CVE-2026-16399

Technical details about CVE-2026-16399 are not publicly available in the provided documents. The sources summarize a site isolation issue in the DOM: Navigation component with Firefox fix in version 153. Monitor for updates.

CVE-2026-74952

Mozilla Firefox's Application Update component is affected by a privilege escalation flaw rated CVSS 8.8 (HIGH), exploitable remotely with no privileges but requiring user interaction. The vulnerability allows full confidentiality, integrity, and availability impact. It is fixed in Firefox 154 , ...

CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of Firefox and Thunderbird. CVSS 8.8 (HIGH) with network attack vector, no privileges required and user interaction needed. CISA reports no known exploitation. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbir...

CVE-2025-11713

CVE-2025-11713: Potential user-assisted code execution via the Copy as cURL feature. Affected products per the sources include Firefox versions prior to 144, Firefox ESR prior to 140.4, Thunderbird versions prior to 144, and Thunderbird prior to 140.4. Root cause: insufficient escaping in the Cop...

CVE-2025-11715

CVE-2025-11715 is part of a family of memory-safety issues affecting Mozilla Firefox and Thunderbird. Connected sources confirm memory safety bugs and memory corruption with potential to execute arbitrary code, affecting Firefox/Thunderbird and their ESR releases prior to version 144 (and ESR 140...

CVE-2026-12300

CVE-2026-12300 describes a memory-safety issue that was fixed in Firefox 152 and Thunderbird 152. The available sources confirm the affected products are Mozilla Firefox/Thunderbird, with the underlying problem labeled as a memory safety bug. The CVSS metrics in the initial document indicate a ba...

CVE-2026-16402

CVE-2026-16402 describes an integer overflow in the Graphics: ImageLib component. The vulnerability is confirmed across multiple advisories and vendors (SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, CVE.org, etc.). The issue is fixed in Firefox version 153. The available connected sources do not provide...

CVE-2026-4685

Summary: CVE-2026-4685 concerns the Graphics: Canvas2D component with incorrect boundary conditions. Affects Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9. Root cause described as incorrect boundary conditions in the Canvas2D implementation. References include ...

CVE-2026-4714

CVE-2026-4714 is an Audio/Video boundary-condition vulnerability present in Mozilla Firefox/Thunderbird stack. The initial entry states impact as high (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 3.1 base 7.5) with exploitation not described in the sources. Connected advisories confirm the issue af...

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2026-74944

CVE-2026-74944 is a use-after-free in Firefox/Thunderbird's DOM: Core & HTML component, rated Critical (CVSS 9.8, network-exploitable, no auth or user interaction required). It enables arbitrary code execution, privilege escalation, and information disclosure. Affected versions: Firefox <154, ...

CVE-2025-14744

CVE-2025-14744 concerns Unicode RTLO spoofing in Firefox for iOS prior to version 144.0. The issue allows a malicious website to render spoofed filenames in the downloads UI, potentially misleading users into saving files with an unintended file type. Affected product: Firefox for iOS

CVE-2025-55030

CVE-2025-55030 concerns Firefox for iOS where a mis-handling of the Content-Disposition header (Attachment) allows inline content display and potential XSS. Affected: Firefox for iOS versions prior to 142. Root cause: improper handling of the Content-Disposition header for certain MIME types. Imp...

CVE-2026-12321

Summary: CVE-2026-12321 is a JIT miscompilation in the JavaScript: WebAssembly component. Affected products: Firefox and Thunderbird (WebAssembly/JS engine). Root cause: JIT miscompilation in the WebAssembly component. Impact: Not explicitly quantified beyond miscompilation; CVSS v3.1 base score ...

CVE-2026-4717

CVE-2026-4717: Privilege escalation in the Netmonitor component. According to the provided advisories, Firefox and Firefox ESR are affected and the issue is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability originated in the Netmonitor component an...

CVE-2026-74962

CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...

CVE-2026-74983

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-8967

CVE-2026-8967 affects Mozilla graphics stack via the Graphics: WebGPU component, leading to information disclosure. Public documentation in connected sources indicates the vulnerability was fixed in Firefox 151 and Thunderbird 151, with affected products listed as Mozilla Thunderbird and Mozilla ...

CVE-2025-11718

CVE-2025-11718 affects Mozilla Firefox versions earlier than 144. The issue allows a malicious page to spoof the address bar by creating a fake bar in response to a visibilitychange event when the Android address bar is hidden after scrolling. Impact is spoofing UI and potential user deception; n...

CVE-2025-14326

CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird

CVE-2026-16376

CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Firefox. Affected software refers to Mozilla Firefox before version 153, where the issue was fixed in Firefox 153. The available sources confirm a DoS impact in the Graphics: WebGPU pipeline but do not provid...

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-16409

CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....

CVE-2026-4687

CVE-2026-4687 describes a sandbox-escape vulnerability in the Mozilla Firefox/Thunderbird Telemetry component caused by incorrect boundary conditions. Connected advisories confirm the issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9, Thunderbird 149 and Thunderbird 140.9, with related e...

CVE-2026-4707

CVE-2026-4707 is a vulnerability in the Graphics: Canvas2D component caused by incorrect boundary conditions. It affects Firefox (pre-149), Firefox ESR (pre-115.34 and pre-140.9) and is also listed similarly in related advisories. The issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9. If...

CVE-2026-4712

The CVE covers an information-disclosure vulnerability in the Widget: Cocoa component affecting Firefox before 149 and Firefox ESR before 140.9. Affected product/component: Firefox/Firefox ESR on Cocoa widgets; vulnerability details (root cause, exploitability) are not provided in the supplied do...

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2026-74953

Firefox's Networking: Cookies component has a privilege escalation flaw. Exploitation requires user interaction (CVSS 8.8 HIGH). Patch available in Firefox 154, ESR 140.14, and ESR 153.1. No in-the-wild exploitation reported; root cause not specified in documents.

CVE-2025-13017

Mode C: CVE-2025-13017 is a same-origin policy bypass in the DOM: Notifications component, affecting Firefox before 145 (and ESR before 140.5) and Thunderbird before 145 (and ESR before 140.5). Connected advisories confirm this CVE alongside other Firefox DOM/JSWA issues and list concrete mitigat...

CVE-2026-0889

CVE-2026-0889 describes a Denial-of-Service in the DOM: Service Workers component, affecting Mozilla Firefox and Mozilla Thunderbird versions earlier than 147. The CVE’s publicly documented impact is DoS with the DOM Service Workers, and the related advisory notes advise updating to the latest ve...

CVE-2026-4709

CVE-2026-4709 involves Firefox and Thunderbird components, specifically an incorrect boundary condition in the Audio/Video: GMP path. The vulnerability affects Firefox and Thunderbird releases prior to the fixes, with patches noted in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149 and...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2026-74961

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74967

Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...

CVE-2026-16397

CVE-2026-16397 describes a clickjacking vulnerability in the WebExtensions component of Firefox for Android. The issue affects the WebExtensions surface and was addressed with a product update, fixed in Firefox 153. The CVSS 3.1 vector indicates network access, low attack complexity, no privilege...

CVE-2026-6781

CVE-2026-6781 is a denial-of-service vulnerability in the Mozilla Firefox/Thunderbird Audio/Video: Playback component. The issue is fixed in Firefox 150 and Thunderbird 150. Affected products are Firefox and Thunderbird; the root cause is described only as a DoS in the playback component, with no...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-4690

Summary of CVE-2026-4690 : A sandbox escape caused by incorrect boundary conditions and an integer overflow in the XPCOM component. This affects Firefox and related ESR branches prior to fixed versions. The public advisories indicate the issue is addressed in Firefox 149, ESR 115.34, and ESR 140....

CVE-2026-6756

CVE-2026-6756 is a mitigation bypass in Firefox for Android that was fixed in Firefox 150 . The connected documents confirm a version upgrade as remediation, with Fedora advisories and other feeds listing Firefox 150 as the patched release. The exact affected component(s) or root cause details ar...

CVE-2026-0888

CVE-2026-0888 relates to information disclosure in the XML component in Mozilla Firefox and Thunderbird prior to version 147. Affected products include Firefox < 147 and Thunderbird

CVE-2026-16394

CVE-2026-16394 describes a mitigation bypass in the DOM: Security component of the Firefox browser. The issue is reported as affecting the DOM/Security component and has been fixed in Firefox 153. The CVSS 3.1 vector indicates Network attack vector, low complexity, no privileges required, with us...

CVE-2026-4697

CVE-2026-4697 concerns incorrect boundary conditions in the Audio/Video: Web Codecs component. Public advisories list affected products as Firefox (pre-149 and ESR 140.9), and Thunderbird alongside Firefox fixes. The issue is defined as a boundary-condition flaw in the WebCodecs path, with fixed ...

CVE-2026-74946

A privilege escalation flaw in Firefox/Thunderbird's Graphics: CanvasWebGL component stems from incorrect boundary conditions. CVSS 8.8 (HIGH) with no privileges required and user interaction needed. Patched in Firefox 154, ESR 115.39/140.14/153.1, and Thunderbird 154/140.14/153.1. No active expl...

CVE-2026-74969

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74971

Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...

CVE-2026-74989

Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

CVE-2026-4723

CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox

CVE-2026-5733

CVE-2026-5733 affects Firefox and Thunderbird via the Graphics: WebGPU component due to incorrect boundary conditions. The vulnerability is a buffer overflow that can lead to arbitrary code execution or application crashes, as stated in multiple sources. Affected products are Firefox and Thunderb...