CVE-2026-4720

Memory safety bugs exist in Mozilla Firefox and Thunderbird (specifically versions Firefox ESR 140.8 , Thunderbird ESR 140.8 , Firefox 148 , and Thunderbird 148 ). These vulnerabilities involve memory corruption that could potentially be exploited with significant effort to achieve arbitrary code...

CVE-2026-57963

The Thunderbird email client is vulnerable to a chat UI manipulation flaw where an attacker sending HTML chat messages (via Matrix or XMPP ) can inject arbitrary styled content , phishing links , and CSS to manipulate the chat interface. This issue was addressed in versions 152.0.1 and 140.12.1 ....

CVE-2026-8964

A spoofing issue exists in the Popup Blocker component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from the false representation of critical information within the user interface, which could allow a remote malicious actor to compromise data in...

CVE-2026-92050

This vulnerability allows for a sandbox escape due to a race condition in the XPConnect component . The issue has been resolved in Firefox 156 and Thunderbird 156 . While a security sighting was reported on 2026-09-17, specific details regarding exploit vectors or in-the-wild exploitation methods...

CVE-2026-92055

The DevTools component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation . This flaw was addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific technical root cause is not detailed beyond the compo...

CVE-2026-92075

CVE-2026-92075 is a mitigation bypass vulnerability within the Networking component of the Mozilla software suite. The issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Technical details from the provided documents indicate that the vulnerability i...

CVE-2026-92074

CVE-2026-92074 involves a mitigation bypass in the Popup Blocker component of the Mozilla Firefox browser and Thunderbird mail client. This vulnerability is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The provided documents do not specify the underlyin...

CVE-2025-11719

CVE-2025-11719 affects Mozilla Firefox and Thunderbird. On Windows, use of the native messaging API by web extensions can trigger use-after-free memory corruption, leading to crashes. Affected versions: Firefox < 144 and Thunderbird

CVE-2025-14323

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the DOM: Notifications component. The root cause involves the execution of operations outside the buffer while processing DOM objects, which could allow an attacker to increase their privileges remotely. Affec...

CVE-2025-14328

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by a privilege escalation vulnerability in the Netmonitor component. The root cause is attributed to the insecure management of privileges, which could allow an attacker to enhance their privileges remotely. This issue ...

CVE-2026-57962

The Thunderbird email client is vulnerable to a memory exhaustion attack via a malicious LDAP server . If a user is configured to query an untrusted LDAP server for address-book autocomplete , the attacker can stash arbitrarily large amounts of data into the Thunderbird LDAP client, leading to a ...

CVE-2026-92028

A Use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . While ...

CVE-2026-92032

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird due to an invalid pointer . This flaw allows for the execution of arbitrary code. Impacted versions include Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 1...

CVE-2026-92066

A sandbox escape vulnerability exists in the Profile Backup component of Firefox and Thunderbird . The vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific root cause technical details are not provided in the documents, the impact involves a potential escape from the ap...

CVE-2025-10534

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a spoofing vulnerability in the Site Permissions component. The root cause is related to a lack of measures to protect the structure of web pages, which can be exploited by a malicious actor to perform cross-site scr...

CVE-2026-0891

Mozilla Firefox and Thunderbird products are affected by memory safety bugs that can lead to memory corruption. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the system. This issue impacts Firefox ESR 140.6 , Thunderbird ESR 140.6 , Firefox 146 , and Thu...

CVE-2026-100819

The XPCOM component in the Firefox browser is vulnerable to a sandbox escape caused by incorrect boundary conditions . This issue was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Exploitation details and direct links are ...

CVE-2026-8965

The Firefox web browser and Thunderbird email client are affected by an information disclosure vulnerability within the DOM: Security component . This flaw allows a remote attacker to gain unauthorized access to confidential data . The vulnerability has been addressed in versions 151 of both Mozi...

CVE-2026-92067

A use-after-free vulnerability exists in the Widget: Gtk component of Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . This flaw was addressed in Firefox versions 156 and 153.3 (ESR), and Thunderbird versions 156 and 153.3 (ESR). Exploitation details are not provided in the doc...

CVE-2025-10530

A spoofing vulnerability exists in the WebAuthn component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an error in the authentication process, specifically the incorrect display of the domain name in the address bar. This allows a remote attacker to perform spear-phishing attack...

CVE-2025-14325

A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of the Mozilla Firefox browser and the Thunderbird email client. The flaw is caused by improper code generation management , which can allow an attacker to achieve remote arbitrary code execution . This vulnerabilit...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2026-0882

A use-after-free vulnerability exists in the IPC component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . Exploiting this flaw could allow an attacker to execute arbitrary code on a system or interfere with the confidentiality, integrity, and accessibility of protected i...

CVE-2026-12300

A memory safety bug exists in Mozilla Firefox and Thunderbird versions earlier than 152.0 . The vulnerability involves operations escaping beyond buffer boundaries in memory, which could allow a remote attacker to access confidential data . To remediate this issue, users should update to the late...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-92049

A use-after-free vulnerability exists in the Widget: Win32 component of Mozilla products. This issue impacts Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Documentation con...

CVE-2026-92053

CVE-2026-92053 is a privilege escalation vulnerability affecting the Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird . The flaw allows for elevated privileges, and a fix has been implemented in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No speci...

CVE-2026-92060

A use-after-free vulnerability exists in the Internationalization component of Mozilla Firefox and Thunderbird . The issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Specific details regarding exploitation vectors or impacts are not provided ...

CVE-2025-11710

A compromised web process could use malicious IPC messages to cause the privileged browser process to reveal blocks of its memory. This vulnerability affects Firefox versions earlier than 144, Firefox ESR earlier than 115.29 and 140.4, and Thunderbird versions earlier than 144 and 140.4. Remediat...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-92009

Mozilla Firefox and Thunderbird are affected by CVE-2026-92009, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. This security issue has been addressed in several releases, including Firefox 156 , Firefox ESR 115.41 , Firefox...

CVE-2026-92044

CVE-2026-92044 involves information disclosure in the Networking: HTTP component of Mozilla products. The vulnerability has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While technical details regarding the specific root cause are not provided in t...

CVE-2026-0883

CVE-2026-0883 identifies an information disclosure vulnerability within the Networking component of Mozilla products. This flaw can allow a malicious actor to gain access to confidential data . The vulnerability impacts Firefox (versions prior to 147), Firefox ESR (versions prior to 140.7), Thund...

CVE-2026-100811

A use-after-free vulnerability in the DOM: Core & HTML component of the Firefox web browser allows for a sandbox escape . This flaw was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific details regarding in-the-wild exploitation or exploit code are provided in th...

CVE-2026-12321

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of Firefox and Thunderbird . The flaw is attributed to the implementation of incorrect flow control , which could allow a remote attacker to access sensitive data and compromise the integrity of the browser. The is...

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2026-92024

Mozilla Firefox and Thunderbird are affected by a use-after-free vulnerability in the SVG component (CVE-2026-92024). This flaw can potentially impact the security of the browser and mail client. The vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Fi...

CVE-2026-92027

A use-after-free vulnerability exists in the DOM: Streams component of Mozilla Firefox and Thunderbird . The flaw allows for potential memory corruption or instability. This issue has been addressed in Firefox versions 156, ESR 115.41, ESR 140.16, and ESR 153.3, as well as Thunderbird versions 15...

CVE-2026-92037

The Mozilla Firefox and Thunderbird applications are affected by CVE-2026-92037 , which is caused by incorrect boundary conditions in the DOM: Animation component . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided, the issue has...

CVE-2026-92042

A race condition exists in the DOM: Content Processes component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the provided documents confirm the presence of the vulnerability in...

CVE-2025-10529

A same-origin policy bypass exists in the Layout component of Mozilla Firefox , Firefox ESR , and Thunderbird . The vulnerability is caused by the use of an untrusted intermediate policy file , which can allow a remote attacker to execute arbitrary code . Affected versions include Firefox < 14...

CVE-2025-11714

Mozilla Firefox and Thunderbird are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . Affected versions include Firefox ESR 115.28 , Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , ...

CVE-2026-92008

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions . This vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderb...

CVE-2026-92030

A mitigation bypass exists in the DOM: Copy & Paste and Drag & Drop component of the Mozilla Firefox and Mozilla Thunderbird browsers. This vulnerability was addressed in Firefox versions 156, ESR 140.16, and ESR 153.3, as well as Thunderbird versions 156, 140.16, and 153.3. Security advisories f...

CVE-2026-92056

A use-after-free vulnerability exists in the Graphics: Text component of Mozilla Firefox and Thunderbird . The flaw was addressed in Firefox versions 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific exploit details are provided in the documentation.

CVE-2026-92058

A use-after-free vulnerability exists in the Graphics component of the Firefox browser and Thunderbird. This flaw has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While one connected document (MGASA-2026-0441) characterizes this specific CVE ID as

CVE-2026-92069

This vulnerability involves a spoofing issue within the DOM: Navigation component . The flaw has been addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While multiple connected documents list this CVE, they do not provide specific tec...

CVE-2026-100756

The Audio/Video: Playback component is vulnerable to incorrect boundary conditions . An attacker could trigger a heap buffer overflow by inducing a user to open an email with a size greater than or equal to 2GB . Impacted products include Firefox (versions 157, ESR 115.42, 140.17, and 153.4) and ...

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-8967

The Firefox web browser and Thunderbird email client are vulnerable to an information disclosure vulnerability within the Graphics: WebGPU component. This flaw allows a remote attacker to gain access to confidential data . The issue was addressed in Firefox 151 and Thunderbird 151 . No specific e...