CVE-2026-2773

CVE-2026-2773 is a Chrome-like vulnerability in Firefox’s Web Audio component caused by incorrect boundary conditions, fixed in Firefox 148 and corresponding ESR releases (ESR 115.33 and ESR 140.8). The issue is documented across multiple advisories (Firefox security notes and vendor feeds) and i...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

CVE-2026-92019

A mitigation bypass vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Mozilla Thunderbird . This issue is present in various versions, including Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3, and Thunderbird 156, 140.16, and 153.3. The vulnerability was addresse...

CVE-2004-0907

CVE-2004-0907 affects Linux installs of Mozilla Firefox (pre-Preview Release), Mozilla (pre-1.7.3), and Thunderbird (pre-0.8). The root cause is insecure permissions on files created during the installation tarball extraction, which could let local users overwrite files and execute arbitrary code...

CVE-2025-14322

A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions and insufficient checking of unusual states. This flaw allows a remote attacker to bypass sandboxing protection mechanisms. Affected versions includ...

CVE-2026-12307

A memory safety bug has been identified and fixed in Firefox and Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The issue was specifically addressed as a memory safety fix in the Thunderbird client. No specific technical deta...

CVE-2026-16380

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2784

A vulnerability CVE-2026-2784 is a mitigation bypass in the DOM: Security component affecting Mozilla Firefox and Thunderbird. The issue was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The connected sources (Astra Linux bulletin and Amazon Linux advisories) co...

CVE-2026-2795

CVE-2026-2795 is a use-after-free in the JavaScript: GC component affecting Mozilla Firefox and Mozilla Thunderbird. Technical details across connected sources consistently identify the flaw in the GC object handling, with exploitation risk implied by the high/critical CVSS data. The vulnerabilit...

CVE-2026-84130

A vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure . This issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Exploitation details are not provided in the documents.

CVE-2026-8973

Memory safety bugs in Firefox 150 and Thunderbird 150 allow for memory corruption due to operations exceeding buffer boundaries. While the impact primarily involves potential service interruptions , it is presumed that with sufficient effort, these flaws could be exploited to achieve arbitrary co...

CVE-2011-2991

CVE-2011-2991 affects the Mozilla browser engine in Firefox 4.x–5, SeaMonkey 2.x prior to 2.3, and Thunderbird prior to 6. The issue arises from improper JavaScript handling, enabling remote attackers to trigger memory corruption and cause a crash, with potential arbitrary code execution via unsp...

CVE-2011-3664

Affected software: Mozilla Firefox, Thunderbird, and SeaMonkey on Mac OS X. Vulnerable behavior: plugins can delete a DOM frame, triggering an incorrect pointer dereference that may crash the application (DoS) and potentially other unspecified impacts. Severity: base CVSS 2.0 score 6.8 (MEDIUM). ...

CVE-2026-0879

This vulnerability involves a sandbox escape caused by incorrect boundary conditions within the Graphics component of Mozilla products. Impacted software includes Firefox , Firefox ESR , and Thunderbird . Exploitation of this flaw can allow an attacker to execute arbitrary code or cause the appli...

CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16402

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2759

The CVE-2026-2759 issue is concrete: it concerns incorrect boundary conditions in the Graphics: ImageLib component affecting Firefox/Thunderbird products. The description explicitly states the vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thun...

CVE-2026-2785

CVE-2026-2785 is an Invalid pointer vulnerability in the Firefox JavaScript Engine. Connected sources show it being addressed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Debian/ALMA and Amazon Linux advisories enumerate Firefox-related fixes including this CVE and l...

CVE-2026-8966

The IP Protection component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to an information disclosure flaw. This vulnerability allows a remote attacker to potentially gain access to confidential data . The issue has been addressed in Firefox 151 and Thunderbird 151 . No specific explo...

CVE-2026-92071

A sandbox escape vulnerability exists in the Widget: Win32 component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw allows an attacker to escape the sandbox environment, potentially leading to broader system impact. The issue was addressed in Firefox 156 , Firefox ESR ...

CVE-2004-2226

This CVE affects Mozilla Mail 1.7.1/1.7.3 and Thunderbird before 0.9. When HTML-Mails is enabled, an attacker can cause an HTML e‑mail to reference a CSS document on the attacker's server, enabling a remote attacker to determine valid e‑mail addresses. The core issue is an information-disclosure ...

CVE-2005-3402

CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...

CVE-2005-4809

CVE-2005-4809 affects Mozilla Firefox 1.0.1 (and possibly other Mozilla products such as Mozilla and Thunderbird) and describes a UI spoofing issue where an attacker can spoof the URL shown in the Status Bar. The root cause is a crafted A HREF tag that includes a TABLE tag containing another A ta...

CVE-2012-1943

CVE-2012-1943 involves an untrusted search path vulnerability in Updater.exe of the Mozilla Updater Service on Windows, affecting Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9. The issue allows local privilege escalation through loading a Trojan horse wsock32.dll located in an application dir...

CVE-2025-14324

CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird

CVE-2026-0880

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird due to an integer overflow (numerical overflow). This flaw can allow an attacker to execute arbitrary code on a system or disclose sensitive information. Affected versions include Firefox < 147, ...

CVE-2026-12322

The Firefox web browser and Thunderbird email client are affected by a clickjacking vulnerability in the Widget: Gtk component. The issue stems from an incorrect limitation on the visible layers of the user interface, which could allow an attacker to cause service failures . This vulnerability ha...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16393

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2764

CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-84120

A use-after-free vulnerability exists in the Audio/Video component of Mozilla Firefox and Thunderbird . This flaw could potentially allow for the execution of arbitrary code , sandbox escape , or privilege escalation . The issues have been addressed in Firefox 155 , Firefox ESR 115.40 , Firefox E...

CVE-2026-8963

The Firefox web browser and Thunderbird email client are vulnerable to a spoofing issue within the Web Speech component. This flaw allows an attacker to bypass authentication through spoofing, potentially leading to a compromise of data integrity . The vulnerability has been addressed in Firefox ...

CVE-2026-8969

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass in the DOM: Security component. The root cause is a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise its integrity . This vulnerability...

CVE-2026-8972

The WebRTC: Audio/Video component in the Mozilla Firefox web browser and Mozilla Thunderbird email client is affected by a privilege escalation vulnerability caused by insecure privilege management . A remote attacker could exploit this flaw to cause service interruptions or achieve elevated priv...

CVE-2009-4629

Mozilla Necko DNS Information Disclosure (CVE-2009-4629) affects Thunderbird 3.0.1, SeaMonkey, and related apps. The issue is DNS prefetching triggered even for APP_TYPE_MAIL/APP_TYPE_EDITOR, enabling an attacker to infer a user’s network location by logging DNS requests (e.g., when reading text/...

CVE-2025-10532

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a security bypass due to incorrect boundary conditions in the JavaScript: GC component . The root cause is identified as insufficient checking of unusual or exceptional states within the GC functions. Successful exploitation could ...

CVE-2025-11708

A Use-after-free vulnerability exists in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox , Firefox ESR , and Thunderbird . This memory safety issue allows a malicious actor to execute arbitrary code . The vulnerability affects Firefox < 144 , Firefox ESR < 140.4 , Thu...

CVE-2026-0892

Mozilla Firefox and Thunderbird versions 146 (and versions prior to 147) are affected by memory safety bugs that can lead to memory corruption . An attacker could potentially exploit these vulnerabilities to achieve arbitrary code execution on the system or cause a denial-of-service (DoS) attack....

CVE-2026-12301

A memory safety bug exists in the Mozilla Firefox web browser and Thunderbird email client. The vulnerability involves operations escaping buffer boundaries in memory, which could allow a remote attacker to gain access to confidential data . This issue is addressed in Firefox 152 and Thunderbird ...

CVE-2026-12303

The Firefox web browser and Thunderbird email client are affected by an information disclosure vulnerability in the Graphics: WebGPU component. The root cause is incorrect boundary conditions , which allows an attacker to read data from buffer areas beyond the allowed limits and potentially acces...

CVE-2026-16398

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2798

A use-after-free vulnerability exists in the DOM: Core & HTML components of the Mozilla Firefox web browser and Mozilla Thunderbird email client. This flaw allows for the reuse of memory after it has been freed, which can be exploited by a remote attacker to trigger service interruptions or failu...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2025-11712

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by CVE-2025-11712 , where a malicious page can use the type attribute of an OBJECT tag to override default browser behavior when encountering a web resource served without a content-type header. This flaw could lead to Cross-Site Script...

CVE-2025-8043

Mozilla Firefox and Thunderbird are vulnerable to a security flaw where URLs are incorrectly truncated toward the beginning instead of around the origin. This vulnerability exists in products earlier than version 141 . Potential impacts include security bypass , spoofing the user interface , and ...

CVE-2026-0886

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability in the Graphics component caused by incorrect boundary conditions . This flaw can lead to memory operations outside of the buffer , potentially allowing a remote attacker to compromise the confidentiality of protected...

CVE-2026-92007

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This vulnerability affects various versions of the software, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thu...

CVE-2026-92012

Mozilla Firefox and Thunderbird are affected by CVE-2026-92012, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. The vulnerability has been addressed in the following versions: Firefox 156, Firefox ESR 115.41, Firefox ESR 140...