CVE-2026-12290

A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...

CVE-2026-12296

CVE-2026-12296 describes a sandbox escape in the Security: Process Sandboxing component. Affected products include Mozilla Firefox and Firefox ESR, and Mozilla Thunderbird with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The description does not ...

CVE-2026-12311

CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...

CVE-2026-16360

Memory safety bugs found in Mozilla Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152, with evidence of memory corruption and potential remote code execution. The issues were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected product family: Mozilla Firefox ESR (olde...

CVE-2026-8946

The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...

CVE-2025-8044

CVE-2025-8044 corresponds to memory safety bugs found in Firefox 140 and Thunderbird 140, with memory corruption evidence and a potential to allow arbitrary code execution. Affected products are Firefox and Thunderbird versions earlier than 141. The consolidated sources indicate the issues are me...

CVE-2026-8954

CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-8953

CVE-2026-8953 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. Affected products include Firefox (fixed in Firefox 151) and Firefox ESR (115.36, 140.11), as well as Thunderbird (151, 140.11). The public records indicate a memory-unsafe defect in the D...

CVE-2025-10527

The CVE-2025-10527 entry corresponds to a sandbox escape via use-after-free in the Graphics: Canvas2D component. Affected products include Firefox <143, Firefox ESR <140.3, Thunderbird <143, and Thunderbird

CVE-2025-10533

CVE-2025-10533 describes an integer overflow in the SVG component affecting Firefox before 143, Firefox ESR before 115.28 and 140.3, Thunderbird before 143 and 140.3. Connected sources confirm the same vulnerability details. The Astra Linux security bulletin echoes this issue and lists the affect...

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2026-12325

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...

CVE-2026-16365

CVE-2026-16365 affects the DOM: Workers component. The vulnerability is fixed in Firefox 153 and Thunderbird 153. The available data include a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, user interaction required, and total impact ...

CVE-2026-6782

This CVE (CVE-2026-6782) affects the IP Protection component and is addressed by upgrading Firefox to version 150 and Thunderbird to version 150 (per multiple advisories). Public records in Fedora/Nessus notes indicate an information disclosure vulnerability resolved by these upgrades; no detaile...

CVE-2026-16381

CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-16396

CVE-2026-16396 is a privilege-escalation issue in WebExtensions that affects Mozilla Firefox and Thunderbird components. Public advisories indicate the vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS data from the initial document show...

CVE-2026-14899

The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...

CVE-2026-12310

CVE-2026-12310 is a memory-safety bug in Mozilla Firefox/Thunderbird fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction required, and impact limited to confidentiality. The connec...

CVE-2026-12324

CVE-2026-12324 concerns an issue in the Graphics: CanvasWebGL component caused by incorrect boundary conditions. Public sources indicate the vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The available documents do not provide exploit vectors ...

CVE-2026-0877

CVE-2026-0877 is a mitigation bypass in the DOM: Security component, affecting Firefox versions below 147, including Firefox ESR <115.32 and ESR

CVE-2026-12299

CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-12297

CVE-2026-12297 describes a sandbox escape caused by incorrect boundary conditions in Mozilla Firefox/Thunderbird networking code. Affects Firefox and Thunderbird components; underlying fault is boundary-condition handling in the Networking component that allowed escape from the sandbox. Impact pe...

CVE-2026-16387

CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-8950

CVE-2026-8950 is a reported same-origin policy bypass in the Networking: HTTP component, with root cause not explicitly detailed in the provided documents. Affected software includes Firefox (fixed in version 151) and Firefox ESR (140.11), as well as Thunderbird (fixed in 151 and 140.11). The CVS...

CVE-2026-12298

CVE-2026-12298 is a memory-safety bug affecting Firefox and Thunderbird components, with fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Connected advisories (ALSA/RLSA/SUSE/Fedora/Red Hat) enumerate the same CVE among a broader set of related issues and indicat...

CVE-2026-16384

CVE-2026-16384 : Information disclosure caused by uninitialized memory in Firefox’s Graphics: WebGPU component. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to potential leakage. Impact per CVSS: Confidentiality High; no integrity/availability impact repo...

CVE-2026-2778

CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. Affected: Firefox (pre-148), Firefox ESR (pre-115.33/140.8); Thunderbird (pre-148, pre-140.8). Fixes: Firefox 148, ESR 115.33/140.8; Thunderbird 148/140.8. Practical impact: sandbox escape potent...

CVE-2026-2792

CVE-2026-2792 involves memory safety bugs found in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some flaws showed memory corruption indicators and could potentially be exploited to run arbitrary code; Mozilla fixed these in Firefox 148, Firefox ESR 140.8, Thunderbird...

CVE-2026-8955

CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...

CVE-2026-12313

CVE-2026-12313 affects Firefox and Thunderbird: Information disclosure and sandbox escape in the Security: Process Sandboxing component. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 (per Mozilla advisories and downstream vendor trackers). ...

CVE-2026-12315

The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...

CVE-2026-16371

CVE-2026-16371: Privilege escalation in the DOM: Navigation component. The Mozilla advisories indicate this affects Firefox and Thunderbird products and is fixed in Firefox 153 / ESR 140.13 and Thunderbird 153 / 140.13. Remediation: upgrade to Firefox 153 (or ESR 140.13) and Thunderbird 153 (or 1...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-6774

CVE-2026-6774 is a mitigation bypass in the DOM: Security component that affects Firefox and Thunderbird. The issue is described as a bypass of mitigation in the DOM security stack and was fixed in Firefox 150 and Thunderbird 150. The provided metadata indicates a CVSS v3.1 base score of 5.4 (Med...

CVE-2026-0878

CVE-2026-0878 describes a sandbox escape caused by incorrect boundary conditions in the Graphics: CanvasWebGL component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird

CVE-2026-16389

CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...

CVE-2026-6775

CVE-2026-6775: Affects the WebRTC component with incorrect boundary conditions. Urban/Thunderbird users should upgrade to Firefox 150 and Thunderbird 150 where the issue is fixed. The vulnerability entry specifies this CVE’s root cause and that remediation is through upgrading to the listed versi...

CVE-2026-8949

CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...

CVE-2026-16379

Technical details for CVE-2026-16379 are not provided in the supplied documents. The initial entry mentions privilege escalation in the DOM Content Processes component and fixes in Firefox/Thunderbird versions, but lacks root cause, affected products, or remediation specifics.

CVE-2026-2760

CVE-2026-2760 is a Firefox/Thunderbird Firefox Graphics: WebRender sandbox escape caused by incorrect boundary conditions. Multiple public advisories confirm the issue and that it is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected comp...

CVE-2026-2774

CVE-2026-2774 is an integer overflow in the Firefox Audio/Video component. Public sources indicate Firefox/ESR updates (Firefox 148, ESR 115.33, ESR 140.8) fix the flaw; affected products include Firefox and Thunderbird per accompanying advisories. The issue is rated high/critical by CVSS sources...

CVE-2026-2780

CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...

CVE-2025-14327

CVE-2025-14327 is a spoofing vulnerability in the Downloads Panel component affecting Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird

CVE-2026-16357

CVE-2026-16357 is a Mozilla Firefox/Firefox ESR vulnerability caused by incorrect boundary conditions in the Graphics component. Affected product: Firefox and Firefox ESR. The issue is tracked with a CVSS 3.1 base score of 9.8 (CRITICAL) with network attack vector, no user interaction, and possib...

CVE-2026-2762

CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...

CVE-2026-2779

CVE-2026-2779 covers incorrect boundary conditions in Networking: JAR within Firefox (and Firefox ESR). Public advisories indicate the issue affects Firefox before version 148 and Firefox ESR before 140.8, with Firefox 148/ESR 140.8 and Thunderbird updates mitigating it. The connected Amazon Linu...