1962 matches found
CVE-2026-74988
Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Fire...
CVE-2026-4723
CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox
CVE-2026-5733
CVE-2026-5733 affects Firefox and Thunderbird via the Graphics: WebGPU component due to incorrect boundary conditions. The vulnerability is a buffer overflow that can lead to arbitrary code execution or application crashes, as stated in multiple sources. Affected products are Firefox and Thunderb...
CVE-2026-74936
A use-after-free in the JavaScript: WebAssembly component of Firefox/Thunderbird can lead to memory corruption and arbitrary code execution. CVSS 9.8 (network, no auth required). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, and 153.1; Debian and Slackware packages updated...
CVE-2026-74963
Firefox and Thunderbird suffer a same-origin policy bypass in their Networking: Cookies component, allowing cross-origin access to cookies. CVSS 5.4 (Medium). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, 153.1. No in-the-wild exploitation reported; user interaction requir...
CVE-2026-74972
Information disclosure in Firefox/Thunderbird's DOM: Push Subscriptions component exposes sensitive data to malicious sites. CVSS 4.3 (MEDIUM), network-reachable with user interaction required. Fixed in Firefox 154, ESR 140.14/153.1, Thunderbird 154/140.14/153.1. No in-the-wild exploitation repor...
CVE-2026-74976
CVE-2026-74976 is a JIT miscompilation in the JavaScript Engine: JIT component of Mozilla Firefox and Thunderbird. The vulnerability can lead to high confidentiality impact (information disclosure) with no integrity or availability impact, per the CVSS 3.1 score of 6.5 (MEDIUM) . Attack requires ...
CVE-2026-74942
A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...
CVE-2026-74973
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74974
The vulnerability is a same-origin policy bypass in the Graphics: ImageLib component of Firefox and Thunderbird. Affected versions include Firefox ESR 140.13, ESR 153.0, and Thunderbird ESR 140.13, ESR 153.0. Remediation is to upgrade to Firefox ESR 140.14, ESR 153.1, Thunderbird 140.14, or Thund...
CVE-2026-74968
Firefox's WebRender component has a site isolation flaw allowing cross-site data access or tampering, rated CVSS 5.4 (Medium). Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported. Users should update immediately. Mozilla advisories: mfsa2026-74, mfsa2026-77.