CVE-2026-2789

CVE-2026-2789 — Use-after-free in Graphics: ImageLib Affected software: Mozilla Firefox (and Firefox ESR) and Thunderbird. The vulnerability arises from a use-after-free in the Graphics: ImageLib component. Affected versions are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunder...

CVE-2026-74950

A privilege escalation flaw in the Downloads API component of Firefox and Thunderbird allows network-based attackers to gain elevated privileges with user interaction. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1; no exploitation evidence reported by CISA. Updat...

CVE-2026-74961

CVE-2026-74961 is a side-channel vulnerability in the Web Audio component of Mozilla Firefox and Thunderbird. It is rated CVSS 9.1 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on both confidentiality and integrity. The flaw allows an attacke...

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-16359

CVE-2026-16359 concerns Mozilla Firefox’s Audio/Video: GMP component. The root cause is described as incorrect boundary conditions in this GMP-related path. The vulnerability is rated with CVSS 3.1 base score 9.1 (Network, Low Attack Complexity, No Privileges Required, User Interaction None, Conf...

CVE-2026-16366

CVE-2026-16366 describes a privilege escalation in the DOM: Navigation component. Affected products are Firefox and Thunderbird before version 153; the issue is fixed in Firefox 153 and Thunderbird 153. The CVSS 3.1 base metrics indicate a High impact with network access as the attack vector, req...

CVE-2026-16403

CVE-2026-16403 affects Mozilla Firefox’s Address Bar spoofing functionality. The connected sources consistently identify a spoofing issue in the Address Bar component that was fixed in Firefox 153. Details across SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, and CVE listings corroborate the same root ca...

CVE-2026-2785

CVE-2026-2785 is an Invalid pointer vulnerability in the Firefox JavaScript Engine. Connected sources show it being addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Debian/ALMA and Amazon Linux advisories enumerate Firefox-related fixes including this CVE and l...

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-6780

CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...

CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of Firefox and Thunderbird. CVSS 8.8 (HIGH) with network attack vector, no privileges required and user interaction needed. CISA reports no known exploitation. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbir...

CVE-2026-74985

Privilege escalation in the Enterprise Policies component of Firefox and Thunderbird allows an attacker with no privileges to gain elevated access. Affected products include Firefox (all versions below 154), Firefox ESR (below 153.1), Thunderbird (below 154), and Thunderbird ESR (below 153.1). Th...

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-16362

CVE-2026-16362 is a use-after-free in Firefox’s WebRTC Audio/Video component. The issue affects Firefox and Firefox ESR prior to the listed fixes, with the vulnerability fixed in Firefox 153 and Firefox ESR 140.13. The CVSS–3.1 metrics indicate network attack vector, no privileges, user interacti...

CVE-2026-16364

CVE-2026-16364 describes incorrect boundary conditions in Mozilla Firefox's Audio/Video: Playback component, with impact per sources as a high-severity issue fixed in Firefox 153. Affected product: Mozilla Firefox versions earlier than 153.0. Root cause: boundary-condition error in the Playback s...

CVE-2026-2805

CVE-2026-2805 describes an Invalid pointer in the DOM: Core & HTML component affecting Mozilla Firefox and Mozilla Thunderbird. The issue originates from a pointer problem in the DOM Core & HTML, with the vulnerability fixed in version Firefox 148 and Thunderbird 148 . Public CVSS details (CVSS v...

CVE-2026-4721

CVE-2026-4721 refers to memory-safety bugs in Firefox/Thunderbird across Firefox ESR 115.33, ESR 140.8, and Firefox/Thunderbird 148. Some flaws show memory corruption and could be exploitable for arbitrary code with enough effort per the initial entry. The issues were fixed in Firefox 149, Firefo...

CVE-2025-10529

CVE-2025-10529 describes a Same-origin policy bypass in the Firefox/Thunderbird Layout component. The connected sources confirm the vulnerability affects Firefox versions below 143 and Firefox ESR below 140.3, and Thunderbird versions below 143 and below 140.3. The impact is implied by the descri...

CVE-2025-14328

CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR

CVE-2026-12330

CVE-2026-12330 corresponds to an issue in the Internationalization component with incorrect boundary conditions. Public disclosures in connected advisories confirm multiple Mozilla products are affected, including Firefox ESR and Thunderbird. Debian’s advisory shows the vulnerability affecting fi...

CVE-2026-16407

The CVE-2026-16407 entry describes a mitigation bypass in the DOM: Service Workers component. Affected software is Mozilla Firefox (and dependent Thunderbird) prior to version 153, with the underlying issue addressed by fixes in Firefox 153/Thunderbird 153. The practical impact is a bypass of mit...

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...

CVE-2026-74954

A side-channel flaw in Firefox/Thunderbird's Storage: Cache API enables network-based information disclosure. Affected versions are fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. No public exploit or in-the-wild exploitation is reported. Users should upgrade to t...

CVE-2026-8952

CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...

CVE-2026-8968

Denial-of-service in the Audio/Video: Web Codecs component of Firefox caused by an invalid pointer. Affected product: Firefox WebCodecs; root cause: invalid pointer in the WebCodecs code path. Impact (per CVSS 3.1): HIGH with Availability impact; Attack Vector: NETWORK; Attack Complexity: LOW; Pr...

CVE-2026-8973

CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...

CVE-2025-10534

CVE-2025-10534 is a spoofing vulnerability in the Site Permissions component affecting Mozilla Firefox and Mozilla Thunderbird. Affected versions are Firefox < 143 and Thunderbird

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-12301

CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-74947

A privilege escalation flaw in Firefox's Graphics component stems from an invalid pointer. CVSS 8.8 (HIGH) rates network attack vector with no privileges required. Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported; CISA SSVC marks it non-automatable with total techn...

CVE-2026-74955

Mozilla Firefox's Request Handling component contains a privilege escalation flaw rated CVSS 8.8 (HIGH). Exploitation requires network access and user interaction but no prior privileges, with HIGH impacts to confidentiality, integrity, and availability. No in-the-wild exploitation is reported. R...

CVE-2026-74957

CVE-2026-74957 is a mitigation bypass in the Safe Browsing component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, indicating that a remote attacker can exploit this with low complexity and user interaction to achieve hi...

CVE-2026-74962

CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...

CVE-2026-8966

CVE-2026-8966 affects Mozilla Thunderbird (earlier than 151.0) and concerns information disclosure in the IP Protection component. Multiple connected sources corroborate the impact as information disclosure, with the vulnerability fixed in Thunderbird 151 (and Firefox 151 per the initial entry). ...

CVE-2026-8971

The CVE-2026-8971 issue is described across multiple sources as a same-origin policy bypass in the Networking: JAR component, with remediation issued as Firefox 151. The documents do not specify the exact affected product versions beyond Firefox, nor any exploits or in-the-wild use. Root cause de...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2025-11708

CVE-2025-11708 is a use-after-free in MediaTrackGraphImpl::GetInstance() affecting Firefox before version 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird before 140.4. Connected advisories corroborate multiple vendors and distributions addressing these Firefox/Thunderbird m...

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2026-0890

The CVE-2026-0890 entry describes a spoofing issue in the DOM: Copy & Paste and Drag & Drop component affecting Mozilla products. Affected products/components: Firefox (versions before 147) and Firefox ESR (before 140.7); Thunderbird (before 147) and Thunderbird (before 140.7). Root cause and imp...

CVE-2026-16353

The CVE-2026-16353 entry concerns Mozilla Firefox/Firefox ESR and the DOM Bindings (WebIDL) component. Affected component: Invalid pointer in the DOM: Bindings (WebIDL). Root cause: invalid pointer handling in the DOM Bindings. Impact: high confidentiality, integrity, and availability (per CVSS 3...

CVE-2026-16380

CVE-2026-16380 describes a mitigation bypass in the Networking component of Mozilla Firefox. The issue is characterized in the sources as a bypass vulnerability that was fixed in Firefox 153. The affected product is Mozilla Firefox; detailed root cause and affected subcomponents are not explicitl...

CVE-2026-2764

CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-4720

CVE-2026-4720 is a memory-safety issue affecting Mozilla products (Firefox/Thunderbird). Connected advisories confirm memory-corruption-type bugs in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148, with the practical impact stated as potential arbitrary code execution. ...