CVE-2026-5732

CVE-2026-5732 describes an issue with incorrect boundary conditions and an integer overflow in the Graphics: Text component. Affected products include Firefox and Thunderbird (and their ESR releases). The vulnerability impacts versions older than Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird ...

CVE-2026-8966

CVE-2026-8966 affects Mozilla Thunderbird (earlier than 151.0) and concerns information disclosure in the IP Protection component. Multiple connected sources corroborate the impact as information disclosure, with the vulnerability fixed in Thunderbird 151 (and Firefox 151 per the initial entry). ...

CVE-2026-8969

CVE-2026-8969 is a mitigation bypass in the DOM: Security component that was fixed in Firefox 151 and Thunderbird 151. The CVSS 3.1 base vector indicates Network attack vector, no privileges required, user interaction required, with high impact to confidentiality and integrity and no impact on av...

CVE-2025-13017

Mode C: CVE-2025-13017 is a same-origin policy bypass in the DOM: Notifications component, affecting Firefox before 145 (and ESR before 140.5) and Thunderbird before 145 (and ESR before 140.5). Connected advisories confirm this CVE alongside other Firefox DOM/JSWA issues and list concrete mitigat...

CVE-2025-13026

The CVE-2025-13026 entry concerns a sandbox escape caused by incorrect boundary conditions in the Graphics: WebGPU component. Affected products are Mozilla Firefox and Thunderbird listed as <145 versions (Firefox <145 and Thunderbird

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-4687

CVE-2026-4687 describes a sandbox-escape vulnerability in the Mozilla Firefox/Thunderbird Telemetry component caused by incorrect boundary conditions. Connected advisories confirm the issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9, Thunderbird 149 and Thunderbird 140.9, with related e...

CVE-2026-4716

CVE-2026-4716 is a boundary-condition and uninitialized-memory issue in the JavaScript Engine. Connected advisories associate it with Firefox/Thunderbird, stating it affects Firefox < 149 and Firefox ESR

CVE-2026-4722

CVE-2026-4722 describes a privilege escalation in the IPC component affecting Firefox

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2026-8952

CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...

CVE-2026-8965

CVE-2026-8965 is an information-disclosure vulnerability in the DOM: Security component, affecting Mozilla Firefox and Mozilla Thunderbird up to version 151. The issue is fixed in Firefox 151 and Thunderbird 151. Affected products include Mozilla Firefox earlier than 151.0 and Mozilla Thunderbird...

CVE-2026-8967

CVE-2026-8967 affects Mozilla graphics stack via the Graphics: WebGPU component, leading to information disclosure. Public documentation in connected sources indicates the vulnerability was fixed in Firefox 151 and Thunderbird 151, with affected products listed as Mozilla Thunderbird and Mozilla ...

CVE-2026-0889

CVE-2026-0889 describes a Denial-of-Service in the DOM: Service Workers component, affecting Mozilla Firefox and Mozilla Thunderbird versions earlier than 147. The CVE’s publicly documented impact is DoS with the DOM Service Workers, and the related advisory notes advise updating to the latest ve...

CVE-2026-12300

CVE-2026-12300 describes a memory-safety issue that was fixed in Firefox 152 and Thunderbird 152. The available sources confirm the affected products are Mozilla Firefox/Thunderbird, with the underlying problem labeled as a memory safety bug. The CVSS metrics in the initial document indicate a ba...

CVE-2026-12319

CVE-2026-12319 is a reported DoS in the Audio/Video: Playback component. Multiple connected sources confirm the issue affects Firefox and Thunderbird and that it was fixed in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges...

CVE-2026-3847

Memory safety bugs exist in Firefox 148.0.2, with some signs of memory corruption. The CVE-2026-3847 issue affects Firefox and was fixed in version 148.0.2. It is described as memory safety-related, potentially enabling arbitrary code execution in some cases, though no exploit details are provide...

CVE-2026-4686

CVE-2026-4686 targets the Graphics: Canvas2D component. The root cause is incorrect boundary conditions, exposed in Firefox versions prior to 149, Firefox ESR prior to 115.34, and Firefox ESR prior to 140.9. The connected sources confirm the affected products and versions without detailing exploi...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-4699

CVE-2026-4699: Incorrect boundary conditions in Firefox/Thunderbird Layout: Text and Fonts. Affected products include Firefox (pre-149, ESR 115.34/140.9) and Thunderbird (pre-149/140.9). A fix is available in Firefox 149, ESR 115.34, 140.9 and Thunderbird 149, 140.9. Upgrade to the patched releas...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2026-8964

The CVE-2026-8964 entry describes a spoofing issue in the Popup Blocker component. The vulnerability is stated to be fixed in Firefox 151 and Thunderbird 151, indicating a patch/upgrade is available for mitigation. The available data list the impact as high (I: High) with a network attack vector ...

CVE-2025-55030

CVE-2025-55030 concerns Firefox for iOS where a mis-handling of the Content-Disposition header (Attachment) allows inline content display and potential XSS. Affected: Firefox for iOS versions prior to 142. Root cause: improper handling of the Content-Disposition header for certain MIME types. Imp...

CVE-2026-4709

CVE-2026-4709 involves Firefox and Thunderbird components, specifically an incorrect boundary condition in the Audio/Video: GMP path. The vulnerability affects Firefox and Thunderbird releases prior to the fixes, with patches noted in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149 and...

CVE-2026-4714

CVE-2026-4714 is an Audio/Video boundary-condition vulnerability present in Mozilla Firefox/Thunderbird stack. The initial entry states impact as high (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 3.1 base 7.5) with exploitation not described in the sources. Connected advisories confirm the issue af...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-6756

CVE-2026-6756 is a mitigation bypass in Firefox for Android that was fixed in Firefox 150 . The connected documents confirm a version upgrade as remediation, with Fedora advisories and other feeds listing Firefox 150 as the patched release. The exact affected component(s) or root cause details ar...

CVE-2026-6781

CVE-2026-6781 is a denial-of-service vulnerability in the Mozilla Firefox/Thunderbird Audio/Video: Playback component. The issue is fixed in Firefox 150 and Thunderbird 150. Affected products are Firefox and Thunderbird; the root cause is described only as a DoS in the playback component, with no...

CVE-2026-0888

CVE-2026-0888 relates to information disclosure in the XML component in Mozilla Firefox and Thunderbird prior to version 147. Affected products include Firefox < 147 and Thunderbird

CVE-2026-12321

Summary: CVE-2026-12321 is a JIT miscompilation in the JavaScript: WebAssembly component. Affected products: Firefox and Thunderbird (WebAssembly/JS engine). Root cause: JIT miscompilation in the WebAssembly component. Impact: Not explicitly quantified beyond miscompilation; CVSS v3.1 base score ...

CVE-2026-4697

CVE-2026-4697 concerns incorrect boundary conditions in the Audio/Video: Web Codecs component. Public advisories list affected products as Firefox (pre-149 and ESR 140.9), and Thunderbird alongside Firefox fixes. The issue is defined as a boundary-condition flaw in the WebCodecs path, with fixed ...

CVE-2026-4707

CVE-2026-4707 is a vulnerability in the Graphics: Canvas2D component caused by incorrect boundary conditions. It affects Firefox (pre-149), Firefox ESR (pre-115.34 and pre-140.9) and is also listed similarly in related advisories. The issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9. If...

CVE-2026-4690

Summary of CVE-2026-4690 : A sandbox escape caused by incorrect boundary conditions and an integer overflow in the XPCOM component. This affects Firefox and related ESR branches prior to fixed versions. The public advisories indicate the issue is addressed in Firefox 149, ESR 115.34, and ESR 140....

CVE-2026-4712

The CVE covers an information-disclosure vulnerability in the Widget: Cocoa component affecting Firefox before 149 and Firefox ESR before 140.9. Affected product/component: Firefox/Firefox ESR on Cocoa widgets; vulnerability details (root cause, exploitability) are not provided in the supplied do...

CVE-2026-4725

CVE-2026-4725 describes a sandbox escape due to a use-after-free in the Graphics: Canvas2D component, affecting Firefox versions older than 149. The vulnerability impact is described in public CVE records; no exploitation details are provided in the connected documents. Affected software: Firefox...

CVE-2026-4723

CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox

CVE-2026-5733

CVE-2026-5733 affects Firefox and Thunderbird via the Graphics: WebGPU component due to incorrect boundary conditions. The vulnerability is a buffer overflow that can lead to arbitrary code execution or application crashes, as stated in multiple sources. Affected products are Firefox and Thunderb...