CVE-2026-12308

A memory safety bug has been identified and fixed in Mozilla Thunderbird 152 and Firefox 152 , along with several Extended Support Release (ESR) versions including Firefox ESR 140.12 and Thunderbird 140.12 . The vulnerability is associated with the Thunderbird client and the Firefox web browser. ...

CVE-2026-16386

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-2782

CVE-2026-2782 affects Firefox (Netmonitor component) and is fixed in Firefox 148 and Firefox ESR 140.8, also addressed in Thunderbird 148/140.8. The connected sources corroborate privilege-escalation via Netmonitor across Mozilla products and note remediation as upgrading to Firefox 148+/Thunderb...

CVE-2004-0909

Mozilla Firefox prior to the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 are affected by CVE-2004-0909. The issue allows remote attackers to trick users into performing unintended actions, including software installation, via signed scripts that request enhanced abilities us...

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2011-2987

The connected documents confirm CVE-2011-2987 is a heap overflow in the ANGLE library used by Mozilla’s WebGL implementation (Firefox/SeaMonkey/related) that could allow remote code execution. The issue is tied to the ANGLE heap overflow in WebGL code paths; exploitation would be via remote attac...

CVE-2026-12309

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause is not detailed beyond a memory safety issue, the vulnera...

CVE-2026-12314

A memory safety bug was identified and fixed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause for CVE-2026-12314 is not detailed beyond its classification as a memory safety issue, several connected documents indicate that si...

CVE-2026-16366

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16370

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-6782

The Firefox web browser and Thunderbird email client are susceptible to an information disclosure vulnerability in the IP Protection component . This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploitat...

CVE-2026-74948

A vulnerability in the Graphics component of Mozilla Firefox and Thunderbird leads to information disclosure . This issue has been addressed in several releases, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunde...

CVE-2026-84124

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird software. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The vulnerability has been addressed in the following versions: Firefo...

CVE-2026-8956

An integer overflow vulnerability exists in the Networking: JAR component of the Firefox web browser and the Thunderbird email client. Exploiting this numerical overflow condition can allow a remote attacker to cause service interruptions . The vulnerability has been addressed in Firefox 151 , Fi...

CVE-2005-0149

CVE-2005-0149 affects Thunderbird 0.6–0.9 and Mozilla 1.7–1.7.3: cookies in mail messages are not blocked by the network.cookie.disableCookieForMailNews preference, allowing a remote attacker to bypass the user’s cookie policy via HTTP content in emails. Connected advisories confirm multiple vend...

CVE-2011-2992

CVE-2011-2992 affects the Ogg reader in the browser engine of Mozilla Firefox (4.x–5) and SeaMonkey (2.x up to 2.3) and possibly other products, causing memory corruption and potential denial of service or arbitrary code execution via unspecified vectors. The root cause is memory safety issues in...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2026-16359

The Audio/Video: GMP component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw can lead to security risks, including potential arbitrary code execution, as indicated by related security advisories. The vulnerability has been addressed in Firefox 153 , Firefox...

CVE-2026-16388

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2767

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox/Thunderbird. Affected products include Firefox (Desktop) and Thunderbird with the WebAssembly implementation; the issue is addressed by fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-2775

CVE-2026-2775 is a mitigation bypass in the DOM: HTML Parser component. The initial description states a fix in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux bulletin and Amazon Linux advisories) reiterate the same mitig...

CVE-2026-74973

A race condition and use-after-free vulnerability exists in the Graphics component of Firefox and Thunderbird . This flaw affects several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , and the corresponding versions of Thunderbird . Remediation is ...

CVE-2026-74982

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-8957

A privilege escalation vulnerability exists in the Enterprise Policies component of Mozilla Firefox and Thunderbird . In the case of Firefox, this issue affects versions prior to 151 and ESR 140.11 . For Thunderbird, it affects versions prior to 151 and 140.11 . One report indicates that exploiti...

CVE-2026-8970

A privilege escalation vulnerability exists in the Security component of the Firefox web browser and the Thunderbird email client. This vulnerability is related to the insecure management of privileges and could allow a malicious actor to cause service interruptions . The issue has been addressed...

CVE-2004-0764

CVE-2004-0764 affects Mozilla-based browsers (Mozilla before 1.7; Firefox before 0.9; Thunderbird before 0.7) where the chrome flag and XML User Interface Language (XUL) files allow remote websites to hijack the browser UI. The vulnerability arises from XUL/UI manipulation that lets a site contro...

CVE-2010-2770

CVE-2010-2770 affects Mozilla-based products on Mac OS X: Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The vulnerability arises from a crafted font in a data: URL that can trigger memory corruption, leadin...

CVE-2026-12305

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . This vulnerability specifically affected the Thunderbird application and was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described ...

CVE-2026-16353

The Firefox browser and Thunderbird mail client are affected by a vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component. This flaw could lead to multiple security consequences, including the potential execution of arbitrary code , privilege escalation , information di...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-2777

CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...

CVE-2026-74968

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74972

A vulnerability in the DOM: Push Subscriptions component of the Mozilla Firefox browser and Mozilla Thunderbird mail client leads to information disclosure . This issue was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 1...

CVE-2026-8975

Memory safety bugs exist in Firefox ESR 115.35 , Firefox ESR 140.10 , and Firefox 150 , as well as Thunderbird 140.10 and Thunderbird 150 . These vulnerabilities involve memory corruption , which could potentially be exploited by an attacker with sufficient effort to execute arbitrary code . The ...

CVE-2004-0648

The CVE-2004-0648 issue affects Mozilla Suite <=1.7.0+1, Firefox <=0.9.1+1, and Thunderbird

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2025-14327

CVE-2025-14327 is a spoofing vulnerability in the Downloads Panel component affecting Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird

CVE-2026-0878

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape caused by incorrect boundary conditions in the Graphics:CanvasWebGL component. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. The issue is ad...

CVE-2026-12316

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and Thunderbird email client. This vulnerability stems from a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise data integrity . The issue h...

CVE-2026-2780

CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...

CVE-2026-2804

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The root cause is a mix-up in the instructions responsible for freeing memory. An attacker could exploit this flaw to execute arbitrary code , ca...

CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

CVE-2011-3649

CVE-2011-3649 affects Mozilla Firefox 7.0 and Thunderbird 7.0 on Windows when using Direct2D with the Azure graphics backend, allowing cross-origin image data to be read via a manipulated canvas (Same Origin Policy bypass). The issue stems from a regression introduced by CVE-2011-2986. According ...

CVE-2011-3671

The CVE-2011-3671 entry describes a use-after-free vulnerability in Mozilla’s nsHTMLSelectElement.cpp (nsHTMLSelectElement) affecting Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey

CVE-2026-0885

A use-after-free vulnerability exists in the JavaScript: GC component of the Mozilla Firefox and Thunderbird products. This memory safety issue can allow a remote attacker to execute arbitrary code on the affected system. The vulnerability affects versions of Firefox earlier than 147 and Firefox ...

CVE-2026-16407

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2769

A use-after-free vulnerability exists in the Storage: IndexedDB component of the Firefox browser and the Thunderbird email client. This flaw occurs because the software uses memory after it has been released, which could allow a remote attacker to induce a service failure . The issue is fixed in ...