CVE-2025-14326

CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird

CVE-2026-0888

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by an information disclosure vulnerability within the XML component . This flaw allows a malicious actor to potentially gain access to confidential data . The vulnerability has been addressed in Firefox 147 and Thun...

CVE-2026-100788

A critical invalid pointer vulnerability exists in the JavaScript: WebAssembly component of several Mozilla products, including Firefox , Firefox ESR , and Thunderbird . Exploitation of this flaw can lead to remote code execution (ACE) , denial of service (DoS) , information disclosure (OSI) , an...

CVE-2026-4690

A sandbox escape vulnerability exists in the XPCOM component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is attributed to incorrect boundary conditions and an integer overflow . This flaw allows an attacker to bypass the sandbox, potentially compromisin...

CVE-2026-100758

A sandbox escape vulnerability exists in the DOM: Navigation component affecting multiple versions of Firefox and Thunderbird . The flaw allows an attacker to escape the sandbox, with potential impacts involving high confidentiality, integrity, and availability. Remediation is available in Firefo...

CVE-2026-100759

A vulnerability exists in the Storage: Quota Manager component due to uninitialized memory . This issue can be exploited remotely to cause a denial of service . Affected products include Mozilla Thunderbird ESR (earlier than 153.4) and various versions of Firefox and Thunderbird . Remediation is ...

CVE-2025-13017

A same-origin policy (SOP) bypass exists in the DOM: Notifications component of Mozilla Firefox and Firefox ESR browsers. An attacker can exploit this vulnerability to remotely bypass existing security restrictions and violate data protection mechanisms. This issue affects Firefox versions prior ...

CVE-2026-100763

Mozilla Firefox and Thunderbird versions earlier than 157 are vulnerable to a heap buffer overflow due to incorrect boundary conditions in the Graphics: WebGPU component. An attacker could exploit this by inducing a user to open an email with a size of 2GB or greater. This vulnerability can lead ...

CVE-2026-100831

A use-after-free vulnerability exists in the DOM: UI Events & Focus Handling component of the Firefox browser. The flaw was addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation instances are provided in the documents.

CVE-2026-12330

The Internationalization component in Mozilla Firefox and Mozilla Thunderbird contains a vulnerability due to incorrect boundary conditions . This issue affects various versions, including Firefox ESR 115.37 , Firefox ESR 140.12 , and Thunderbird 140.12 . Remediation is available in the specified...

CVE-2026-92014

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics component . This issue is addressed in Firefox ESR 115.41 , Firefox ESR 140.16 , and Thunderbird 140.16 . No specific exploit details or in-the-wild exp...

CVE-2026-100764

The Firefox browser is affected by a privilege escalation vulnerability in the Graphics: WebGPU component. The root cause is identified as incorrect boundary conditions . This vulnerability was addressed and fixed in Firefox 157 . Exploitation details and specific attack vectors are not provided ...

CVE-2026-100830

A mitigation bypass vulnerability exists in the DOM: Navigation component of the Mozilla Firefox web browser. This flaw affects multiple versions including Firefox ESR , Thunderbird , and Firefox 157 . The issue has been addressed in the following patched versions: Firefox ESR 153.4 , Thunderbird...

CVE-2026-100757

A use-after-free vulnerability exists in the Widget component of the Firefox web browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Exploitation details are not provided in the documents, but the vulnerab...

CVE-2026-100825

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox web browser. This flaw can potentially lead to significant impacts on confidentiality, integrity, and availability. The issue has been addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit ...

CVE-2026-100765

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Firefox . This flaw was addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details are provided in the documents, but the vulnerability is reported to have a high impact .

CVE-2026-100824

A privilege escalation vulnerability exists in the Places component of the Firefox browser. This flaw was addressed in the release of Firefox ESR 153.4 and Firefox 157 . Specific technical details regarding the root cause are not provided in the documentation. No information regarding active expl...

CVE-2026-100821

A site isolation issue exists in the Panning and Zooming component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in multiple releases, including Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 140.17 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17...

CVE-2026-100766

A vulnerability in the Networking: JAR component of the Firefox web browser allows for information disclosure . This issue has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . The technical details regarding the specific...

CVE-2026-100822

A spoofing issue exists in the Networking: HTTP component of several Mozilla products. This vulnerability impacts Firefox ESR , Firefox , and Thunderbird . The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , Thunderbird 153.4 , and Thunderbird 157 . Specific details regarding the ro...

CVE-2026-100800

The Firefox browser is vulnerable to a sandbox escape caused by a use-after-free flaw in the Disability Access APIs component. This vulnerability allows an attacker to bypass sandbox restrictions, potentially leading to elevated privileges or unauthorized access to system resources. This issue wa...

CVE-2026-100761

A use-after-free vulnerability in the Graphics: WebGPU component of Firefox allows for privilege escalation . This issue was resolved in Firefox 157 . While the specific technical root cause is not detailed in the provided documents, the impact is categorized as high . Information regarding activ...

CVE-2026-100826

A Denial-of-service vulnerability exists in the Storage: StorageManager component of the Firefox browser. The issue was addressed in Firefox ESR 153.4 and Firefox 157 . No specific root cause or exploit details are provided in the documents, and no information regarding in-the-wild exploitation i...

CVE-2026-100804

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free flaw in the Preferences: Backend component. This issue allows for potential sandbox circumvention, and the vulnerability was resolved in Firefox 157 . No specific exploit details or in-the-wild exploitati...

CVE-2026-100789

A use-after-free vulnerability exists in the Graphics: Canvas2D component of the Firefox browser. This issue has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific root cause is not detailed, the vulnera...

CVE-2026-100791

The DOM: Core & HTML component in the Firefox browser is vulnerable to a use-after-free memory safety issue (CVE-2026-100791 ). This vulnerability has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit ...

CVE-2026-100798

A cryptography misuse vulnerability exists in the Storage: Quota Manager component of certain Mozilla products. The issue involves a missing cryptographic step (CWE-325), potentially impacting data security. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbir...

CVE-2026-100801

A privilege escalation vulnerability exists in the DLL Services component of the Firefox browser. The vulnerability has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific root cause, exploit details, or in-the-wild exploitation information are provided in the...

CVE-2026-100794

A sandbox escape vulnerability exists in the Internationalization component due to incorrect boundary conditions. This flaw affects Mozilla Firefox , Firefox ESR , and Thunderbird products. The vulnerability could allow an attacker to bypass security restrictions. Remediation is available in Fire...

CVE-2026-100793

The JavaScript Engine component in Thunderbird and Firefox is vulnerable to a JIT miscompilation issue. JIT (Just-In-Time) is a performance optimization method that compiles code during execution. This vulnerability impacts versions prior to 157 . To remediate this issue, users should update Thun...

CVE-2026-100803

A same-origin policy bypass vulnerability exists in the WebExtensions component of Mozilla products. This flaw impacts several versions of Firefox (including ESR 115.42, 140.17, and 153.4) and Thunderbird (including 140.17, 153.4, and 157). The vulnerability was addressed in the following fixed v...

CVE-2026-100805

The Firefox web browser is affected by a race condition and use-after-free vulnerability within its Audio/Video component . This security flaw was addressed and fixed in Firefox 157 . No specific exploitation details or in-the-wild instances are provided in the documents.

CVE-2026-100796

The Firefox browser is affected by a use-after-free vulnerability within the JavaScript: WebAssembly component. This flaw was addressed in Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documentation.

CVE-2026-100806

The Firefox browser is affected by a vulnerability involving uninitialized memory within the Graphics: WebGPU component. This flaw was addressed in the release of Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-100802

The Graphics: WebGPU component in Firefox is affected by a vulnerability involving uninitialized memory . This issue was addressed and fixed in Firefox 157 . No specific exploit information or direct links to in-the-wild exploitation are provided in the documents.

CVE-2026-100797

A use-after-free vulnerability in the Graphics: WebRender component of the Firefox browser can lead to privilege escalation . This issue has been addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the vulnerability is doc...

CVE-2026-100807

A privilege escalation vulnerability exists in the DOM: Service Workers component of the Firefox web browser. This flaw allows for an escalation of privileges within the browser environment. The vulnerability has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No spec...

CVE-2026-100792

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of several Mozilla products. This flaw can be exploited remotely to achieve Arbitrary Code Execution (ACE) , Obtain Sensitive Information (OSI) , Denial of Service (DoS) , and Security Bypass (SB) . The vulnerabili...

CVE-2026-100790

A use-after-free vulnerability exists in the XSLT component of the Firefox browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit information or manual workaround details are provided in t...

CVE-2026-100795

A Denial-of-service vulnerability exists in the Networking component of the Firefox browser. This issue was addressed and resolved in Firefox 157 . No specific root cause details, exploit vectors, or in-the-wild exploitation evidence are provided in the documentation.

CVE-2026-100799

A vulnerability exists in the Graphics: WebGPU component due to uninitialized memory . This issue has been resolved in Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documentation.