CVE-2025-8043

Mozilla Firefox and Thunderbird are vulnerable to a security flaw where URLs are incorrectly truncated toward the beginning instead of around the origin. This vulnerability exists in products earlier than version 141 . Potential impacts include security bypass , spoofing the user interface , and ...

CVE-2026-0879

This vulnerability involves a sandbox escape caused by incorrect boundary conditions within the Graphics component of Mozilla products. Impacted software includes Firefox , Firefox ESR , and Thunderbird . Exploitation of this flaw can allow an attacker to execute arbitrary code or cause the appli...

CVE-2026-0886

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability in the Graphics component caused by incorrect boundary conditions . This flaw can lead to memory operations outside of the buffer , potentially allowing a remote attacker to compromise the confidentiality of protected...

CVE-2026-2798

A use-after-free vulnerability exists in the DOM: Core & HTML components of the Mozilla Firefox web browser and Mozilla Thunderbird email client. This flaw allows for the reuse of memory after it has been freed, which can be exploited by a remote attacker to trigger service interruptions or failu...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-3846

Mozilla Firefox versions prior to 148.0.2 are vulnerable to a Same-Origin Policy (SOP) bypass within the CSS Parsing and Computation component. The root cause is attributed to a lack of verification regarding the reliability of data sources or messages, which allows attackers to bypass existing s...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2011-3003

CVE-2011-3003 affects Mozilla Firefox < 7.0 and SeaMonkey

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2023-37455

The CVE-2023-37455 vulnerability affects Firefox for iOS prior to version 115. A permission-request prompt shown in a background tab overlays the foreground tab, potentially confusing users or leading to unintended interactions. Root cause: UI prompt handling in background context allows overlay ...

CVE-2025-10528

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape due to undefined behavior and an invalid pointer within the Graphics: Canvas2D component. This flaw allows an attacker to bypass the sandbox, potentially leading to privilege escalation. The vulnerability affects v...

CVE-2025-11712

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by CVE-2025-11712 , where a malicious page can use the type attribute of an OBJECT tag to override default browser behavior when encountering a web resource served without a content-type header. This flaw could lead to Cross-Site Script...

CVE-2026-100814

The Firefox browser is affected by a vulnerability caused by incorrect boundary conditions within the JavaScript Engine: JIT component. This flaw allows for potential exploitation through the Just-In-Time compiler. Remediation is available in Firefox ESR 153.4 and Firefox 157 . No specific exploi...

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-4716

CVE-2026-4716 is a boundary-condition and uninitialized-memory issue in the JavaScript Engine. Connected advisories associate it with Firefox/Thunderbird, stating it affects Firefox < 149 and Firefox ESR

CVE-2026-8960

A spoofing issue in the WebExtensions component of the Firefox web browser and Thunderbird email client allows a malicious actor to bypass authentication processes through spearfishing . Exploiting this vulnerability enables remote compromise of data integrity . The issue was resolved in Firefox ...

CVE-2025-6428

Mozilla Firefox for Android is vulnerable to an open redirect vulnerability. The issue occurs when the browser processes a querystring parameter containing a link; instead of following the intended destination, the browser follows the URL provided in the query string. This flaw can be exploited b...

CVE-2026-100783

A high-impact uninitialized memory vulnerability exists in the Audio/Video component of Firefox . This flaw was addressed in several versions, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the uninitiali...

CVE-2026-100820

A privilege escalation vulnerability exists in the Address Bar component of the Firefox web browser. This flaw allows for elevated privileges during use. The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitat...

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2026-4704

Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) affects Firefox/Firefox ESR and Thunderbird prior to fixed versions. Multiple documents confirm the issue and indicate fixes in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is associa...

CVE-2026-4705

CVE-2026-4705 is an undefined-behavior issue in the WebRTC: Signaling component. Public disclosures in the initial document indicate the vulnerability affected Firefox and Thunderbird products, with patches delivered in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The accompanying connect...

CVE-2026-8964

A spoofing issue exists in the Popup Blocker component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from the false representation of critical information within the user interface, which could allow a remote malicious actor to compromise data in...

CVE-2026-8965

The Firefox web browser and Thunderbird email client are affected by an information disclosure vulnerability within the DOM: Security component . This flaw allows a remote attacker to gain unauthorized access to confidential data . The vulnerability has been addressed in versions 151 of both Mozi...

CVE-2026-8967

The Firefox web browser and Thunderbird email client are vulnerable to an information disclosure vulnerability within the Graphics: WebGPU component. This flaw allows a remote attacker to gain access to confidential data . The issue was addressed in Firefox 151 and Thunderbird 151 . No specific e...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2017-7761

Summary: CVE-2017-7761 affects Firefox on Windows (Firefox ESR < 52.2 and Firefox

CVE-2025-11717

CVE-2025-11717 affects Mozilla Firefox versions earlier than 144. The issue occurs when switching between Android apps via the card carousel, causing a black screen for the card image if a password-related screen was the last used; before 144, the password edit screen was visible. Practical impac...

CVE-2025-13019

A same-origin policy bypass exists in the DOM: Workers component of Mozilla Firefox and Firefox ESR . This vulnerability allows an attacker to remotely bypass existing security restrictions. Affected versions include Firefox < 145 and Firefox ESR

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-100784

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Firefox browser. This flaw has a high impact and was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Specific details regarding the root ca...

CVE-2026-100786

A sandbox escape vulnerability exists in the Graphics component of the Firefox browser due to a use-after-free condition. This flaw was addressed in multiple releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or external...

CVE-2026-100815

A use-after-free vulnerability exists in the CSS Parsing and Computation component of the Firefox browser. This flaw was addressed and fixed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation records are provided in the documents.

CVE-2026-6780

The Audio/Video: Playback component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an uncontrolled resource consumption issue within the playback functions, which can be exploited by an attacker to trigger service interruptions . Th...

CVE-2017-5452

CVE-2017-5452 affects Firefox for Android prior to version 53. The issue allows a spoofed address bar on a page when the new page’s location bar is scrolled out of view if an HTML editable element is user-selected. Remediation per the advisory is upgrading to Firefox 53 or newer (the fixed versio...

CVE-2025-10537

Mozilla Firefox and Thunderbird are affected by memory safety bugs that exhibit evidence of memory corruption . These vulnerabilities could potentially be exploited to execute arbitrary code or cause service interruptions by performing operations outside of the buffer in memory. The affected vers...

CVE-2025-11711

This vulnerability exists in Mozilla Firefox and Thunderbird due to a flaw that allows an attacker to modify the values of JavaScript Object properties that are intended to be non-writeable. Affected versions include Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird &...

CVE-2025-13024

Mozilla Firefox and Thunderbird are affected by a JIT miscompilation vulnerability within the JavaScript Engine: JIT component . This flaw arises from a compilation error that allows operations to be executed beyond memory buffer boundaries. A remote attacker can exploit this vulnerability to ach...

CVE-2026-0887

CVE-2026-0887 involves a clickjacking issue and information disclosure within the PDF Viewer component of Mozilla products. This vulnerability impacts Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird versions prior to 140.7. Ex...

CVE-2026-100813

The Firefox web browser is affected by an invalid pointer vulnerability within the JavaScript Engine: JIT component . This flaw was addressed in Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-4686

CVE-2026-4686 targets the Graphics: Canvas2D component. The root cause is incorrect boundary conditions, exposed in Firefox versions prior to 149, Firefox ESR prior to 115.34, and Firefox ESR prior to 140.9. The connected sources confirm the affected products and versions without detailing exploi...

CVE-2026-4696

The CVE-2026-4696 entry describes a Use-after-free in Firefox’s Layout: Text and Fonts component. Affected products are Firefox versions newer than? actually older than 149 for Firefox, and ESR variants: <115.34 and