CVE-2026-8961

CVE-2026-8961 is a spoofing issue in the Mozilla form autofill component. Publicly documented fixes apply to Firefox and Thunderbird updates: Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. OpenSUSE and Slackware advisories list Firefox ESR/Thunderbird updates (e.g., fir...

CVE-2026-0886

CVE-2026-0886 : The vulnerability arises from incorrect boundary conditions in the Graphics component, affecting Firefox versions below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. The connected documents confirm the same issue is referenced across Mozilla advisor...

CVE-2026-0887

CVE-2026-0887: Clickjacking information disclosure in the PDF Viewer component. Affected products per the CVE entry include Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird

CVE-2026-16386

CVE-2026-16386 : Information disclosure caused by uninitialized memory in the Graphics: WebGPU component of Firefox. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to leakage of information. Impact as per source: Confidentiality impact HIGH; overall CVSSv3....

CVE-2026-16388

CVE-2026-16388 concerns a sandbox escape in the DOM within Firefox’ s Networking component. The available documents identify the affected software as Mozilla Firefox (DOM/Networking code path) and state the vulnerability was fixed in Firefox 153. The description provided does not reveal a detaile...

CVE-2026-2769

CVE-2026-2769 is a use-after-free vulnerability in Firefox’s Storage: IndexedDB component. Affected products are Firefox versions earlier than 148, Firefox ESR earlier than 115.33, and Firefox ESR earlier than 140.8. The issue arises from a memory safety flaw in IndexedDB storage handling, leadin...

CVE-2026-2790

CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...

CVE-2026-2804

CVE-2026-2804 describes a use-after-free vulnerability in the JavaScript: WebAssembly component that affects Mozilla Firefox and Mozilla Thunderbird. The issue is fixed in Firefox 148 and Thunderbird 148. Connected advisories reaffirm the same root cause (memory management issue in the WebAssembl...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-74940

CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird . It carries a CVSS 3.1 score of 9.8 (Critical) with a network attack vector requiring no privileges or user interaction. The Debian advisory notes that the vulnerability could pote...

CVE-2026-74957

CVE-2026-74957 is a mitigation bypass in the Safe Browsing component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating that a remote attacker can exploit this with low complexity and user interaction to achieve hi...

CVE-2026-74962

CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...

CVE-2026-0890

The CVE-2026-0890 entry describes a spoofing issue in the DOM: Copy & Paste and Drag & Drop component affecting Mozilla products. Affected products/components: Firefox (versions before 147) and Firefox ESR (before 140.7); Thunderbird (before 147) and Thunderbird (before 140.7). Root cause and imp...

CVE-2026-16366

CVE-2026-16366 describes a privilege escalation in the DOM: Navigation component. Affected products are Firefox and Thunderbird before version 153; the issue is fixed in Firefox 153 and Thunderbird 153. The CVSS 3.1 base metrics indicate a High impact with network access as the attack vector, req...

CVE-2026-2764

CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-2805

CVE-2026-2805 describes an Invalid pointer in the DOM: Core & HTML component affecting Mozilla Firefox and Mozilla Thunderbird. The issue originates from a pointer problem in the DOM Core & HTML, with the vulnerability fixed in version Firefox 148 and Thunderbird 148 . Public CVSS details (CVSS v...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-6780

CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...

CVE-2026-74955

Mozilla Firefox's Request Handling component contains a privilege escalation flaw rated CVSS 8.8 (HIGH). Exploitation requires network access and user interaction but no prior privileges, with HIGH impacts to confidentiality, integrity, and availability. No in-the-wild exploitation is reported. R...

CVE-2026-74986

A site isolation flaw in Firefox/Thunderbird's CSS Parsing and Computation component allows cross-origin data leakage. NVD rates it CVSS 9.1 (network, no auth). No active exploitation confirmed; patch in Firefox 154, ESR 153.1, Thunderbird 154, and 153.1. Update affected browsers immediately.

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2026-8973

CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...

CVE-2025-11721

CVE-2025-11721 describes a memory safety bug in Firefox 143 and Thunderbird 143, with evidence of memory corruption and potential arbitrary-code execution. Affected versions include Firefox < 144 and Thunderbird

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-16359

CVE-2026-16359 concerns Mozilla Firefox’s Audio/Video: GMP component. The root cause is described as incorrect boundary conditions in this GMP-related path. The vulnerability is rated with CVSS 3.1 base score 9.1 (Network, Low Attack Complexity, No Privileges Required, User Interaction None, Conf...

CVE-2026-16362

CVE-2026-16362 is a use-after-free in Firefox’s WebRTC Audio/Video component. The issue affects Firefox and Firefox ESR prior to the listed fixes, with the vulnerability fixed in Firefox 153 and Firefox ESR 140.13. The CVSS–3.1 metrics indicate network attack vector, no privileges, user interacti...

CVE-2026-16364

CVE-2026-16364 describes incorrect boundary conditions in Mozilla Firefox's Audio/Video: Playback component, with impact per sources as a high-severity issue fixed in Firefox 153. Affected product: Mozilla Firefox versions earlier than 153.0. Root cause: boundary-condition error in the Playback s...

CVE-2026-16407

The CVE-2026-16407 entry describes a mitigation bypass in the DOM: Service Workers component. Affected software is Mozilla Firefox (and dependent Thunderbird) prior to version 153, with the underlying issue addressed by fixes in Firefox 153/Thunderbird 153. The practical impact is a bypass of mit...

CVE-2026-4721

CVE-2026-4721 refers to memory-safety bugs in Firefox/Thunderbird across Firefox ESR 115.33, ESR 140.8, and Firefox/Thunderbird 148. Some flaws show memory corruption and could be exploitable for arbitrary code with enough effort per the initial entry. The issues were fixed in Firefox 149, Firefo...

CVE-2026-74947

A privilege escalation flaw in Firefox's Graphics component stems from an invalid pointer. CVSS 8.8 (HIGH) rates network attack vector with no privileges required. Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported; CISA SSVC marks it non-automatable with total techn...

CVE-2026-74978

CVE-2026-74978 is a clickjacking issue in the Firefox/Thunderbird Widget component. Affected versions include Firefox ESR 153.0 and Thunderbird 153/153.0; fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. CVSS 8.1 HIGH. No in-the-wild exploitation reported. Upgrade ...

CVE-2026-8966

CVE-2026-8966 affects Mozilla Thunderbird (earlier than 151.0) and concerns information disclosure in the IP Protection component. Multiple connected sources corroborate the impact as information disclosure, with the vulnerability fixed in Thunderbird 151 (and Firefox 151 per the initial entry). ...

CVE-2026-8968

Denial-of-service in the Audio/Video: Web Codecs component of Firefox caused by an invalid pointer. Affected product: Firefox WebCodecs; root cause: invalid pointer in the WebCodecs code path. Impact (per CVSS 3.1): HIGH with Availability impact; Attack Vector: NETWORK; Attack Complexity: LOW; Pr...

CVE-2025-14328

CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR

CVE-2026-12301

CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...

CVE-2026-4729

CVE-2026-4729 affects Firefox 148 and Thunderbird 148, with memory-safety bugs that could lead to memory corruption and potential arbitrary-code execution. The issues were fixed in Firefox 149 and Thunderbird 149. Mitigation: upgrade to the fixed versions (Firefox 149 / Thunderbird 149). Exploita...

CVE-2026-74952

Mozilla Firefox's Application Update component is affected by a privilege escalation flaw rated CVSS 8.8 (HIGH), exploitable remotely with no privileges but requiring user interaction. The vulnerability allows full confidentiality, integrity, and availability impact. It is fixed in Firefox 154 , ...

CVE-2026-74953

Firefox's Networking: Cookies component has a privilege escalation flaw. Exploitation requires user interaction (CVSS 8.8 HIGH). Patch available in Firefox 154, ESR 140.14, and ESR 153.1. No in-the-wild exploitation reported; root cause not specified in documents.

CVE-2026-74960

CVE-2026-74960 is a site isolation issue in the WebExtensions component of Mozilla Firefox and Thunderbird. The vulnerability allows a web extension to bypass site isolation boundaries, potentially enabling cross-origin data access. It carries a CVSS 3.1 score of 8.1 (HIGH) with a vector of AV:N/...

CVE-2025-11708

CVE-2025-11708 is a use-after-free in MediaTrackGraphImpl::GetInstance() affecting Firefox before version 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird before 140.4. Connected advisories corroborate multiple vendors and distributions addressing these Firefox/Thunderbird m...

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2026-0879

CVE-2026-0879 is a sandbox escape in the Graphics component that affects Firefox and Thunderbird prior to certain versions. Concrete details from connected documents show: the vulnerability is described as a Sandbox escape due to incorrect boundary conditions in the Graphics component, affecting ...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-74988

CVE-2026-74988 covers internally found bugs in Thunderbird ESR 153.0 , Thunderbird 153 , Firefox ESR 153.0 , and Firefox 153 . Some of these bugs showed evidence of memory corruption or another security-relevant defect, and Mozilla presumes that with enough effort some could have been exploited. ...

CVE-2026-8952

CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...