1883 matches found
CVE-2026-4692
This CVE (CVE-2026-4692) is a confirmed issue in the Responsive Design Mode component, leading to sandbox escape. The primary affected product is Mozilla Firefox (and related ESR builds) with versions prior to the fixed releases: Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9; Thunderbird...
CVE-2026-6774
CVE-2026-6774 is a mitigation bypass in the DOM: Security component that affects Firefox and Thunderbird. The issue is described as a bypass of mitigation in the DOM security stack and was fixed in Firefox 150 and Thunderbird 150. The provided metadata indicates a CVSS v3.1 base score of 5.4 (Med...
CVE-2026-6775
CVE-2026-6775: Affects the WebRTC component with incorrect boundary conditions. Urban/Thunderbird users should upgrade to Firefox 150 and Thunderbird 150 where the issue is fixed. The vulnerability entry specifies this CVE’s root cause and that remediation is through upgrading to the listed versi...
CVE-2026-74935
Mozilla Firefox's DOM Networking component has a privilege escalation flaw, scoring CVSS 8.8 (HIGH). An attacker can trigger it via a malicious webpage (network vector, low complexity). Affected users should upgrade to Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1. No in-the-wild exploitation...
CVE-2026-75874
A critical (CVSS 10.0) sandbox escape in Firefox and Thunderbird's Remote Settings Client component allows remote, unauthenticated attackers to break out of the application sandbox and achieve full system compromise. No exploitation has been reported, but the flaw affects any Firefox/Thunderbird ...
CVE-2026-8958
This CVE affects the Firefox Security: Process Sandboxing component and related Thunderbird variants, causing information disclosure and sandbox escape. The NVD/NVDC and CVE records state fixes in Firefox 151 and Firefox ESR 140.11, and in Thunderbird 151 and 140.11, addressing the underlying san...
CVE-2025-14327
CVE-2025-14327 is a spoofing vulnerability in the Downloads Panel component affecting Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird
CVE-2026-16357
CVE-2026-16357 is a Mozilla Firefox/Firefox ESR vulnerability caused by incorrect boundary conditions in the Graphics component. Affected product: Firefox and Firefox ESR. The issue is tracked with a CVSS 3.1 base score of 9.8 (CRITICAL) with network attack vector, no user interaction, and possib...
CVE-2026-2760
CVE-2026-2760 is a Firefox/Thunderbird Firefox Graphics: WebRender sandbox escape caused by incorrect boundary conditions. Multiple public advisories confirm the issue and that it is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected comp...
CVE-2026-2780
CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...
CVE-2026-2782
CVE-2026-2782 affects Firefox (Netmonitor component) and is fixed in Firefox 148 and Firefox ESR 140.8, also addressed in Thunderbird 148/140.8. The connected sources corroborate privilege-escalation via Netmonitor across Mozilla products and note remediation as upgrading to Firefox 148+/Thunderb...
CVE-2026-2799
CVE-2026-2799 is a use-after-free vulnerability in the DOM: Core & HTML components of Mozilla Firefox and Thunderbird. The issue, identified across multiple advisories, is resolved in Firefox 148 and Thunderbird 148. Public exploit activity is noted in connected sources. Affected products include...
CVE-2026-5734
CVE-2026-5734 involves memory safety bugs in Mozilla products. Affected: Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. The issue is addressed by fixes in Firefox 14...
CVE-2025-10531
CVE-2025-10531 : Affects Firefox < 143 and Thunderbird
CVE-2026-2779
CVE-2026-2779 covers incorrect boundary conditions in Networking: JAR within Firefox (and Firefox ESR). Public advisories indicate the issue affects Firefox before version 148 and Firefox ESR before 140.8, with Firefox 148/ESR 140.8 and Thunderbird updates mitigating it. The connected Amazon Linu...
CVE-2026-8948
CVE-2026-8948: A same-origin policy bypass in the DOM: Networking component affecting Firefox and Thunderbird; fixed in Firefox 151 and Thunderbird 151. CVSS 3.1: 9.1 (CRITICAL), attack vector NETWORK, complexity LOW, no user interaction. No exploitation details provided in the documents. Remedia...
CVE-2026-8975
CVE-2026-8975 covers memory-safety bugs in Thunderbird 140.10 and Thunderbird 150, with evidence that some flaws could be exploited to run arbitrary code. The fixed versions are Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Affected products documen...
CVE-2026-12328
CVE-2026-12328 pertains to memory safety bugs in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed memory corruption and could potentially be exploited to run arbitrary code. Remediations are available: Firefox 152, Firefox ESR 140....
CVE-2026-2762
CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...
CVE-2026-57962
CVE-2026-57962 affects Thunderbird’s LDAP address-book autocomplete. A malicious LDAP server can cause the Thunderbird LDAP client to stash attacker-supplied data, enabling memory exhaustion and a denial of service. Root cause is unbounded data processing by the LDAP client when queried by the Th...
CVE-2026-16363
The CVE-2026-16363 entry describes a JIT miscompilation vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox. Affected product is Firefox and Firefox ESR; the root cause is a miscompilation in the JavaScript/WebAssembly engine. The vulnerability is rated critical (CVSS v3.1: ...
CVE-2026-2775
CVE-2026-2775 is a mitigation bypass in the DOM: HTML Parser component. The initial description states a fix in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux bulletin and Amazon Linux advisories) reiterate the same mitig...
CVE-2026-8956
The CVE-2026-8956 issue is an integer overflow in the Networking: JAR component. Affected products include Firefox (includes Firefox 151 and Firefox ESR 140.11) and Thunderbird (incl. Thunderbird 151 and Thunderbird 140.11). The root cause is an integer overflow within the JAR networking module, ...
CVE-2026-8957
CVE-2026-8957 involves a privilege-escalation issue in Mozilla Firefox/Thunderbird’s Enterprise Policies component. Affected products include Firefox and Thunderbird, with fixes in Firefox 151 and Firefox ESR 140.11 (and corresponding Thunderbird updates 151/140.11). The vulnerability details in ...
CVE-2026-8974
CVE-2026-8974 concerns memory-safety bugs in Thunderbird 140.10 and Thunderbird 150 that could enable arbitrary code execution; fixes are available in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Multiple vendor advisories (e.g., openSUSE SUSE 10813-1, Slackware advis...
CVE-2025-14322
CVE-2025-14322: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Affected software: Firefox versions before 146 and ESR before 115.31 and 140.6. The issue is described across multiple advisories (ALAS2023-2025-1337, ALAS2FIREFOX-2025-049, ALSA-2025:23128...
CVE-2026-0885
CVE-2026-0885 is a use-after-free in Firefox/Thunderbird’s JavaScript: GC component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird
CVE-2026-16372
CVE-2026-16372 — Privilege escalation in the DOM: Content Processes component. Affected products: Firefox and Thunderbird. The provided documents do not reveal the exact root cause or vulnerable files. CVSS 3.1 base score 8.8 (HIGH) with Network access, no privileges required, user interaction ne...
CVE-2026-4710
CVE-2026-4710 is an Audio/Video boundary-conditions flaw that affects Firefox (including ESR) and Thunderbird. The issue’s root cause is incorrect boundary handling in the Audio/Video component. Public advisories list the impact as high/critical, with CVSS 3.1 base score 9.8 (Impact: Confidential...
CVE-2026-74987
CVE-2026-74987 covers internally discovered bugs in Thunderbird ESR 140.13 , Thunderbird ESR 153.0 , and Thunderbird 153 , with some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes that with sufficient effort some could have been exploited. The CVSS 3.1 ...
CVE-2025-10528
CVE-2025-10528 is a sandbox escape in Mozilla Firefox/Thunderbird caused by undefined behavior due to an invalid pointer in Graphics: Canvas2D. Affected products include Firefox < 143 and Firefox ESR < 140.3, Thunderbird < 143 and Thunderbird
CVE-2025-14324
CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird
CVE-2026-12314
CVE-2026-12314 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird addressed by updates to Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s advisory confirms Firefox ESR 140.12.0esr-1~deb13u1 fixes the issue for firefox-esr in the stable trixie packag...
CVE-2026-12327
CVE-2026-12327 relates to memory safety bugs in Mozilla products: Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The issue was fixed in Firefox 152, Firefox ESR ...
CVE-2026-16392
CVE-2026-16392 concerns a JIT miscompilation in the JavaScript Engine: JIT component. Multiple connected advisories indicate this issue affects Firefox/Thunderbird releases prior to version 153 and has been fixed in Firefox 153 and Thunderbird 153. Public details in the provided documents specify...
CVE-2026-2777
CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...
CVE-2026-2788
CVE-2026-2788 concerns incorrect boundary conditions in the Audio/Video: GMP component of Mozilla Firefox. Public advisories (e.g., Firefox/Firefox ESR updates in Firefox 148, ESR 115.33, ESR 140.8) and downstream Debian/AlmaLinux advisories confirm the fix was applied in those versions. Connecte...
CVE-2026-3889
CVE-2026-3889 is a spoofing vulnerability in Thunderbird. The issue affects Thunderbird releases earlier than 149 and earlier than 140.9 and could enable spoofing via malformed strings from a mail server. Mozilla fixed the vulnerability in Thunderbird 149 and Thunderbird 140.9; affected users sho...
CVE-2026-57963
The CVE-2026-57963 issue affects chat UI in Thunderbird where an attacker able to send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Underlying risk is manipulation of the chat interface and potential phishing wi...
CVE-2026-74938
A mitigation bypass in the JavaScript: GC component of Firefox and Thunderbird allows remote attackers to bypass memory-protection mitigations, potentially leading to arbitrary code execution. CVSS 9.1 (CRITICAL). Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1 . S...
CVE-2026-74990
CVE-2026-74990 affects Thunderbird ESR 140.13, ESR 153.0, and Thunderbird 153, where internally found bugs showed evidence of memory corruption or security-relevant defects. Mozilla assesses that, with enough effort, some could have been exploitable, scoring it Critical (CVSS 9.8). The vulnerabil...
CVE-2025-10532
CVE-2025-10532 involves incorrect boundary conditions in the JavaScript: GC component affecting Firefox and Thunderbird products. Affected versions: Firefox and Thunderbird before 143, and ESR before 140.3. Connected advisories indicate fixes released as Firefox/Thunderbird updates (e.g., Firefox...
CVE-2025-11712
The CVE-2025-11712 entry is supported by connected documents describing the same issue across Mozilla products. Affected software for this CVE includes Firefox and Thunderbird prior to version 144 (Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, Thunderbird
CVE-2025-14331
CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and
CVE-2026-12316
CVE-2026-12316 describes a mitigation bypass in the DOM: Security component that was fixed in Mozilla Firefox 152 and Thunderbird 152. The connected documents confirm that this is a software-level patch by Mozilla, addressing a DOM-related security bypass. The vulnerability details in the public ...
CVE-2026-16369
CVE-2026-16369 : Integer overflow in the JavaScript: WebAssembly component of Mozilla Firefox. Affected: Firefox browser (WebAssembly/JavaScript engine). Root cause: integer overflow. Impact: fixed in Firefox 153 and Firefox ESR 140.13. Mitigation: upgrade Firefox to 153 (or ESR 140.13) to apply ...
CVE-2026-2787
CVE-2026-2787 is a use-after-free in the DOM: Window and Location component, with fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources corroborate the issue in Firefox-related components and list the affected products as Firefox/Th...
CVE-2026-8970
The CVE describes a privilege-escalation in the Firefox Security component. Concrete detail from sources: the flaw is fixed in Firefox 151 and Firefox ESR 140.11. Affected scope is stated only as the Security component; no deeper root cause, affected subcomponents, or explicit exploit paths are p...