CVE-2026-10701

CVE-2026-10701 relates to an Incorrect boundary condition in Firefox’s Graphics: Text component. Connected sources confirm this is addressed by the Firefox 151.0.3 update, fixing the vulnerability. The issue is described as a boundary condition problem within the Graphics: Text component and is i...

CVE-2026-12314

CVE-2026-12314 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird addressed by updates to Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s advisory confirms Firefox ESR 140.12.0esr-1~deb13u1 fixes the issue for firefox-esr in the stable trixie packag...

CVE-2026-12318

CVE-2026-12318 concerns the Mozilla NSS Libraries component. The vulnerability is described as incorrect boundary conditions in the NSS Libraries, with the fixed versions identified as Firefox 152 and Thunderbird 152. Connected sources confirm this fix and cite Firefox/Thunderbird 152 as the reme...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-4692

This CVE (CVE-2026-4692) is a confirmed issue in the Responsive Design Mode component, leading to sandbox escape. The primary affected product is Mozilla Firefox (and related ESR builds) with versions prior to the fixed releases: Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9; Thunderbird...

CVE-2026-4705

CVE-2026-4705 is an undefined-behavior issue in the WebRTC: Signaling component. Public disclosures in the initial document indicate the vulnerability affected Firefox and Thunderbird products, with patches delivered in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The accompanying connect...

CVE-2026-4721

CVE-2026-4721 refers to memory-safety bugs in Firefox/Thunderbird across Firefox ESR 115.33, ESR 140.8, and Firefox/Thunderbird 148. Some flaws show memory corruption and could be exploitable for arbitrary code with enough effort per the initial entry. The issues were fixed in Firefox 149, Firefo...

CVE-2026-8961

CVE-2026-8961 is a spoofing issue in the Mozilla form autofill component. Publicly documented fixes apply to Firefox and Thunderbird updates: Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. OpenSUSE and Slackware advisories list Firefox ESR/Thunderbird updates (e.g., fir...

CVE-2026-8968

Denial-of-service in the Audio/Video: Web Codecs component of Firefox caused by an invalid pointer. Affected product: Firefox WebCodecs; root cause: invalid pointer in the WebCodecs code path. Impact (per CVSS 3.1): HIGH with Availability impact; Attack Vector: NETWORK; Attack Complexity: LOW; Pr...

CVE-2026-8970

The CVE describes a privilege-escalation in the Firefox Security component. Concrete detail from sources: the flaw is fixed in Firefox 151 and Firefox ESR 140.11. Affected scope is stated only as the Security component; no deeper root cause, affected subcomponents, or explicit exploit paths are p...

CVE-2025-11714

CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...

CVE-2025-13025

CVE-2025-13025 describes incorrect boundary conditions in the Graphics: WebGPU component. Affected are Firefox and Thunderbird versions earlier than 145. Access vector/exploitation details are not provided in the documents, but advisories indicate the issue is addressed by updating to Firefox/Thu...

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2025-54144

Summary: CVE-2025-54144 affects Firefox for iOS before version 141. The URL scheme used to facilitate searching of text queries could be abused to open arbitrary website URLs or internal pages if a user is tricked into clicking a link. This is described as a security bypass in Firefox for iOS pri...

CVE-2025-54145

The CVE-2025-54145 issue affects Mozilla Firefox for iOS, specifically versions before 141. The vulnerability arises from the QR scanner and Firefox’s open-text URL scheme, which could cause a user to load arbitrary websites. Documented impact is high (H) with user interaction required and no pri...

CVE-2025-55031

CVE-2025-55031 affects Firefox for iOS and Firefox Focus for iOS prior to version 142. A malicious page can trigger FIDO/hybrid passkey transport by passing FIDO links to the OS, and an attacker within Bluetooth range could coerce a user into using their passkey to sign into the attacker’s machin...

CVE-2026-0880

CVE-2026-0880 is a sandbox-escape vulnerability: sandbox escape due to an integer overflow in the Graphics component. Affected products include Firefox (<147), Firefox ESR (<115.32 and <140.7), Thunderbird (<147 and

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-0892

CVE-2026-0892 concerns memory safety bugs in Mozilla Firefox and Thunderbird prior to version 147. The CVE description notes memory corruption with potential for arbitrary code execution, affecting Firefox < 147 and Thunderbird

CVE-2026-12302

CVE-2026-12302 is a mitigation bypass in the DOM: Security component that has been fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Multiple advisories and vendor notes confirm the patch exists in these versions. Affected products in the conne...

CVE-2026-13356

The CVE-2026-13356 issue affects Firefox for iOS and centers on a malicious webpage that interrupts a pending navigation by enqueuing a synchronous JavaScript dialog. This side effect causes the browser UI to display the destination origin in the address bar while attacker-controlled content cont...

CVE-2026-2769

CVE-2026-2769 is a use-after-free vulnerability in Firefox’s Storage: IndexedDB component. Affected products are Firefox versions earlier than 148, Firefox ESR earlier than 115.33, and Firefox ESR earlier than 140.8. The issue arises from a memory safety flaw in IndexedDB storage handling, leadin...

CVE-2026-2777

CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-4696

The CVE-2026-4696 entry describes a Use-after-free in Firefox’s Layout: Text and Fonts component. Affected products are Firefox versions newer than? actually older than 149 for Firefox, and ESR variants: <115.34 and

CVE-2026-4711

CVE-2026-4711 describes a use-after-free in the Cocoa-based Widget component affecting Mozilla Firefox before 149 and Firefox ESR before 140.9. The available sources consistently state the vulnerability type and affected versions but do not provide payload details, implicated files, root cause be...

CVE-2026-4729

CVE-2026-4729 affects Firefox 148 and Thunderbird 148, with memory-safety bugs that could lead to memory corruption and potential arbitrary-code execution. The issues were fixed in Firefox 149 and Thunderbird 149. Mitigation: upgrade to the fixed versions (Firefox 149 / Thunderbird 149). Exploita...

CVE-2026-8949

CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...

CVE-2026-8955

CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...

CVE-2026-8957

CVE-2026-8957 involves a privilege-escalation issue in Mozilla Firefox/Thunderbird’s Enterprise Policies component. Affected products include Firefox and Thunderbird, with fixes in Firefox 151 and Firefox ESR 140.11 (and corresponding Thunderbird updates 151/140.11). The vulnerability details in ...

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2025-13016

CVE-2025-13016 is a Mozilla Firefox/Firefox ESR JavaScript: WebAssembly component boundary-condition vulnerability. Connected advisories confirm the flaw affects Firefox <145 and ESR

CVE-2025-13019

CVE-2025-13019 is a same-origin policy bypass in the DOM: Workers component. Connected advisories confirm affected products as Mozilla Firefox and Firefox ESR, with impact on versions below Firefox 145 and Firefox ESR below 140.5. The Amazon Linux advisories (ALAS2-2025-3108, ALAS2FIREFOX-2025-04...

CVE-2025-13023

CVE-2025-13023 is a sandbox-escape vulnerability in Graphics: WebGPU, affecting Firefox < 145 and Thunderbird

CVE-2025-14323

CVE-2025-14323 describes a privilege-escalation vulnerability in the DOM: Notifications component affecting Firefox < 146, Firefox ESR < 115.31, and Firefox ESR

CVE-2025-54143

CVE-2025-54143 is tied to Firefox for iOS prior to version 141. The issue arises from sandboxed iframes on web pages that could bypass the parent page’s sandbox restrictions, potentially allowing downloads to the device. Affected product: Firefox for iOS

CVE-2025-9186

CVE-2025-9186 concerns a spoofing vulnerability in the Address Bar of Firefox Focus for Android. Affected: Firefox versions earlier than 142.0. Root cause: spoofing in the Address Bar component. Impact per sources: potential spoof UI exploitation; no explicit exploitation details provided. Remedi...

CVE-2026-0890

The CVE-2026-0890 entry describes a spoofing issue in the DOM: Copy & Paste and Drag & Drop component affecting Mozilla products. Affected products/components: Firefox (versions before 147) and Firefox ESR (before 140.7); Thunderbird (before 147) and Thunderbird (before 140.7). Root cause and imp...

CVE-2026-12305

Memory-safety vulnerability CVE-2026-12305 affecting Mozilla Firefox and Thunderbird, fixed in Firefox 152 (including ESR 140.12) and Thunderbird 152/140.12. Root cause stated as memory safety bug; no exploitation details provided. Remediation: upgrade to Firefox 152 / ESR 140.12 and Thunderbird ...

CVE-2026-12317

CVE-2026-12317 is a memory-safety vulnerability fixed in Firefox 152 and Thunderbird 152. Affected products are Firefox/Thunderbird; root cause is a memory-safety bug.remediation is to upgrade to Firefox 152 / Thunderbird 152 as indicated by multiple advisories (e.g., Mozilla MFSA advisories and ...

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...

CVE-2026-4700

CVE-2026-4700 affects Firefox and Thunderbird; mitigation bypass in the Networking: HTTP component was fixed in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The CVSS 3.1 score is 9.8 (CRITICAL) with NETWORK attack vector and no user interaction. Remediation per provided docs: upgrade to F...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-8948

CVE-2026-8948: A same-origin policy bypass in the DOM: Networking component affecting Firefox and Thunderbird; fixed in Firefox 151 and Thunderbird 151. CVSS 3.1: 9.1 (CRITICAL), attack vector NETWORK, complexity LOW, no user interaction. No exploitation details provided in the documents. Remedia...

CVE-2026-8956

The CVE-2026-8956 issue is an integer overflow in the Networking: JAR component. Affected products include Firefox (includes Firefox 151 and Firefox ESR 140.11) and Thunderbird (incl. Thunderbird 151 and Thunderbird 140.11). The root cause is an integer overflow within the JAR networking module, ...

CVE-2025-11720

Summary of CVE-2025-11720 : The issue affects Mozilla Firefox (including Firefox for Android) where the Custom Tabs UI only shows the base site hostname, not the full hostname. This can enable user deception when content from a subdomain is hosted to resemble content from another subdomain of the...