CVE-2026-2788

CVE-2026-2788 concerns incorrect boundary conditions in the Audio/Video: GMP component of Mozilla Firefox. Public advisories (e.g., Firefox/Firefox ESR updates in Firefox 148, ESR 115.33, ESR 140.8) and downstream Debian/AlmaLinux advisories confirm the fix was applied in those versions. Connecte...

CVE-2026-4691

The CVE-2026-4691 entry describes a use-after-free in Firefox’s CSS Parsing and Computation component. Affected products/versions, as documented across connected sources, include Firefox versions prior to 149 and Firefox ESR prior to 115.34 and 140.9. The root cause is a use-after-free in the CSS...

CVE-2026-4721

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are affected by memory safety bugs (CVE-2026-4721). These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issue impacts Firefox versions prior to 149, Firefox ESR ver...

CVE-2026-8969

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass in the DOM: Security component. The root cause is a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise its integrity . This vulnerability...

CVE-2026-92068

A site isolation issue exists in the Reader Mode component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in Firefox versions 156 and ESR 153.3, and Thunderbird versions 156 and 153.3. No specific exploit details or in-the-wild exploitation information are provi...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2025-13027

Mozilla Firefox and Thunderbird versions prior to 145 are susceptible to memory safety bugs that can result in memory corruption . These vulnerabilities could potentially be exploited by an attacker to execute arbitrary code on the affected system, potentially via remote vectors. The issues have ...

CVE-2025-14861

The Mozilla Firefox browser is affected by memory safety bugs in versions prior to 146.0.1 . These vulnerabilities involve memory security issues that could lead to memory corruption , potentially allowing a remote attacker to execute arbitrary code . The issue has been addressed in Firefox 146.0...

CVE-2026-2795

CVE-2026-2795 is a use-after-free in the JavaScript: GC component affecting Mozilla Firefox and Mozilla Thunderbird. Technical details across connected sources consistently identify the flaw in the GC object handling, with exploitation risk implied by the high/critical CVSS data. The vulnerabilit...

CVE-2026-92016

A use-after-free vulnerability exists in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability is cha...

CVE-2026-92025

A use-after-free vulnerability exists in the DOM: Navigation component of the Mozilla Firefox and Thunderbird browsers. This security flaw impacts several versions of the software. Remediation is available in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird ...

CVE-2026-92031

CVE-2026-92031 is an information disclosure vulnerability affecting the Graphics: ImageLib component in the Mozilla Firefox and Mozilla Thunderbird applications. The flaw allows for the unauthorized disclosure of information. Remediation is available in Firefox 156 , Firefox ESR 140.16 , Firefox ...

CVE-2026-92077

A Denial-of-Service (DoS) vulnerability exists in the SVG component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is confirmed to affect the SVG component and was addressed in several security updates. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird...

CVE-2012-4212

Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.

CVE-2025-10531

A mitigation bypass vulnerability exists in the Web Compatibility: Tooling component of the Mozilla Firefox browser and Mozilla Thunderbird email client. The flaw allows a malicious actor to circumvent existing security restrictions remotely by exploiting an alternative path or channel that bypas...

CVE-2025-11720

Summary of CVE-2025-11720 : The issue affects Mozilla Firefox (including Firefox for Android) where the Custom Tabs UI only shows the base site hostname, not the full hostname. This can enable user deception when content from a subdomain is hosted to resemble content from another subdomain of the...

CVE-2025-14324

CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...

CVE-2026-2785

CVE-2026-2785 is an Invalid pointer vulnerability in the Firefox JavaScript Engine. Connected sources show it being addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Debian/ALMA and Amazon Linux advisories enumerate Firefox-related fixes including this CVE and l...

CVE-2026-8971

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a same-origin policy bypass within the Networking: JAR component. The root cause is attributed to a lack of source verification mechanism in the networking component. If exploited, an attacker can bypass securi...

CVE-2026-92015

A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw was addressed in the following releases: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thu...

CVE-2017-7766

CVE-2017-7766 is a local privilege-escalation path in Windows Mozilla updater components. An attacker who already has local access can manipulate updater.ini to abuse the Mozilla Windows Updater and Mozilla Maintenance Service, gaining privileged access to execute arbitrary files or delete files....

CVE-2021-43530

Affected software: Firefox for Android. The CVE-2021-43530 entry describes a Universal XSS vulnerability caused by improper sanitization when processing a URL scanned from a QR code, affecting Firefox versions before 94. The condition is explicit in multiple sources (NVD/Nessus aggregation and re...

CVE-2021-43533

CVE-2021-43533 affects Firefox versions prior to 94. Root cause: during internationalized domain name parsing, high bits of URL characters could be stripped, causing display/inconsistency that could enable phishing or user confusion. Impact: user interaction required; potential phishing risk due ...

CVE-2025-10532

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a security bypass due to incorrect boundary conditions in the JavaScript: GC component . The root cause is identified as insufficient checking of unusual or exceptional states within the GC functions. Successful exploitation could ...

CVE-2026-12300

A memory safety bug exists in Mozilla Firefox and Thunderbird versions earlier than 152.0 . The vulnerability involves operations escaping beyond buffer boundaries in memory, which could allow a remote attacker to access confidential data . To remediate this issue, users should update to the late...

CVE-2026-12321

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of Firefox and Thunderbird . The flaw is attributed to the implementation of incorrect flow control , which could allow a remote attacker to access sensitive data and compromise the integrity of the browser. The is...

CVE-2026-24869

Mozilla Firefox is affected by a use-after-free vulnerability in the Layout: Scrolling and Overflow component. This memory management flaw allows an attacker to exploit the vulnerability to achieve arbitrary code execution on the target system. This issue has been resolved in Firefox version 147....

CVE-2026-2805

CVE-2026-2805 describes an Invalid pointer in the DOM: Core & HTML component affecting Mozilla Firefox and Mozilla Thunderbird. The issue originates from a pointer problem in the DOM Core & HTML, with the vulnerability fixed in version Firefox 148 and Thunderbird 148 . Public CVSS details (CVSS v...

CVE-2026-3845

A heap buffer overflow exists in the Audio/Video: Playback component of the Mozilla Firefox browser for Android . This vulnerability occurs due to a buffer overflow in dynamic memory during playback. A remote attacker could exploit this flaw to achieve arbitrary code execution . The issue is fixe...

CVE-2026-8952

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a privilege escalation flaw within the Application Update component. Insecure management of privileges allows a malicious actor to trigger service interruptions or cause a service failure. The vulnerability aff...

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2020-12412

This CVE (CVE-2020-12412) affects Mozilla Firefox prior to version 70, where navigating a tab via the History API could spoof the address bar to display an incorrect domain (https scheme, blocked port, no lock icon) while the page content is controlled. The vulnerability enables spoofing of the v...

CVE-2025-13012

A race condition in the Graphics component of Mozilla Firefox and Firefox ESR allows an attacker to achieve remote code execution . The vulnerability stems from synchronization errors involving shared resources. Affected versions include Firefox < 145 , Firefox ESR < 140.5 , and Firefox ESR

CVE-2025-8041

Mozilla Firefox for Android versions prior to 141 are vulnerable to a security bypass and UI spoofing issue. The vulnerability stems from the address bar improperly truncating URLs from the end instead of prioritizing the origin. This allows an attacker to bypass security restrictions and spoof t...

CVE-2026-4713

CVE-2026-4713 is a Firefox graphics vulnerability: incorrect boundary conditions in the Graphics component. Affected: Firefox versions before 149 and ESR before 140.9. Mitigation: update to Firefox 149 or ESR 140.9 (patched). Details on exploitability or broader impact are not provided in the sup...

CVE-2009-4129

Technical details about CVE-2009-4129 are not publicly provided in the supplied documents. No concrete information on affected products, versions, impact, or fixes is present here. Monitor for updates from official advisories and vulnerability feeds.

CVE-2017-7760

CVE-2017-7760 affects Mozilla Firefox/Firefox ESR on Windows via the Mozilla Windows Updater and Maintenance Service. The vulnerability stems from the updater reading the original file and applying changes, with a malicious actor able to pass a crafted path to the callback parameter, enabling man...

CVE-2017-7768

CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox

CVE-2021-29958

CVE-2021-29958 affects Firefox for iOS prior to 34. The issue occurs when a download starts without verifying if the browser is in normal or private mode, causing private-mode cookies to be exposed in normal browsing. This is a client-side handling flaw in the download flow that can lead to leaka...

CVE-2025-11708

A Use-after-free vulnerability exists in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox , Firefox ESR , and Thunderbird . This memory safety issue allows a malicious actor to execute arbitrary code . The vulnerability affects Firefox < 144 , Firefox ESR < 140.4 , Thu...

CVE-2025-11709

Mozilla Firefox and Thunderbird are vulnerable to out-of-bounds reads and writes in a privileged process caused by manipulated WebGL textures . The vulnerability exists in the WebGL Texture Handler component, where a compromised web process can trigger memory corruption to execute arbitrary code ...

CVE-2025-8042

Mozilla Firefox for Android is vulnerable to an information disclosure flaw in versions prior to 141 . The root cause is a sandboxed iframe that lacks the allow-downloads attribute but can still initiate downloads, allowing a remote attacker to bypass security restrictions and obtain sensitive in...

CVE-2026-0880

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird due to an integer overflow (numerical overflow). This flaw can allow an attacker to execute arbitrary code on a system or disclose sensitive information. Affected versions include Firefox < 147, ...

CVE-2026-100780

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific technical root cause is not detailed beyond the...

CVE-2026-100808

A mitigation bypass exists in the DOM: Service Workers component of the Mozilla Firefox web browser. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While specific technical root causes are not detailed in the provided documents...

CVE-2026-4702

CVE-2026-4702 is a JIT miscompilation in the JavaScript Engine component. The primary entry states it is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Connected advisories consistently reference the same JIT/memory-safety context across Firefox/Thunderbird relea...

CVE-2026-92040

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird . This flaw was addressed in versions 156 of both products. While the vulnerability is confirmed, specific details regarding the root cause, technical impact, or exploit availability ...

CVE-2026-92063

A Denial-of-service vulnerability exists in the Audio/Video component of Firefox and Thunderbird . This issue has been addressed in Firefox 156 and Thunderbird 156 . While specific technical root causes are not detailed in the provided documents, the vulnerability is confirmed to impact these spe...