CVE-2026-2769

A use-after-free vulnerability exists in the Storage: IndexedDB component of the Firefox browser and the Thunderbird email client. This flaw occurs because the software uses memory after it has been released, which could allow a remote attacker to induce a service failure . The issue is fixed in ...

CVE-2026-2771

CVE-2026-2771 is an undefined-behavior vulnerability in the DOM: Core & HTML component of Mozilla Firefox/Thunderbird family that was fixed in Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148 and 140.8. The issue is reported across multiple advisories (Astra Linux bulletin and Amazon Li...

CVE-2026-2787

CVE-2026-2787 is a use-after-free in the DOM: Window and Location component, with fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources corroborate the issue in Firefox-related components and list the affected products as Firefox/Th...

CVE-2026-2799

CVE-2026-2799 is a use-after-free vulnerability in the DOM: Core & HTML components of Mozilla Firefox and Thunderbird. The issue, identified across multiple advisories, is resolved in Firefox 148 and Thunderbird 148. Public exploit activity is noted in connected sources. Affected products include...

CVE-2026-2802

A race condition exists in the JavaScript: GC component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from simultaneous execution using a shared resource with incorrect synchronization. If exploited, an attacker could gain access to confidential ...

CVE-2026-4729

Mozilla Firefox and Thunderbird versions 148 contain memory safety bugs that exhibit evidence of memory corruption. A specific vulnerability in the Firefox web browser involves copying buffers without checking the input data , which could allow a remote attacker to trigger a service failure or, w...

CVE-2026-84126

The Firefox and Thunderbird browsers are affected by a vulnerability involving incorrect boundary conditions in the Layout: Grid component . The issue has been remediated in Firefox 155 and Thunderbird 155 . While the vulnerability was identified as having a Medium base severity (CVSS 4.3) and a ...

CVE-2026-8948

A same-origin policy bypass exists in the DOM: Networking component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability is caused by the use of an untrusted network policy file , which can allow a remote attacker to execute arbitrary code . The issue was res...

CVE-2006-0299

CVE-2006-0299 affects Mozilla Firefox up to 1.5.0.1, Thunderbird 1.5 (when JavaScript runs in mail), and SeaMonkey before 1.0. The issue arises from the E4X implementation exposing the internal AnyName object to external interfaces, allowing multiple cooperating domains to exchange information an...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2026-12302

A mitigation bypass exists in the DOM: Security component of Mozilla Firefox and Thunderbird . This vulnerability affects various versions and has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not prov...

CVE-2026-12317

A memory safety bug exists in the Mozilla Firefox and Thunderbird web browser and email client. The vulnerability is caused by operations performing beyond the buffer boundaries in memory. Successful exploitation by a remote attacker can lead to service interruptions (Denial of Service). This iss...

CVE-2026-16400

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-5734

CVE-2026-5734 involves memory safety bugs in Mozilla products. Affected: Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. The issue is addressed by fixes in Firefox 14...

CVE-2026-6778

Mozilla Firefox and Thunderbird are vulnerable to an invalid pointer (specifically a zero pointer ) in the Audio/Video: Playback component. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected information . This issue has been resolved in Firefox 150 ...

CVE-2026-74963

A Same-origin policy bypass exists in the Networking: Cookies component of the Mozilla Firefox and Thunderbird applications. This vulnerability affects various versions of Firefox and Thunderbird, including Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.1...

CVE-2026-74971

A security vulnerability in the DOM: UI Events & Focus Handling component allows for information disclosure . This issue affects the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 ,...

CVE-2026-8962

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and the Thunderbird email client. Exploiting this vulnerability could allow an attacker to access confidential data and compromise data integrity . This issue was resolved in Firefox 151 , Firefox ESR 140.11 , Th...

CVE-2002-2437

The CVE-2002-2437 entry describes an information-disclosure flaw in the JavaScript implementation of Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability arises from improper restrictions on the values returned by getComputedStyle, enabling remote ...

CVE-2026-16409

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-74967

A Same-origin policy bypass vulnerability exists in the Audio/Video: Playback component of the Firefox web browser and Thunderbird email client. This flaw allows for the circumvention of origin-based security boundaries during media playback. The vulnerability has been addressed in Firefox 154 , ...

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

CVE-2026-84122

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The issue is resolved in Firefox 155 , Firefox ESR 140.1...

CVE-2004-0762

CVE-2004-0762 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. An attacker could lure a remote web site to trigger interaction events to manipulate the XPInstall Security dialog, allowing installation of arbitrary extensions. The vulnerability is documented with a high ...

CVE-2011-3665

CVE-2011-3665 affects Mozilla Firefox (4.x–8.0), Thunderbird (5.0–8.0), and SeaMonkey before 2.6. The issue is an improper handling of an Ogg VIDEO element after scaling, which can cause a crash or potentially other impact. Connected advisories corroborate MFSA2011-58 and related fixes across ope...

CVE-2014-2018

CVE-2014-2018 is an XSS issue in Mozilla Thunderbird 17.x–17.0.8, Thunderbird ESR 17.x–17.0.10, and SeaMonkey

CVE-2025-10531

A mitigation bypass vulnerability exists in the Web Compatibility: Tooling component of the Mozilla Firefox browser and Mozilla Thunderbird email client. The flaw allows a malicious actor to circumvent existing security restrictions remotely by exploiting an alternative path or channel that bypas...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

CVE-2026-2762

CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...

CVE-2026-2789

CVE-2026-2789 — Use-after-free in Graphics: ImageLib Affected software: Mozilla Firefox (and Firefox ESR) and Thunderbird. The vulnerability arises from a use-after-free in the Graphics: ImageLib component. Affected versions are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunder...

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-4721

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are affected by memory safety bugs (CVE-2026-4721). These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issue impacts Firefox versions prior to 149, Firefox ESR ver...

CVE-2026-6775

The WebRTC component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to incorrect boundary conditions, specifically involving the execution of operations outside of the buffer in memory. This vulnerability could allow an attacker to gain unauthorized access to protected information . The...

CVE-2026-8961

A spoofing issue exists in the Form Autofill component of the Firefox web browser and the Thunderbird email client. This vulnerability allows a malicious actor to potentially compromise data integrity and may facilitate authentication bypass through spearfishing . The issue is fixed in Firefox 15...

CVE-2026-8968

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Web Codecs component due to an invalid pointer . This flaw can lead to service interruptions or program crashes. The vulnerability affects the Firefox web browser and Thunderbird email client. Remediation is available in Firefox 1...

CVE-2010-5074

CVE-2010-5074 affects Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability stems from the layout engine comparing visited vs. unvisited links while processing CSS token sequences, causing a timing-based information disclosure. An attacker could rem...

CVE-2011-3652

CVE-2011-3652 affects Mozilla Firefox and Thunderbird prior to version 8.0 due to a browser engine memory allocation bug. This can cause memory corruption and application crashes, with potential for remote arbitrary code execution via unspecified vectors. Remediation is to upgrade to Firefox/Thun...

CVE-2011-3654

CVE-2011-3654 : The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 mishandles links from SVG mpath elements to non-SVG elements, enabling memory corruption and application crash and possibly arbitrary code execution via unspecified vectors. Impact is a high-severity memor...

CVE-2026-16364

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2788

CVE-2026-2788 concerns incorrect boundary conditions in the Audio/Video: GMP component of Mozilla Firefox. Public advisories (e.g., Firefox/Firefox ESR updates in Firefox 148, ESR 115.33, ESR 140.8) and downstream Debian/AlmaLinux advisories confirm the fix was applied in those versions. Connecte...

CVE-2026-2790

CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...

CVE-2026-2805

CVE-2026-2805 describes an Invalid pointer in the DOM: Core & HTML component affecting Mozilla Firefox and Mozilla Thunderbird. The issue originates from a pointer problem in the DOM Core & HTML, with the vulnerability fixed in version Firefox 148 and Thunderbird 148 . Public CVSS details (CVSS v...

CVE-2026-84139

A clickjacking vulnerability exists in the DOM: Events component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wild exploitation instances were provi...

CVE-2026-92047

A privilege escalation vulnerability exists in the Crash Reporting component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The vulnerability was addressed in the aforementioned release...

CVE-2026-92051

The Mozilla Firefox and Thunderbird applications are affected by a spoofing issue within the Graphics component caused by an invalid pointer . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided in the documents, the vulnerability ...

CVE-2011-3653

CVE-2011-3653 affects Mozilla Firefox < 8.0 and Thunderbird

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2026-12320

An information disclosure vulnerability exists in the Password Manager component of the Firefox and Thunderbird web browsers. This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 152 and Thunderbird 152 . Exploitation details are not...