CVE-2026-0877

A mitigation bypass vulnerability exists in the DOM: Security component of several Mozilla products. This flaw allows an attacker to remotely circumvent existing security restrictions due to a weakness in data protection mechanisms. The issue affects Mozilla Firefox (versions prior to 147), Firef...

CVE-2026-16394

CVE-2026-16394 describes a mitigation bypass in the DOM: Security component of the Mozilla suite. The vulnerability has been addressed in Firefox 153 and Thunderbird 153 . No specific details regarding the root cause, exploitability, or practical consequences are provided in the documents beyond ...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-2778

CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. Affected: Firefox (pre-148), Firefox ESR (pre-115.33/140.8); Thunderbird (pre-148, pre-140.8). Fixes: Firefox 148, ESR 115.33/140.8; Thunderbird 148/140.8. Practical impact: sandbox escape potent...

CVE-2026-8948

A same-origin policy bypass exists in the DOM: Networking component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability is caused by the use of an untrusted network policy file , which can allow a remote attacker to execute arbitrary code . The issue was res...

CVE-2026-92009

Mozilla Firefox and Thunderbird are affected by CVE-2026-92009, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. This security issue has been addressed in several releases, including Firefox 156 , Firefox ESR 115.41 , Firefox...

CVE-2026-92022

A use-after-free vulnerability exists in the DOM: HTML Parser component of Mozilla Firefox and Thunderbird . This flaw can be triggered during the parsing of HTML content. The issue has been addressed in several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox E...

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2026-100810

An issue exists within the DevTools component in Mozilla Firefox and Thunderbird . This vulnerability affects versions prior to 157 . The impact of this vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8 , potentially leading to high confidentiality, integrity, and availability impac...

CVE-2026-12301

A memory safety bug exists in the Mozilla Firefox web browser and Thunderbird email client. The vulnerability involves operations escaping buffer boundaries in memory, which could allow a remote attacker to gain access to confidential data . This issue is addressed in Firefox 152 and Thunderbird ...

CVE-2026-12307

A memory safety bug has been identified and fixed in Firefox and Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The issue was specifically addressed as a memory safety fix in the Thunderbird client. No specific technical deta...

CVE-2026-4692

This CVE (CVE-2026-4692) is a confirmed issue in the Responsive Design Mode component, leading to sandbox escape. The primary affected product is Mozilla Firefox (and related ESR builds) with versions prior to the fixed releases: Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9; Thunderbird...

CVE-2026-92023

A Use-after-free vulnerability exists in the XML component of the Mozilla Firefox and Thunderbird applications. This flaw could potentially allow an attacker to cause a crash or achieve arbitrary code execution. The issue has been addressed in the following versions: Firefox 156 , Firefox ESR 115...

CVE-2026-92030

A mitigation bypass exists in the DOM: Copy & Paste and Drag & Drop component of the Mozilla Firefox and Mozilla Thunderbird browsers. This vulnerability was addressed in Firefox versions 156, ESR 140.16, and ESR 153.3, as well as Thunderbird versions 156, 140.16, and 153.3. Security advisories f...

CVE-2026-92042

A race condition exists in the DOM: Content Processes component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the provided documents confirm the presence of the vulnerability in...

CVE-2026-92058

A use-after-free vulnerability exists in the Graphics component of the Firefox browser and Thunderbird. This flaw has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While one connected document (MGASA-2026-0441) characterizes this specific CVE ID as

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2023-37456

Summary of CVE-2023-37456 (Firefox for iOS) : The issue is a crash in the session restore helper when no parameter is sent to the message handler, affecting Firefox for iOS versions prior to 115. Per connected documents, this creates a denial-of-service risk that can be triggered remotely. The ro...

CVE-2026-2767

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox/Thunderbird. Affected products include Firefox (Desktop) and Thunderbird with the WebAssembly implementation; the issue is addressed by fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-2777

CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...

CVE-2026-4729

Mozilla Firefox and Thunderbird versions 148 contain memory safety bugs that exhibit evidence of memory corruption. A specific vulnerability in the Firefox web browser involves copying buffers without checking the input data , which could allow a remote attacker to trigger a service failure or, w...

CVE-2026-8962

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and the Thunderbird email client. Exploiting this vulnerability could allow an attacker to access confidential data and compromise data integrity . This issue was resolved in Firefox 151 , Firefox ESR 140.11 , Th...

CVE-2017-7767

CVE-2017-7767 involves privilege escalation and arbitrary file overwrites via the Mozilla Windows Updater and Mozilla Maintenance Service on Windows. Affected products are Firefox ESR versions older than 52.2 and Firefox versions older than 54. The root cause is the update/maintenance components ...

CVE-2026-0892

Mozilla Firefox and Thunderbird versions 146 (and versions prior to 147) are affected by memory safety bugs that can lead to memory corruption . An attacker could potentially exploit these vulnerabilities to achieve arbitrary code execution on the system or cause a denial-of-service (DoS) attack....

CVE-2026-100782

The Firefox browser is affected by a privilege escalation vulnerability (CVE-2026-100782 ) caused by incorrect boundary conditions in the Graphics component . This flaw allows for unauthorized privilege escalation and has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 ,...

CVE-2026-100818

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free in the Widget: Gtk component. This vulnerability was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitation information are provide...

CVE-2026-2782

CVE-2026-2782 affects Firefox (Netmonitor component) and is fixed in Firefox 148 and Firefox ESR 140.8, also addressed in Thunderbird 148/140.8. The connected sources corroborate privilege-escalation via Netmonitor across Mozilla products and note remediation as upgrading to Firefox 148+/Thunderb...

CVE-2026-4698

CVE-2026-4698 — JIT miscompilation in the JavaScript Engine (JIT component) . The issue is disclosed for Firefox/Thunderbird products and is described as a JIT miscompilation in the JavaScript engine’s JIT path. Affected versions are Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2026-8390

Mozilla Firefox is vulnerable to a use-after-free memory corruption flaw in the JavaScript: WebAssembly component. The vulnerability occurs because the component responsible for releasing memory experiences confusion in its instructions, allowing memory to be used after it has been freed. A remot...

CVE-2026-8401

A sandbox escape vulnerability exists in the Profile Backup component of Mozilla Firefox and Thunderbird . The flaw is related to a lack of data security mechanisms , which could allow an attacker to cause service interruptions . Affected versions include various builds of Firefox, Firefox ESR, a...

CVE-2026-8973

Memory safety bugs in Firefox 150 and Thunderbird 150 allow for memory corruption due to operations exceeding buffer boundaries. While the impact primarily involves potential service interruptions , it is presumed that with sufficient effort, these flaws could be exploited to achieve arbitrary co...

CVE-2026-92008

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderb...

CVE-2026-92069

This vulnerability involves a spoofing issue within the DOM: Navigation component . The flaw has been addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While multiple connected documents list this CVE, they do not provide specific tec...

CVE-2026-92073

CVE-2026-92073 is a privilege escalation vulnerability within the Enterprise Policies component of the Mozilla Firefox browser. This issue was addressed in Firefox version 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While various security advisories and package updates (su...

CVE-2026-96869

The Networking component in Firefox is subject to an information disclosure vulnerability (CVE-2026-96869 ). This issue was reported by Carlo Di Dato and has a moderate impact. The vulnerability has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit d...

CVE-2014-1494

CVE-2014-1494 concerns multiple memory-safety vulnerabilities in the browser engine of Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25, with remote denial of service or potential arbitrary code execution via unknown vectors. The connected docs confirm that these issues are part of MFSA ...

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions

CVE-2025-6431

In Firefox for Android , a security bypass vulnerability exists in the Link Handler component where the prompt for opening links in external applications can be circumvented. This flaw could allow an attacker to bypass security restrictions, potentially leading to security vulnerabilities or priv...

CVE-2026-2775

CVE-2026-2775 is a mitigation bypass in the DOM: HTML Parser component. The initial description states a fix in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux bulletin and Amazon Linux advisories) reiterate the same mitig...

CVE-2026-2780

CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...

CVE-2026-2802

A race condition exists in the JavaScript: GC component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from simultaneous execution using a shared resource with incorrect synchronization. If exploited, an attacker could gain access to confidential ...

CVE-2026-2804

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The root cause is a mix-up in the instructions responsible for freeing memory. An attacker could exploit this flaw to execute arbitrary code , ca...

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-6778

Mozilla Firefox and Thunderbird are vulnerable to an invalid pointer (specifically a zero pointer ) in the Audio/Video: Playback component. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information . This issue has been resolved in Firefox 150 ...

CVE-2026-92020

The Graphics: WebRender component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This issue affects several versions, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird...

CVE-2026-92072

This vulnerability exists in the Safe Browsing component due to incorrect boundary conditions . The flaw affects Mozilla Firefox and Thunderbird software. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Exploitation details are not provided ...

CVE-2005-0587

CVE-2005-0587 : Firefox versions before 1.0.1 and Mozilla before 1.7.6 are affected. A remote attacker can trick a user into downloading a .LNK file twice, causing arbitrary files referenced by the first link to be overwritten. This stems from how the .LNK files are processed during download. Aff...

CVE-2009-1597

Summary : CVE-2009-1597 affects Mozilla Firefox. What’s affected : Firefox’s handling of a javascript: URI in the target attribute of a submit element within a form embedded in a PDF, potentially bypassing Adobe Acrobat JavaScript restrictions. Root cause / vector : DOM calls triggered by the jav...

CVE-2009-4102

The CVE-2009-4102 entry concerns the Sage Firefox extension (1.4.3 and earlier) which processes feed descriptions with chrome privileges, enabling remote command execution and cross-domain scripting via crafted RSS/Atom feeds. Affected versions include Sage prior to 1.4.6; Debian’s advisory and J...