confirm the fix was applied in those versions. Connecte...

CVE-2026-8974

CVE-2026-8974 concerns memory-safety bugs in Thunderbird 140.10 and Thunderbird 150 that could enable arbitrary code execution; fixes are available in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Multiple vendor advisories (e.g., openSUSE SUSE 10813-1, Slackware advis...

CVE-2025-14324

CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird

CVE-2026-8706

Summary: CVE-2026-8706 affects Firefox for iOS Reader mode when it runs its own unauthenticated local web server. The issue allows another app on the same device to request arbitrary URLs and receive the response rendered using the signed-in user’s cookies. Affected component: Firefox for iOS Rea...

CVE-2026-12298

CVE-2026-12298 is a memory-safety bug affecting Firefox and Thunderbird components, with fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Connected advisories (ALSA/RLSA/SUSE/Fedora/Red Hat) enumerate the same CVE among a broader set of related issues and indicat...

CVE-2026-2774

CVE-2026-2774 is an integer overflow in the Firefox Audio/Video component. Public sources indicate Firefox/ESR updates (Firefox 148, ESR 115.33, ESR 140.8) fix the flaw; affected products include Firefox and Thunderbird per accompanying advisories. The issue is rated high/critical by CVSS sources...

CVE-2026-2787

CVE-2026-2787 is a use-after-free in the DOM: Window and Location component, with fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources corroborate the issue in Firefox-related components and list the affected products as Firefox/Th...

CVE-2026-8950

CVE-2026-8950 is a reported same-origin policy bypass in the Networking: HTTP component, with root cause not explicitly detailed in the provided documents. Affected software includes Firefox (fixed in version 151) and Firefox ESR (140.11), as well as Thunderbird (fixed in 151 and 140.11). The CVS...

CVE-2026-8953

CVE-2026-8953 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. Affected products include Firefox (fixed in Firefox 151) and Firefox ESR (115.36, 140.11), as well as Thunderbird (151, 140.11). The public records indicate a memory-unsafe defect in the D...

CVE-2025-11152

CVE-2025-11152: Firefox's Graphics: Canvas2D contains an integer overflow that enables sandbox escape in versions prior to 143.0.3. The affected component and root cause are described across multiple sources; exploitation status is not detailed in the provided documents; no explicit remediation i...

CVE-2026-12299

CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...

CVE-2026-2032

CVE-2026-2032 concerns Mozilla Firefox for iOS. The issue involves malicious scripts that interrupt new tab page loading, causing desynchronization between the address bar and page content. This can allow an attacker to forge arbitrary HTML under a trusted domain. The vulnerability affects Firefo...

CVE-2026-2767

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox/Thunderbird. Affected products include Firefox (Desktop) and Thunderbird with the WebAssembly implementation; the issue is addressed by fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-2780

CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...

CVE-2026-2799

CVE-2026-2799 is a use-after-free vulnerability in the DOM: Core & HTML components of Mozilla Firefox and Thunderbird. The issue, identified across multiple advisories, is resolved in Firefox 148 and Thunderbird 148. Public exploit activity is noted in connected sources. Affected products include...

CVE-2026-4688

CVE-2026-4688 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9. The available documents do not provide exploit details or specific remediation steps beyond...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-4702

CVE-2026-4702 is a JIT miscompilation in the JavaScript Engine component. The primary entry states it is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Connected advisories consistently reference the same JIT/memory-safety context across Firefox/Thunderbird relea...

CVE-2026-6759

CVE-2026-6759 is a use-after-free in the Mozilla Widget: Cocoa component. Affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This is confirmed across multiple connected advisories and CVE l...

CVE-2026-8401

CVE-2026-8401 is a Firefox vulnerability describing a sandbox escape in the Profile Backup component. The issue is fixed in Firefox 150.0.3 per MFSA2026-45 and EU/OSV/NVD entries. Affected product: Mozilla Firefox (Profile Backup sandbox escape). Root cause details are not elaborated beyond the c...

CVE-2026-8946

The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...

CVE-2026-8972

The CVE-2026-8972 issue affects the WebRTC: Audio/Video component in Mozilla Thunderbird (and Firefox) and is described as a privilege-escalation vulnerability. Technical sources consistently state it was fixed in Firefox 151 and Thunderbird 151. The available documents do not provide deeper root...

CVE-2026-12325

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...

CVE-2026-2762

CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...

CVE-2026-2779

CVE-2026-2779 covers incorrect boundary conditions in Networking: JAR within Firefox (and Firefox ESR). Public advisories indicate the issue affects Firefox before version 148 and Firefox ESR before 140.8, with Firefox 148/ESR 140.8 and Thunderbird updates mitigating it. The connected Amazon Linu...

CVE-2026-2795

CVE-2026-2795 is a use-after-free in the JavaScript: GC component affecting Mozilla Firefox and Mozilla Thunderbird. Technical details across connected sources consistently identify the flaw in the GC object handling, with exploitation risk implied by the high/critical CVSS data. The vulnerabilit...

CVE-2026-2798

CVE-2026-2798 is a use-after-free in the DOM: Core & HTML components affecting Firefox and Thunderbird. It was fixed in Firefox 148 and Thunderbird 148. Public exploits exist. Remediation: update to the latest Firefox/Thunderbird versions (148+).

CVE-2026-2802

The CVE-2026-2802 entry describes a race condition in the JavaScript: GC component. Connected sources confirm this affects Firefox and Thunderbird and state the vulnerability was fixed in Firefox 148 and Thunderbird 148. Practical impact is a concurrency issue in the GC path; no exploitation deta...

CVE-2026-8945

CVE-2026-8945 is described across multiple sources as a sandbox escape in Firefox and Firefox Focus for Android, with the vulnerability fixed in Firefox 151. The connected documents confirm the issue affected Firefox on Android devices and state the fix is part of Firefox 151 releases. The exact ...

CVE-2026-8954

CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...

CVE-2025-13021

CVE-2025-13021 is an active issue affecting Firefox and Thunderbird prior to version 145, caused by incorrect boundary conditions in the Graphics: WebGPU component. Public advisories (mfsa2025-90) reference memory-safety concerns in Firefox/Thunderbird around 144 as context, and Fedora/Mozilla ad...

CVE-2026-0878

CVE-2026-0878 describes a sandbox escape caused by incorrect boundary conditions in the Graphics: CanvasWebGL component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird

CVE-2026-12292

CVE-2026-12292 : Incorrect boundary conditions in the Web Audio component are fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Affected software is Mozilla Firefox/Thunderbird Web Audio implementation; mitigation is upgrade to the stated fixed versions. Other con...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-2775

CVE-2026-2775 is a mitigation bypass in the DOM: HTML Parser component. The initial description states a fix in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux bulletin and Amazon Linux advisories) reiterate the same mitig...

CVE-2026-2782

CVE-2026-2782 affects Firefox (Netmonitor component) and is fixed in Firefox 148 and Firefox ESR 140.8, also addressed in Thunderbird 148/140.8. The connected sources corroborate privilege-escalation via Netmonitor across Mozilla products and note remediation as upgrading to Firefox 148+/Thunderb...

CVE-2026-8390

Mozilla Firefox is affected by a use-after-free in the JavaScript: WebAssembly component (CVE-2026-8390). The issue resides in WebAssembly within Firefox’s JavaScript engine and was fixed in version 150.0.3. Affected products are Firefox releases prior to 150.0.3, across platforms referenced in t...

CVE-2025-10529

CVE-2025-10529 describes a Same-origin policy bypass in the Firefox/Thunderbird Layout component. The connected sources confirm the vulnerability affects Firefox versions below 143 and Firefox ESR below 140.3, and Thunderbird versions below 143 and below 140.3. The impact is implied by the descri...

CVE-2025-10534

CVE-2025-10534 is a spoofing vulnerability in the Site Permissions component affecting Mozilla Firefox and Mozilla Thunderbird. Affected versions are Firefox < 143 and Thunderbird

CVE-2025-10535

CVE-2025-10535 describes an information-disclosure and mitigation-bypass vulnerability in the Privacy component of Firefox for Android, affecting Firefox versions older than 143. The issue is cited across multiple security feeds and Nessus plugins as part of the Firefox

CVE-2025-11709

CVE-2025-11709 is documented across multiple sources (Mozilla advisories and Amazon/Linux bulletins) as a memory-safety/out-of-bounds issue triggered by manipulated WebGL textures in a compromised web process, affecting Firefox and Thunderbird before version 144 (and ESR branches like ESR 115.29/...

CVE-2025-13012

CVE-2025-13012 describes a race condition in Firefox/Graphics. Affected: Firefox <145, Firefox ESR <140.5, Firefox ESR

CVE-2025-13018

CVE-2025-13018 is a mitigation bypass in the DOM: Security component that affects Firefox <145, Firefox ESR <140.5, Thunderbird <145, and Thunderbird

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...