2028 matches found
CVE-2025-11712
Mozilla Firefox , Firefox ESR , and Thunderbird are affected by CVE-2025-11712 , where a malicious page can use the type attribute of an OBJECT tag to override default browser behavior when encountering a web resource served without a content-type header. This flaw could lead to Cross-Site Script...
CVE-2026-0886
Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability in the Graphics component caused by incorrect boundary conditions . This flaw can lead to memory operations outside of the buffer , potentially allowing a remote attacker to compromise the confidentiality of protected...
CVE-2026-8952
The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a privilege escalation flaw within the Application Update component. Insecure management of privileges allows a malicious actor to trigger service interruptions or cause a service failure. The vulnerability aff...
CVE-2026-92045
CVE-2026-92045 involves a sandbox escape vulnerability caused by incorrect boundary conditions in the WebRTC component . This flaw impacts multiple products including Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderb...
CVE-2026-92052
A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component due to uninitialized memory . This issue impacts Mozilla Firefox , Mozilla Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thund...
CVE-2026-92059
The DOM: Editor component in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to incorrect boundary conditions . This security issue has been addressed in versions Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the vulnerability is listed ...
CVE-2026-92079
A mitigation bypass exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird . This vulnerability impacts several versions and was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific root cause is not detailed beyond the comp...
CVE-2025-10528
Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape due to undefined behavior and an invalid pointer within the Graphics: Canvas2D component. This flaw allows an attacker to bypass the sandbox, potentially leading to privilege escalation. The vulnerability affects v...
CVE-2026-16399
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-2768
CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...
CVE-2026-84125
A use-after-free vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Mozilla Thunderbird . This flaw affects the core browser engine and was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wil...
CVE-2026-8971
The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a same-origin policy bypass within the Networking: JAR component. The root cause is attributed to a lack of source verification mechanism in the networking component. If exploited, an attacker can bypass securi...
CVE-2026-92041
A mitigation bypass vulnerability exists in the DOM: Networking component of the Firefox browser. This issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While specific technical root causes or exploit details are not provided, the vulnerability is ...
CVE-2006-0836
CVE-2006-0836 : Affected product is Mozilla Thunderbird 1.5. The issue allows user-assisted attackers to cause an unspecified denial of service by convincing a user to import an LDIF file containing a long field (demonstrated by a long homePhone field) into the address book. The available connect...
CVE-2025-10537
Mozilla Firefox and Thunderbird are affected by memory safety bugs that exhibit evidence of memory corruption . These vulnerabilities could potentially be exploited to execute arbitrary code or cause service interruptions by performing operations outside of the buffer in memory. The affected vers...
CVE-2025-11709
Mozilla Firefox and Thunderbird are vulnerable to out-of-bounds reads and writes in a privileged process caused by manipulated WebGL textures . The vulnerability exists in the WebGL Texture Handler component, where a compromised web process can trigger memory corruption to execute arbitrary code ...
CVE-2026-12319
The Firefox web browser and Thunderbird email client are affected by a Denial-of-Service (DoS) vulnerability in the Audio/Video: Playback component. The flaw is caused by an uncontrolled consumption of resources , which can allow a remote attacker to trigger service interruptions or cause a servi...
CVE-2026-16376
Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-2786
Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.
CVE-2026-2791
CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...
CVE-2026-2803
CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...
CVE-2026-84132
CVE-2026-84132 is an information disclosure vulnerability affecting the Networking: HTTP component in Mozilla products. This flaw impacts Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . N...
CVE-2026-84639
Mozilla Thunderbird is affected by CVE-2026-84639 , where triggering an error condition in certain MIME bodies causes the use of uninitialized memory . This vulnerability could potentially lead to arbitrary code execution or information disclosure. The issue has been addressed in Thunderbird vers...
CVE-2026-92061
The Security: Process Sandboxing component in Firefox and Thunderbird is vulnerable due to incorrect boundary conditions . This flaw can potentially impact security boundaries within the sandboxing environment. The vulnerability was addressed and fixed in Firefox 156 and Thunderbird 156 . While t...
CVE-2026-92064
The Widget: Win32 component in Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to a sandbox escape caused by incorrect boundary conditions. This vulnerability affects various versions, with fixes available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and ...
CVE-2008-5430
CVE-2008-5430 affects Mozilla Thunderbird 2.0.14 and is tied to handling of multipart/mixed e-mails with many MIME parts and possibly many headers of the form Content-type: message/rfc822;. The root cause is improper processing leading to denial of service through large messages (resource/stack c...
CVE-2026-0887
CVE-2026-0887 involves a clickjacking issue and information disclosure within the PDF Viewer component of Mozilla products. This vulnerability impacts Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird versions prior to 140.7. Ex...
CVE-2026-12323
The Firefox web browser and Thunderbird email client are affected by a DOM spoofing issue within the Core & HTML components. The root cause is attributed to improper restrictions on the visible layers of the user interface , which could allow a remote attacker to trigger service interruptions . R...
CVE-2026-2770
CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...
CVE-2026-2776
CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...
CVE-2026-2800
CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...
CVE-2026-2807
CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...
CVE-2026-3889
A spoofing vulnerability exists in the Mozilla Thunderbird email client, affecting versions prior to 149 and 140.9 . This flaw allows attackers to conduct spoofing attacks against users. The vulnerability was addressed in the release of Thunderbird versions 149 and 140.9 . While the documents con...
CVE-2026-92034
A site isolation issue exists in the Graphics component of Firefox and Thunderbird . This vulnerability is addressed in Firefox 156 and Thunderbird 156 . No specific root cause or exploitation details are provided in the documentation, but the issue has been identified in several distributions an...
CVE-2026-92043
The Audio/Video component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This issue impacts Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Remediation is available via patches in versions Firefox 156 , F...
CVE-2026-92046
A Use-after-free vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird . The issue affects these applications across various distributions, including openSUSE and SUSE Linux. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbir...
CVE-2026-92057
This vulnerability involves a mitigation bypass within the Enterprise Policies component of the Firefox and Thunderbird browsers. The flaw is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the initial description identifies it as a mitigation bypass...
CVE-2026-92065
Mozilla Firefox and Mozilla Thunderbird are affected by a sandbox escape vulnerability in the Widget: Win32 component. The root cause is identified as incorrect boundary conditions within the component. This issue impacts the security boundary of the browser and mail client's sandbox. Remediation...
CVE-2025-11711
This vulnerability exists in Mozilla Firefox and Thunderbird due to a flaw that allows an attacker to modify the values of JavaScript Object properties that are intended to be non-writeable. Affected versions include Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird &...
CVE-2026-2793
CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...
CVE-2026-8960
A spoofing issue in the WebExtensions component of the Firefox web browser and Thunderbird email client allows a malicious actor to bypass authentication processes through spearfishing . Exploiting this vulnerability enables remote compromise of data integrity . The issue was resolved in Firefox ...
CVE-2026-8964
A spoofing issue exists in the Popup Blocker component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from the false representation of critical information within the user interface, which could allow a remote malicious actor to compromise data in...
CVE-2026-92006
Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This security flaw impacts various versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thund...
CVE-2026-92010
The Mozilla Firefox and Mozilla Thunderbird browsers/mail clients are vulnerable to privilege escalation due to incorrect boundary conditions within the Graphics: CanvasWebGL component. This vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Firefox ESR...
CVE-2026-92054
The Memory component in Mozilla Firefox is vulnerable to privilege escalation (CVE-2026-92054). This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit details are provided in the documentation.
CVE-2025-14333
CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...
CVE-2026-6780
The Audio/Video: Playback component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an uncontrolled resource consumption issue within the playback functions, which can be exploited by an attacker to trigger service interruptions . Th...
CVE-2026-92050
This vulnerability allows for a sandbox escape due to a race condition in the XPConnect component . The issue has been resolved in Firefox 156 and Thunderbird 156 . While a security sighting was reported on 2026-09-17, specific details regarding exploit vectors or in-the-wild exploitation methods...
CVE-2026-92055
The DevTools component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation . This flaw was addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific technical root cause is not detailed beyond the compo...