CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-4700

CVE-2026-4700 affects Firefox and Thunderbird; mitigation bypass in the Networking: HTTP component was fixed in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The CVSS 3.1 score is 9.8 (CRITICAL) with NETWORK attack vector and no user interaction. Remediation per provided docs: upgrade to F...

CVE-2026-4710

CVE-2026-4710 is an Audio/Video boundary-conditions flaw that affects Firefox (including ESR) and Thunderbird. The issue’s root cause is incorrect boundary handling in the Audio/Video component. Public advisories list the impact as high/critical, with CVSS 3.1 base score 9.8 (Impact: Confidential...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-8948

CVE-2026-8948: A same-origin policy bypass in the DOM: Networking component affecting Firefox and Thunderbird; fixed in Firefox 151 and Thunderbird 151. CVSS 3.1: 9.1 (CRITICAL), attack vector NETWORK, complexity LOW, no user interaction. No exploitation details provided in the documents. Remedia...

CVE-2026-8956

The CVE-2026-8956 issue is an integer overflow in the Networking: JAR component. Affected products include Firefox (includes Firefox 151 and Firefox ESR 140.11) and Thunderbird (incl. Thunderbird 151 and Thunderbird 140.11). The root cause is an integer overflow within the JAR networking module, ...

CVE-2025-11720

Summary of CVE-2025-11720 : The issue affects Mozilla Firefox (including Firefox for Android) where the Custom Tabs UI only shows the base site hostname, not the full hostname. This can enable user deception when content from a subdomain is hosted to resemble content from another subdomain of the...

CVE-2025-13022

CVE-2025-13022 is a boundary-condition flaw in the Graphics: WebGPU component that affects Firefox and Thunderbird, both prior to version 145. Root cause: incorrect boundary handling in WebGPU. Impact: high-severity potential for crashes or arbitrary code execution per the CVSS data. Affected pro...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2026-0879

CVE-2026-0879 is a sandbox escape in the Graphics component that affects Firefox and Thunderbird prior to certain versions. Concrete details from connected documents show: the vulnerability is described as a Sandbox escape due to incorrect boundary conditions in the Graphics component, affecting ...

CVE-2026-0884

CVE-2026-0884 is a use-after-free in the JavaScript Engine component. Affected products include Firefox (versions before 147 and ESR before 140.7) and Thunderbird (versions before 147 and ESR before 140.7). The issue is confirmed in multiple security advisories and Debian/Distro records. Remediat...

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2026-12320

CVE-2026-12320 affects the Password Manager component in Firefox and Thunderbird. The vulnerability enables information disclosure and is documented with a CVSS v3.1 base score of 4.3 (Medium) with network attack vector, low attack complexity, no privileges required, but user interaction is requi...

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-2790

CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...

CVE-2026-4720

CVE-2026-4720 is a memory-safety issue affecting Mozilla products (Firefox/Thunderbird). Connected advisories confirm memory-corruption-type bugs in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148, with the practical impact stated as potential arbitrary code execution. ...

CVE-2026-8960

Summary: CVE-2026-8960 is a spoofing issue in WebExtensions that affects Firefox (and Thunderbird per NVD) and was fixed in Firefox 151 and Thunderbird 151. According to the sources, the vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no p...

CVE-2026-8962

CVE-2026-8962 is a mitigation bypass in the DOM: Security component affecting Firefox/Thunderbird. It was fixed in Firefox 151 and Firefox ESR 140.11, and in Thunderbird 151 and Thunderbird 140.11. CVSSv3.1 shows a HIGH base score (8.1) with NETWORK attack vector, LOW attack complexity, NONE requ...

CVE-2025-11708

CVE-2025-11708 is a use-after-free in MediaTrackGraphImpl::GetInstance() affecting Firefox before version 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird before 140.4. Connected advisories corroborate multiple vendors and distributions addressing these Firefox/Thunderbird m...

CVE-2025-11715

CVE-2025-11715 is part of a family of memory-safety issues affecting Mozilla Firefox and Thunderbird. Connected sources confirm memory safety bugs and memory corruption with potential to execute arbitrary code, affecting Firefox/Thunderbird and their ESR releases prior to version 144 (and ESR 140...

CVE-2026-12301

CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...

CVE-2026-12323

CVE-2026-12323 describes a spoofing issue in the DOM: Core & HTML component. The vulnerability affected Mozilla Firefox and Thunderbird and was fixed in Firefox 152 and Thunderbird 152. The available references confirm the DOM spoofing flaw and its patch in version 152. Practical impact is modest...

CVE-2026-12326

CVE-2026-12326 is a Firefox/Thunderbird memory-safety issue affecting Firefox 151 and Thunderbird 151. The available sources indicate memory corruption that could be exploited to run arbitrary code, with a fix delivered in Firefox 152 and Thunderbird 152. The vulnerability details include affecte...

CVE-2026-4685

Summary: CVE-2026-4685 concerns the Graphics: Canvas2D component with incorrect boundary conditions. Affects Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9. Root cause described as incorrect boundary conditions in the Canvas2D implementation. References include ...

CVE-2026-4693

CVE-2026-4693: Affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2026-4704

Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) affects Firefox/Firefox ESR and Thunderbird prior to fixed versions. Multiple documents confirm the issue and indicate fixes in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is associa...

CVE-2026-4708

CVE-2026-4708 is an incorrect boundary conditions vulnerability in Mozilla Firefox’s Graphics component (Canvas2D) affecting Firefox < 149 and Firefox ESR

CVE-2026-4715

CVE-2026-4715 involves uninitialized memory in the Graphics: Canvas2D component. Affected products are Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 140.9. The connected records (NVD and CVE/CVE List entries) confirm the vulnerability and its scope but do not provide deta...

CVE-2026-8951

The CVE-2026-8951 entry describes a Spoofing issue in the Toolbar component of Firefox for Android. The connected documents consistently identify the affected software as Firefox for Android and state the vulnerability was fixed in Firefox 151. There are no explicit technical details about the ro...

CVE-2026-8966

CVE-2026-8966 affects Mozilla Thunderbird (earlier than 151.0) and concerns information disclosure in the IP Protection component. Multiple connected sources corroborate the impact as information disclosure, with the vulnerability fixed in Thunderbird 151 (and Firefox 151 per the initial entry). ...

CVE-2026-8971

The CVE-2026-8971 issue is described across multiple sources as a same-origin policy bypass in the Networking: JAR component, with remediation issued as Firefox 151. The documents do not specify the exact affected product versions beyond Firefox, nor any exploits or in-the-wild use. Root cause de...

CVE-2026-8973

CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...

CVE-2026-8975

CVE-2026-8975 covers memory-safety bugs in Thunderbird 140.10 and Thunderbird 150, with evidence that some flaws could be exploited to run arbitrary code. The fixed versions are Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Affected products documen...

CVE-2025-11713

CVE-2025-11713: Potential user-assisted code execution via the Copy as cURL feature. Affected products per the sources include Firefox versions prior to 144, Firefox ESR prior to 140.4, Thunderbird versions prior to 144, and Thunderbird prior to 140.4. Root cause: insufficient escaping in the Cop...

CVE-2025-11718

CVE-2025-11718 affects Mozilla Firefox versions earlier than 144. The issue allows a malicious page to spoof the address bar by creating a fake bar in response to a visibilitychange event when the Android address bar is hidden after scrolling. Impact is spoofing UI and potential user deception; n...

CVE-2025-13014

CVE-2025-13014 is a use-after-free in the Audio/Video component affecting Firefox < 145, Firefox ESR < 140.5, and Thunderbird < 145 /

CVE-2025-14744

CVE-2025-14744 concerns Unicode RTLO spoofing in Firefox for iOS prior to version 144.0. The issue allows a malicious website to render spoofed filenames in the downloads UI, potentially misleading users into saving files with an unintended file type. Affected product: Firefox for iOS

CVE-2026-0882

CVE-2026-0882 : Use-after-free in the IPC component exposed in Firefox < 147, Firefox ESR < 115.32 and < 140.7, Thunderbird < 147 and

CVE-2026-12322

CVE-2026-12322 is a clickjacking vulnerability in the Gtk Widget component affecting Mozilla Firefox and Thunderbird. The issue, described across multiple sources, is due to a UI framing/embedding flaw that could enable deceptive UI interaction. Affected products were updated to mitigate the vuln...

CVE-2026-2794

CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. Affected: Firefox/Firefox Focus for Android; root cause is uninitialized memory. Status: fixed in Firefox 148.0. Remediation: upgrade to Firefox 148 or later (per Mozilla advisory). Practic...

CVE-2026-5732

CVE-2026-5732 describes an issue with incorrect boundary conditions and an integer overflow in the Graphics: Text component. Affected products include Firefox and Thunderbird (and their ESR releases). The vulnerability impacts versions older than Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird ...

CVE-2025-13026

The CVE-2025-13026 entry concerns a sandbox escape caused by incorrect boundary conditions in the Graphics: WebGPU component. Affected products are Mozilla Firefox and Thunderbird listed as <145 versions (Firefox <145 and Thunderbird

CVE-2026-12303

CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...

CVE-2026-2759

The CVE-2026-2759 issue is concrete: it concerns incorrect boundary conditions in the Graphics: ImageLib component affecting Firefox/Thunderbird products. The description explicitly states the vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thun...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-2773

CVE-2026-2773 is a Chrome-like vulnerability in Firefox’s Web Audio component caused by incorrect boundary conditions, fixed in Firefox 148 and corresponding ESR releases (ESR 115.33 and ESR 140.8). The issue is documented across multiple advisories (Firefox security notes and vendor feeds) and i...

CVE-2026-2804

CVE-2026-2804 describes a use-after-free vulnerability in the JavaScript: WebAssembly component that affects Mozilla Firefox and Mozilla Thunderbird. The issue is fixed in Firefox 148 and Thunderbird 148. Connected advisories reaffirm the same root cause (memory management issue in the WebAssembl...

CVE-2026-4706

CVE-2026-4706: In Graphics: Canvas2D, a boundary-condition issue could affect Firefox/Thunderbird before certain releases. Public advisories indicate fixes in Firefox 149, ESR 115.34 and ESR 140.9, and Thunderbird 149 and 140.9. Upgrading to these versions (or later) is the advised remediation pe...

CVE-2026-4717

CVE-2026-4717: Privilege escalation in the Netmonitor component. According to the provided advisories, Firefox and Firefox ESR are affected and the issue is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability originated in the Netmonitor component an...