CVE-2026-84122

CVE-2026-84122 is a use-after-free vulnerability in the Audio/Video component of Mozilla Firefox. The flaw was fixed in Firefox 155 , Firefox ESR 140.15 , and Firefox ESR 153.2 . The CVSS 3.1 score is 5.4 (MEDIUM) , requiring user interaction with low impacts to confidentiality and integrity and ...

CVE-2026-84123

CVE-2026-84123 is a privilege escalation vulnerability in Firefox caused by a use-after-free flaw in the Graphics: WebGPU component. The flaw allows an attacker to escalate privileges when a user interacts with a malicious WebGPU workload in the browser. CVSS 3.1 rates it 8.8 (HIGH) with a vector...

CVE-2026-84145

Internally discovered bugs in Firefox 154 , Firefox ESR 153.1 , Firefox ESR 140.14 , and Firefox ESR 115.39 included defects showing evidence of memory corruption or other security-relevant issues. Mozilla noted that with enough effort some of these bugs could potentially have been exploited, tho...

CVE-2026-0888

CVE-2026-0888 relates to information disclosure in the XML component in Mozilla Firefox and Thunderbird prior to version 147. Affected products include Firefox < 147 and Thunderbird

CVE-2026-84124

CVE-2026-84124 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox . The CVSS 3.1 score is 5.4 (MEDIUM) , with a network-based attack vector requiring user interaction and no privileges , resulting in low impacts to confidentiality and integrity but no impact to...

CVE-2026-84125

A use-after-free vulnerability in the DOM: Core & HTML component of Firefox could allow a remote attacker to execute arbitrary code , according to Red Hat's assessment. The CVSS 3.1 score is 5.4 (Medium) with a network attack vector, low complexity, no required privileges, but user interaction re...

CVE-2026-84130

CVE-2026-84130 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The flaw can be exploited remotely to obtain sensitive information . The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, lo...

CVE-2026-84640

CVE-2026-84640 is a one-byte buffer over-read in the mail header parser of Mozilla Thunderbird, triggered by a maliciously constructed mail header. The vulnerability is rated CVSS 3.1 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N , indicating a network-exploitable flaw requiring...

CVE-2026-84120

A use-after-free vulnerability in the Audio/Video component of Firefox and Firefox ESR allows a remote attacker to achieve arbitrary code execution . The flaw occurs when the program uses memory that has already been deallocated, leading to memory corruption. The CVSS 3.1 score is 5.4 (Medium) , ...

CVE-2026-84637

CVE-2026-84637 is a critical (CVSS 9.8) vulnerability in Mozilla Thunderbird where malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows , bypassing Thunderbird's normal executable attachment protections. With the new invitation dis...

CVE-2026-84641

A use-after-free in Mozilla Thunderbird's IMAP ID response handling allows a malicious IMAP server to trigger heap-memory disclosure. The leaked heap contents can ultimately be persisted to prefs.js , enabling an attacker to recover sensitive data without user interaction. The vulnerability carri...

CVE-2026-84118

CVE-2026-84118 is a use-after-free vulnerability in the JavaScript GC (Garbage Collector) component of Mozilla Firefox . The flaw can lead to low confidentiality and integrity impact when a user interacts with a crafted page, but does not affect availability (CVSS 3.1 score: 5.4 MEDIUM , vector A...

CVE-2026-84642

CVE-2026-84642 affects Mozilla Thunderbird , where the mail.allowed_attachment_hostnames advanced config setting values were inserted into a regular expression without escaping . For certain valid hostnames, this regex injection allowed unintended hostnames to match , enabling remote attachments ...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability in the Networking: HTTP component of Mozilla's Firefox and Thunderbird products. A remote attacker with no privileges and no user interaction can obtain sensitive information, resulting in high confidentiality impact with no integrity or a...