CVE-2026-84120

A use-after-free vulnerability exists in the Audio/Video component of Mozilla Firefox and Thunderbird . This flaw could potentially allow for the execution of arbitrary code , sandbox escape , or privilege escalation . The issues have been addressed in Firefox 155 , Firefox ESR 115.40 , Firefox E...

CVE-2026-92017

CVE-2026-92017 is a privilege escalation vulnerability affecting the DOM: Service Workers component in Mozilla Firefox and Thunderbird . The issue was addressed in Firefox versions 156 , ESR 115.41 , ESR 140.16 , and ESR 153.3 , along with corresponding Thunderbird versions. No specific root caus...

CVE-2026-92050

This vulnerability allows for a sandbox escape due to a race condition in the XPConnect component . The issue has been resolved in Firefox 156 and Thunderbird 156 . While a security sighting was reported on 2026-09-17, specific details regarding exploit vectors or in-the-wild exploitation methods...

CVE-2026-92057

This vulnerability involves a mitigation bypass within the Enterprise Policies component of the Firefox and Thunderbird browsers. The flaw is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the initial description identifies it as a mitigation bypass...

CVE-2026-100762

A use-after-free vulnerability in the DOM: Content Processes component of Firefox allows for a sandbox escape . This flaw has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Technical details regarding the specific root cau...

CVE-2026-16353

The Firefox browser and Thunderbird mail client are affected by a vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component. This flaw could lead to multiple security consequences, including the potential execution of arbitrary code , privilege escalation , information di...

CVE-2026-16380

A mitigation bypass exists in the Networking component of Firefox and Thunderbird . The vulnerability was addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the documents.

CVE-2026-6759

A use-after-free vulnerability exists in the Widget: Cocoa component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. An attacker could exploit this memory safety issue to compromise the accessibility of protected information . The vulnerability has been addressed in Firefox 1...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-92012

Mozilla Firefox and Thunderbird are affected by CVE-2026-92012, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. The vulnerability has been addressed in the following versions: Firefox 156, Firefox ESR 115.41, Firefox ESR 140...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2016-5299

CVE-2016-5299 affects Firefox for Android (Android), where a previously installed malicious app with signature-level permissions can intercept AuthTokens intended for Firefox. The issue is limited to Firefox for Android and does not affect other platforms; vulnerable version is Firefox prior to 5...

CVE-2025-1941

The Mozilla Firefox browser is affected by a vulnerability where a user opt-in setting intended to require authentication for Focus could be bypassed. This flaw is distinct from CVE-2025-0245. The issue was resolved in Firefox 136 . Users are advised to upgrade to the latest version in their rele...

CVE-2025-6435

Mozilla Firefox and Thunderbird versions prior to 140 are affected by a vulnerability where saving a response from the Network tab in Devtools via the Save As context menu may fail to append the .download file extension. This lack of extension sanitization could lead to a user inadvertently runni...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird

CVE-2026-100811

A use-after-free vulnerability in the DOM: Core & HTML component of the Firefox web browser allows for a sandbox escape . This flaw was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific details regarding in-the-wild exploitation or exploit code are provided in th...

CVE-2026-6755

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by a mitigation bypass in the DOM: postMessage component. This vulnerability allows a malicious actor to remotely trigger a service failure . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploita...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability affecting the Networking: HTTP component in Mozilla products. This flaw impacts Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . N...

CVE-2026-92006

Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This security flaw impacts various versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thund...

CVE-2026-92043

The Audio/Video component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This issue impacts Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Remediation is available via patches in versions Firefox 156 , F...

CVE-2003-1492

CVE-2003-1492 affects Netscape Navigator 7.0.2 and Mozilla, where an HTTP request to a domain with a trailing dot can cause cross-domain cookie access. The connected ROSA advisory lists this CVE as Fixed and notes remediation as updating Firefox (DNF command reference: sudo dnf update firefox). T...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...

CVE-2016-9061

CVE-2016-9061 affects Firefox for Android, where a previously installed malicious Android app can exploit a signature-level permission to access API keys meant for Firefox. The issue is limited to Firefox for Android; other platforms are unaffected and Firefox versions prior to 50 are affected. T...

CVE-2026-6763

A mitigation bypass exists in the File Handling component of Mozilla Firefox and the Thunderbird email client. This vulnerability allows an attacker to circumvent existing security restrictions remotely due to a violation of data protection mechanisms. The issue is fixed in Firefox 150 , Firefox ...

CVE-2026-84125

A use-after-free vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Mozilla Thunderbird . This flaw affects the core browser engine and was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wil...

CVE-2026-8953

A sandbox escape vulnerability exists in the Disability Access APIs component due to a use-after-free condition. This flaw affects the Firefox web browser (including Firefox ESR ) and the Thunderbird email client. Exploitation of this vulnerability could allow an attacker to escape the sandbox en...

CVE-2026-92064

The Widget: Win32 component in Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to a sandbox escape caused by incorrect boundary conditions. This vulnerability affects various versions, with fixes available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and ...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2014-1520

CVE-2014-1520 affects Mozilla Firefox on Windows prior to version 29.0 and Firefox ESR prior to 24.5. The issue is a local privilege escalation by placing a Trojan horse DLL into a temporary directory during the update process of the Mozilla installer, enabling the attacker to gain elevated privi...

CVE-2017-7762

Summary: CVE-2017-7762 is a vulnerability in Firefox where, when entering a URL directly, Reader Mode did not strip the username and password portion of the address bar, enabling domain spoofing. The issue affects Firefox versions earlier than 54. The available connected documents confirm the roo...

CVE-2026-12308

A memory safety bug has been identified and fixed in Mozilla Thunderbird 152 and Firefox 152 , along with several Extended Support Release (ESR) versions including Firefox ESR 140.12 and Thunderbird 140.12 . The vulnerability is associated with the Thunderbird client and the Firefox web browser. ...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

CVE-2026-16406

CVE-2026-16406 describes a mitigation bypass within the Networking component of the Mozilla Firefox and Mozilla Thunderbird browsers. The vulnerability is fixed in Firefox 153 and Thunderbird 153 . While the specific root cause is not detailed in the provided documents, the impact is associated w...

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-4684

A race condition and use-after-free vulnerability exists in the Graphics: WebRender component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . This memory safety issue could allow an attacker to trigger a service failure . The vulnerability affects Firefox versions prior t...

CVE-2026-92037

The Mozilla Firefox and Thunderbird applications are affected by CVE-2026-92037 , which is caused by incorrect boundary conditions in the DOM: Animation component . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided, the issue has...

CVE-2026-92046

A Use-after-free vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird . The issue affects these applications across various distributions, including openSUSE and SUSE Linux. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbir...

CVE-2026-92054

The Memory component in Mozilla Firefox is vulnerable to privilege escalation (CVE-2026-92054). This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit details are provided in the documentation.

CVE-2026-9308

Firefox for iOS is vulnerable to arbitrary JavaScript execution within the Reader View due to an incorrect HTML replacement order. The application incorrectly replaces page content in its HTML template before processing other internal placeholders. This flaw allows a malicious page to include a p...

CVE-2008-4061

CVE-2008-4061: An integer overflow in the MathML component of Mozilla Firefox can be triggered by an mtd element with a large rowspan value. Affects Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12. Impact: remote memory corruption, denial of ...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2016-9062

CVE-2016-9062 affects Firefox for Android. Private browsing mode leaves metadata (URLs) in browser.db and browser.db-wal within the Firefox profile after exit. Impact is limited to Firefox versions earlier than 50 on Android; other platforms are unaffected. The remediation is to update to Firefox...

CVE-2025-4089

Mozilla Firefox and Thunderbird are vulnerable to local code execution due to insufficient escaping of special characters in the "copy as cURL" feature. An attacker could trick a user into executing a manipulated command, potentially leading to the execution of arbitrary code on the user's system...

CVE-2026-12317

A memory safety bug exists in the Mozilla Firefox and Thunderbird web browser and email client. The vulnerability is caused by operations performing beyond the buffer boundaries in memory. Successful exploitation by a remote attacker can lead to service interruptions (Denial of Service). This iss...

CVE-2026-12326

The Firefox web browser and Thunderbird email client (versions 151) are affected by memory safety bugs involving operations that go beyond buffer boundaries in memory. These vulnerabilities can result in memory corruption , which could potentially be exploited by a remote attacker to achieve arbi...

CVE-2026-16393

CVE-2026-16393 involves incorrect boundary conditions within the Graphics: WebGPU component. This vulnerability affects Mozilla Firefox and Mozilla Thunderbird , specifically impacting the WebGPU graphics functionality. The issue has been remediated in Firefox 153 and Thunderbird 153 . Practical ...