CVE-2026-8947

CVE-2026-8947 describes a use-after-free in the DOM: Bindings (WebIDL) component of Firefox. The available sources confirm the issue and state it was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The documents do not provide exploit details, affected subcomponents beyond the W...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-3846

CVE-2026-3846: A same-origin policy bypass in Firefox’s CSS Parsing and Computation component. Affected: Mozilla Firefox before 148.0.2. Root cause: bypass in CSS parsing/calculation logic. Impact: potential security restriction bypass (I: High per CVSS data). Status: fixed in Firefox 148.0.2; re...

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2025-10535

CVE-2025-10535 describes an information-disclosure and mitigation-bypass vulnerability in the Privacy component of Firefox for Android, affecting Firefox versions older than 143. The issue is cited across multiple security feeds and Nessus plugins as part of the Firefox

CVE-2025-13021

CVE-2025-13021 is an active issue affecting Firefox and Thunderbird prior to version 145, caused by incorrect boundary conditions in the Graphics: WebGPU component. Public advisories (mfsa2025-90) reference memory-safety concerns in Firefox/Thunderbird around 144 as context, and Fedora/Mozilla ad...

CVE-2026-0886

CVE-2026-0886 : The vulnerability arises from incorrect boundary conditions in the Graphics component, affecting Firefox versions below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. The connected documents confirm the same issue is referenced across Mozilla advisor...

CVE-2026-12309

CVE-2026-12309 describes a memory-safety bug in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The Debian/Ubuntu/Nessus notes corroborate that Firefox ESR was updated to 140.12.x and Firefox to 152.x, indicating remediat...

CVE-2026-12317

CVE-2026-12317 is a memory-safety vulnerability fixed in Firefox 152 and Thunderbird 152. Affected products are Firefox/Thunderbird; root cause is a memory-safety bug.remediation is to upgrade to Firefox 152 / Thunderbird 152 as indicated by multiple advisories (e.g., Mozilla MFSA advisories and ...

CVE-2026-13356

The CVE-2026-13356 issue affects Firefox for iOS and centers on a malicious webpage that interrupts a pending navigation by enqueuing a synchronous JavaScript dialog. This side effect causes the browser UI to display the destination origin in the address bar while attacker-controlled content cont...

CVE-2026-16366

CVE-2026-16366 describes a privilege escalation in the DOM: Navigation component. Affected products are Firefox and Thunderbird before version 153; the issue is fixed in Firefox 153 and Thunderbird 153. The CVSS 3.1 base metrics indicate a High impact with network access as the attack vector, req...

CVE-2026-16385

CVE-2026-16385 is a information-disclosure vulnerability in Firefox related to the Graphics: WebGPU component caused by uninitialized memory. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVE description and cross-reference set describe the vulnerability as an i...

CVE-2026-16392

CVE-2026-16392 concerns a JIT miscompilation in the JavaScript Engine: JIT component. Multiple connected advisories indicate this issue affects Firefox/Thunderbird releases prior to version 153 and has been fixed in Firefox 153 and Thunderbird 153. Public details in the provided documents specify...

CVE-2026-2785

CVE-2026-2785 is an Invalid pointer vulnerability in the Firefox JavaScript Engine. Connected sources show it being addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Debian/ALMA and Amazon Linux advisories enumerate Firefox-related fixes including this CVE and l...

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-4696

The CVE-2026-4696 entry describes a Use-after-free in Firefox’s Layout: Text and Fonts component. Affected products are Firefox versions newer than? actually older than 149 for Firefox, and ESR variants: <115.34 and

CVE-2026-4719

CVE-2026-4719 is a vulnerability described as incorrect boundary conditions in the Graphics: Text component. The connected advisories show affected products as Firefox (and Firefox ESR) and Thunderbird, with fixes implemented in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140...

CVE-2026-6780

CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...

CVE-2025-11152

CVE-2025-11152: Firefox's Graphics: Canvas2D contains an integer overflow that enables sandbox escape in versions prior to 143.0.3. The affected component and root cause are described across multiple sources; exploitation status is not detailed in the provided documents; no explicit remediation i...

CVE-2025-11720

Summary of CVE-2025-11720 : The issue affects Mozilla Firefox (including Firefox for Android) where the Custom Tabs UI only shows the base site hostname, not the full hostname. This can enable user deception when content from a subdomain is hosted to resemble content from another subdomain of the...

CVE-2025-13012

CVE-2025-13012 describes a race condition in Firefox/Graphics. Affected: Firefox <145, Firefox ESR <140.5, Firefox ESR

CVE-2025-14328

CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2026-16359

CVE-2026-16359 concerns Mozilla Firefox’s Audio/Video: GMP component. The root cause is described as incorrect boundary conditions in this GMP-related path. The vulnerability is rated with CVSS 3.1 base score 9.1 (Network, Low Attack Complexity, No Privileges Required, User Interaction None, Conf...

CVE-2026-16403

CVE-2026-16403 affects Mozilla Firefox’s Address Bar spoofing functionality. The connected sources consistently identify a spoofing issue in the Address Bar component that was fixed in Firefox 153. Details across SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, and CVE listings corroborate the same root ca...

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-2789

CVE-2026-2789 — Use-after-free in Graphics: ImageLib Affected software: Mozilla Firefox (and Firefox ESR) and Thunderbird. The vulnerability arises from a use-after-free in the Graphics: ImageLib component. Affected versions are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunder...

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-3845

CVE-2026-3845 : A heap buffer overflow in the Firefox for Android Audio/Video: Playback component was fixed in Firefox 148.0.2. The advisory reports a high-severity issue (CVSS v3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) requiring user interaction. Affected product: Firefox for Android; vulne...

CVE-2026-4711

CVE-2026-4711 describes a use-after-free in the Cocoa-based Widget component affecting Mozilla Firefox before 149 and Firefox ESR before 140.9. The available sources consistently state the vulnerability type and affected versions but do not provide payload details, implicated files, root cause be...

CVE-2026-4713

CVE-2026-4713 is a Firefox graphics vulnerability: incorrect boundary conditions in the Graphics component. Affected: Firefox versions before 149 and ESR before 140.9. Mitigation: update to Firefox 149 or ESR 140.9 (patched). Details on exploitability or broader impact are not provided in the sup...

CVE-2026-8952

CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...

CVE-2026-8962

CVE-2026-8962 is a mitigation bypass in the DOM: Security component affecting Firefox/Thunderbird. It was fixed in Firefox 151 and Firefox ESR 140.11, and in Thunderbird 151 and Thunderbird 140.11. CVSSv3.1 shows a HIGH base score (8.1) with NETWORK attack vector, LOW attack complexity, NONE requ...

CVE-2025-10529

CVE-2025-10529 describes a Same-origin policy bypass in the Firefox/Thunderbird Layout component. The connected sources confirm the vulnerability affects Firefox versions below 143 and Firefox ESR below 140.3, and Thunderbird versions below 143 and below 140.3. The impact is implied by the descri...

CVE-2025-10534

CVE-2025-10534 is a spoofing vulnerability in the Site Permissions component affecting Mozilla Firefox and Mozilla Thunderbird. Affected versions are Firefox < 143 and Thunderbird

CVE-2025-55028

CVE-2025-55028 affects Mozilla Firefox for iOS. The issue arises from malicious scripts using repetitive JavaScript alerts that can prevent user interaction, potentially enabling denial-of-service scenarios. Affected version range is Firefox for iOS before 142. The available connected documents c...

CVE-2026-0884

CVE-2026-0884 is a use-after-free in the JavaScript Engine component. Affected products include Firefox (versions before 147 and ESR before 140.7) and Thunderbird (versions before 147 and ESR before 140.7). The issue is confirmed in multiple security advisories and Debian/Distro records. Remediat...

CVE-2026-12330

CVE-2026-12330 corresponds to an issue in the Internationalization component with incorrect boundary conditions. Public disclosures in connected advisories confirm multiple Mozilla products are affected, including Firefox ESR and Thunderbird. Debian’s advisory shows the vulnerability affecting fi...

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-4702

CVE-2026-4702 is a JIT miscompilation in the JavaScript Engine component. The primary entry states it is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Connected advisories consistently reference the same JIT/memory-safety context across Firefox/Thunderbird relea...

CVE-2026-74935

Mozilla Firefox's DOM Networking component has a privilege escalation flaw, scoring CVSS 8.8 (HIGH). An attacker can trigger it via a malicious webpage (network vector, low complexity). Affected users should upgrade to Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1. No in-the-wild exploitation...

CVE-2026-8973

CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...

CVE-2025-10859

CVE-2025-10859 affects Mozilla Firefox for iOS (pre-143.1). The issue is an information disclosure caused by cookie storage for non-HTML temporary documents being shared with normal browsing content, allowing data from private/incognito tabs to be exposed even after all tabs are closed. Impact de...

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-16362

CVE-2026-16362 is a use-after-free in Firefox’s WebRTC Audio/Video component. The issue affects Firefox and Firefox ESR prior to the listed fixes, with the vulnerability fixed in Firefox 153 and Firefox ESR 140.13. The CVSS–3.1 metrics indicate network attack vector, no privileges, user interacti...

CVE-2026-16364

CVE-2026-16364 describes incorrect boundary conditions in Mozilla Firefox's Audio/Video: Playback component, with impact per sources as a high-severity issue fixed in Firefox 153. Affected product: Mozilla Firefox versions earlier than 153.0. Root cause: boundary-condition error in the Playback s...

CVE-2026-16388

CVE-2026-16388 concerns a sandbox escape in the DOM within Firefox’ s Networking component. The available documents identify the affected software as Mozilla Firefox (DOM/Networking code path) and state the vulnerability was fixed in Firefox 153. The description provided does not reveal a detaile...

CVE-2026-16407

The CVE-2026-16407 entry describes a mitigation bypass in the DOM: Service Workers component. Affected software is Mozilla Firefox (and dependent Thunderbird) prior to version 153, with the underlying issue addressed by fixes in Firefox 153/Thunderbird 153. The practical impact is a bypass of mit...

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...