CVE-2025-11709

CVE-2025-11709 is documented across multiple sources (Mozilla advisories and Amazon/Linux bulletins) as a memory-safety/out-of-bounds issue triggered by manipulated WebGL textures in a compromised web process, affecting Firefox and Thunderbird before version 144 (and ESR branches like ESR 115.29/...

CVE-2025-13018

CVE-2025-13018 is a mitigation bypass in the DOM: Security component that affects Firefox <145, Firefox ESR <140.5, Thunderbird <145, and Thunderbird

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-4688

CVE-2026-4688 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9. The available documents do not provide exploit details or specific remediation steps beyond...

CVE-2026-4710

CVE-2026-4710 is an Audio/Video boundary-conditions flaw that affects Firefox (including ESR) and Thunderbird. The issue’s root cause is incorrect boundary handling in the Audio/Video component. Public advisories list the impact as high/critical, with CVSS 3.1 base score 9.8 (Impact: Confidential...

CVE-2026-6778

CVE-2026-6778 describes an invalid pointer in the Audio/Video: Playback component of Mozilla Firefox (and Thunderbird) that was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 5.3 (Medium) with availability impact Low; no exploit specifics are provided in the sources. OpenSUS...

CVE-2026-8390

Mozilla Firefox is affected by a use-after-free in the JavaScript: WebAssembly component (CVE-2026-8390). The issue resides in WebAssembly within Firefox’s JavaScript engine and was fixed in version 150.0.3. Affected products are Firefox releases prior to 150.0.3, across platforms referenced in t...

CVE-2026-12314

CVE-2026-12314 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird addressed by updates to Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s advisory confirms Firefox ESR 140.12.0esr-1~deb13u1 fixes the issue for firefox-esr in the stable trixie packag...

CVE-2026-12326

CVE-2026-12326 is a Firefox/Thunderbird memory-safety issue affecting Firefox 151 and Thunderbird 151. The available sources indicate memory corruption that could be exploited to run arbitrary code, with a fix delivered in Firefox 152 and Thunderbird 152. The vulnerability details include affecte...

CVE-2026-16354

CVE-2026-16354 affects Mozilla Firefox when using the Graphics: ImageLib component, causing information disclosure. The vulnerability is addressed in Firefox 153 and Firefox ESR 115.38 and 140.13. Connected sources corroborate that this issue is resolved by these version fixes; no exploitation st...

CVE-2026-16369

CVE-2026-16369 : Integer overflow in the JavaScript: WebAssembly component of Mozilla Firefox. Affected: Firefox browser (WebAssembly/JavaScript engine). Root cause: integer overflow. Impact: fixed in Firefox 153 and Firefox ESR 140.13. Mitigation: upgrade Firefox to 153 (or ESR 140.13) to apply ...

CVE-2026-2766

CVE-2026-2766 is a use-after-free in the JavaScript Engine: JIT component of Firefox/Firefox ESR that was fixed in Firefox 148, ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products in the provided documents include Firefox-based browsers and Thunderbird; multiple advisories (Astra...

CVE-2026-2767

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox/Thunderbird. Affected products include Firefox (Desktop) and Thunderbird with the WebAssembly implementation; the issue is addressed by fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-2771

CVE-2026-2771 is an undefined-behavior vulnerability in the DOM: Core & HTML component of Mozilla Firefox/Thunderbird family that was fixed in Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148 and 140.8. The issue is reported across multiple advisories (Astra Linux bulletin and Amazon Li...

CVE-2026-2787

CVE-2026-2787 is a use-after-free in the DOM: Window and Location component, with fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources corroborate the issue in Firefox-related components and list the affected products as Firefox/Th...

CVE-2026-4701

CVE-2026-4701 is a use-after-free vulnerability in the JavaScript Engine. It affects Firefox and Thunderbird products and is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Exploitation status is not provided in the connected documents.

CVE-2026-8975

CVE-2026-8975 covers memory-safety bugs in Thunderbird 140.10 and Thunderbird 150, with evidence that some flaws could be exploited to run arbitrary code. The fixed versions are Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Affected products documen...

CVE-2025-13019

CVE-2025-13019 is a same-origin policy bypass in the DOM: Workers component. Connected advisories confirm affected products as Mozilla Firefox and Firefox ESR, with impact on versions below Firefox 145 and Firefox ESR below 140.5. The Amazon Linux advisories (ALAS2-2025-3108, ALAS2FIREFOX-2025-04...

CVE-2025-13024

CVE-2025-13024 is caused by a JIT miscompilation in the JavaScript Engine: JIT component. It affects Mozilla Firefox and Mozilla Thunderbird prior to version 145. The reported impact is arbitrary code execution via the JIT issue, with memory-related concerns noted in related advisories. Remediati...

CVE-2025-8364

Summary: CVE-2025-8364 affects Mozilla Firefox for Android (pre-141) due to a crafted blob: URI that can hide the page’s true origin, enabling potential spoofing. The issue is Android-only; other OSes are unaffected. Affected component is the browser’s handling of blob: URLs, with the root cause ...

CVE-2026-0880

CVE-2026-0880 is a sandbox-escape vulnerability: sandbox escape due to an integer overflow in the Graphics component. Affected products include Firefox (<147), Firefox ESR (<115.32 and <140.7), Thunderbird (<147 and

CVE-2026-0885

CVE-2026-0885 is a use-after-free in Firefox/Thunderbird’s JavaScript: GC component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird

CVE-2026-2795

CVE-2026-2795 is a use-after-free in the JavaScript: GC component affecting Mozilla Firefox and Mozilla Thunderbird. Technical details across connected sources consistently identify the flaw in the GC object handling, with exploitation risk implied by the high/critical CVSS data. The vulnerabilit...

CVE-2026-2798

CVE-2026-2798 is a use-after-free in the DOM: Core & HTML components affecting Firefox and Thunderbird. It was fixed in Firefox 148 and Thunderbird 148. Public exploits exist. Remediation: update to the latest Firefox/Thunderbird versions (148+).

CVE-2026-2802

The CVE-2026-2802 entry describes a race condition in the JavaScript: GC component. Connected sources confirm this affects Firefox and Thunderbird and state the vulnerability was fixed in Firefox 148 and Thunderbird 148. Practical impact is a concurrency issue in the GC path; no exploitation deta...

CVE-2026-2804

CVE-2026-2804 describes a use-after-free vulnerability in the JavaScript: WebAssembly component that affects Mozilla Firefox and Mozilla Thunderbird. The issue is fixed in Firefox 148 and Thunderbird 148. Connected advisories reaffirm the same root cause (memory management issue in the WebAssembl...

CVE-2026-4691

The CVE-2026-4691 entry describes a use-after-free in Firefox’s CSS Parsing and Computation component. Affected products/versions, as documented across connected sources, include Firefox versions prior to 149 and Firefox ESR prior to 115.34 and 140.9. The root cause is a use-after-free in the CSS...

CVE-2026-8401

CVE-2026-8401 is a Firefox vulnerability describing a sandbox escape in the Profile Backup component. The issue is fixed in Firefox 150.0.3 per MFSA2026-45 and EU/OSV/NVD entries. Affected product: Mozilla Firefox (Profile Backup sandbox escape). Root cause details are not elaborated beyond the c...

CVE-2026-8957

CVE-2026-8957 involves a privilege-escalation issue in Mozilla Firefox/Thunderbird’s Enterprise Policies component. Affected products include Firefox and Thunderbird, with fixes in Firefox 151 and Firefox ESR 140.11 (and corresponding Thunderbird updates 151/140.11). The vulnerability details in ...

CVE-2026-8970

The CVE describes a privilege-escalation in the Firefox Security component. Concrete detail from sources: the flaw is fixed in Firefox 151 and Firefox ESR 140.11. Affected scope is stated only as the Security component; no deeper root cause, affected subcomponents, or explicit exploit paths are p...

CVE-2026-8972

The CVE-2026-8972 issue affects the WebRTC: Audio/Video component in Mozilla Thunderbird (and Firefox) and is described as a privilege-escalation vulnerability. Technical sources consistently state it was fixed in Firefox 151 and Thunderbird 151. The available documents do not provide deeper root...

CVE-2025-8042

CVE-2025-8042 affects Mozilla Firefox for Android up to version 141. A sandboxed iframe without the allow-downloads attribute could initiate downloads, enabling information disclosure and potentially arbitrary code execution. CVSSv3.1 is high/critical with network vector, no user interaction. Rem...

CVE-2026-12320

CVE-2026-12320 affects the Password Manager component in Firefox and Thunderbird. The vulnerability enables information disclosure and is documented with a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, low attack complexity, no privileges required, but user interaction is requi...

CVE-2026-16352

CVE-2026-16352 is a sandbox-escape vulnerability due to a use-after-free in the Disability Access APIs component of Mozilla Firefox. The issue is fixed in Firefox 153 , and in Firefox ESR 115.38 and 140.13 . Affected product is Mozilla Firefox ESR (earlier than 115.38 per related advisory). The p...

CVE-2026-2777

CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2025-13015

CVE-2025-13015 is a spoofing vulnerability in Firefox affecting Firefox < 145, Firefox ESR < 140.5, and Firefox ESR

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-0887

CVE-2026-0887: Clickjacking information disclosure in the PDF Viewer component. Affected products per the CVE entry include Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird

CVE-2026-12305

Memory-safety vulnerability CVE-2026-12305 affecting Mozilla Firefox and Thunderbird, fixed in Firefox 152 (including ESR 140.12) and Thunderbird 152/140.12. Root cause stated as memory safety bug; no exploitation details provided. Remediation: upgrade to Firefox 152 / ESR 140.12 and Thunderbird ...

CVE-2026-12306

CVE-2026-12306 is a memory-safety vulnerability fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The connected sources confirm the affected products and versions, with the Debian Fedora OSV entries echoing the same remediation. Practical impact is a potential sec...

CVE-2026-16370

CVE-2026-16370 is a mitigation bypass vulnerability in the DOM Networking component of Mozilla Firefox. Affected product: Mozilla Firefox earlier than 153.0. Root cause: mitigation bypass in the DOM: Networking component, resolved by the Firefox 153 release. Impact as described in sources: high c...

CVE-2026-16386

CVE-2026-16386 : Information disclosure caused by uninitialized memory in the Graphics: WebGPU component of Firefox. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to leakage of information. Impact as per source: Confidentiality impact HIGH; overall CVSSv3....

CVE-2026-16400

Technical details (affected products, components, versions, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-2032

CVE-2026-2032 concerns Mozilla Firefox for iOS. The issue involves malicious scripts that interrupt new tab page loading, causing desynchronization between the address bar and page content. This can allow an attacker to forge arbitrary HTML under a trusted domain. The vulnerability affects Firefo...

CVE-2026-2759

The CVE-2026-2759 issue is concrete: it concerns incorrect boundary conditions in the Graphics: ImageLib component affecting Firefox/Thunderbird products. The description explicitly states the vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thun...

CVE-2026-2769

CVE-2026-2769 is a use-after-free vulnerability in Firefox’s Storage: IndexedDB component. Affected products are Firefox versions earlier than 148, Firefox ESR earlier than 115.33, and Firefox ESR earlier than 140.8. The issue arises from a memory safety flaw in IndexedDB storage handling, leadin...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-3846

CVE-2026-3846: A same-origin policy bypass in Firefox’s CSS Parsing and Computation component. Affected: Mozilla Firefox before 148.0.2. Root cause: bypass in CSS parsing/calculation logic. Impact: potential security restriction bypass (I: High per CVSS data). Status: fixed in Firefox 148.0.2; re...