CVE-2026-75874

A critical (CVSS 10.0) sandbox escape in Firefox and Thunderbird's Remote Settings Client component allows remote, unauthenticated attackers to break out of the application sandbox and achieve full system compromise. No exploitation has been reported, but the flaw affects any Firefox/Thunderbird ...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2025-4086

CVE-2025-4086 affects Thunderbird for Android and Firefox/ Thunderbird versions earlier than 138. The issue is triggered by a filename containing a large number of encoded newline characters that can obscure the file extension in the download dialog, potentially misleading users about the downloa...

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2026-6750

CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...

CVE-2026-74990

CVE-2026-74990 affects Thunderbird ESR 140.13, ESR 153.0, and Thunderbird 153, where internally found bugs showed evidence of memory corruption or security-relevant defects. Mozilla assesses that, with enough effort, some could have been exploitable, scoring it Critical (CVSS 9.8). The vulnerabil...

CVE-2026-12315

The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...

CVE-2026-16360

Memory safety bugs found in Mozilla Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152, with evidence of memory corruption and potential remote code execution. The issues were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected product family: Mozilla Firefox ESR (olde...

CVE-2026-16387

CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...

CVE-2026-6755

CVE-2026-6755 describes a mitigation bypass in the DOM: postMessage component. Affected products reference Mozilla Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 6.5 (Network attack vector, Low attack complexity, Privileges requ...

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2026-16381

CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...

CVE-2026-8946

The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2026-16389

CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-74987

CVE-2026-74987 covers internally discovered bugs in Thunderbird ESR 140.13 , Thunderbird ESR 153.0 , and Thunderbird 153 , with some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes that with sufficient effort some could have been exploited. The CVSS 3.1 ...

CVE-2026-74989

CVE-2026-74989 affects Thunderbird 153 and Firefox 153 , encompassing internally discovered bugs that exhibited evidence of memory corruption or other security-relevant defects. Mozilla presumes that with sufficient effort, some of these bugs could have been exploited to achieve remote code execu...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2026-16396

CVE-2026-16396 is a privilege-escalation issue in WebExtensions that affects Mozilla Firefox and Thunderbird components. Public advisories indicate the vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS data from the initial document show...

CVE-2026-74935

Mozilla Firefox's DOM Networking component has a privilege escalation flaw, scoring CVSS 8.8 (HIGH). An attacker can trigger it via a malicious webpage (network vector, low complexity). Affected users should upgrade to Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1. No in-the-wild exploitation...

CVE-2026-74937

CVE-2026-74937 is a use-after-free vulnerability in the JavaScript: GC component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges required, but user interaction required, leading to high impact on confidentiality, in...

CVE-2026-8954

CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...

CVE-2026-8955

CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...

CVE-2026-12299

CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...

CVE-2026-74961

CVE-2026-74961 is a side-channel vulnerability in the Web Audio component of Mozilla Firefox and Thunderbird. It is rated CVSS 9.1 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on both confidentiality and integrity. The flaw allows an attacke...

CVE-2026-74988

CVE-2026-74988 covers internally found bugs in Thunderbird ESR 153.0 , Thunderbird 153 , Firefox ESR 153.0 , and Firefox 153 . Some of these bugs showed evidence of memory corruption or another security-relevant defect, and Mozilla presumes that with enough effort some could have been exploited. ...

CVE-2025-10536

Mode C: CVE-2025-10536 is an Information disclosure in the Networking: Cache component affecting Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird

CVE-2025-8044

CVE-2025-8044 corresponds to memory safety bugs found in Firefox 140 and Thunderbird 140, with memory corruption evidence and a potential to allow arbitrary code execution. Affected products are Firefox and Thunderbird versions earlier than 141. The consolidated sources indicate the issues are me...

CVE-2026-14899

The CVE-2026-14899 issue is a memory-safe vulnerability in Thunderbird’s MIME header parser when forwarding messages with headers visible. An off-by-one error could allow reading a byte beyond the header buffer, potentially causing a crash. Affected component: Thunderbird MIME header parsing duri...

CVE-2026-16363

The CVE-2026-16363 entry describes a JIT miscompilation vulnerability in the JavaScript: WebAssembly component of Mozilla Firefox. Affected product is Firefox and Firefox ESR; the root cause is a miscompilation in the JavaScript/WebAssembly engine. The vulnerability is rated critical (CVSS v3.1: ...

CVE-2026-16371

CVE-2026-16371: Privilege escalation in the DOM: Navigation component. The Mozilla advisories indicate this affects Firefox and Thunderbird products and is fixed in Firefox 153 / ESR 140.13 and Thunderbird 153 / 140.13. Remediation: upgrade to Firefox 153 (or ESR 140.13) and Thunderbird 153 (or 1...

CVE-2026-74938

A mitigation bypass in the JavaScript: GC component of Firefox and Thunderbird allows remote attackers to bypass memory-protection mitigations, potentially leading to arbitrary code execution. CVSS 9.1 (CRITICAL). Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1 . S...

CVE-2025-10533

CVE-2025-10533 describes an integer overflow in the SVG component affecting Firefox before 143, Firefox ESR before 115.28 and 140.3, Thunderbird before 143 and 140.3. Connected sources confirm the same vulnerability details. The Astra Linux security bulletin echoes this issue and lists the affect...

CVE-2026-12298

CVE-2026-12298 is a memory-safety bug affecting Firefox and Thunderbird components, with fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Connected advisories (ALSA/RLSA/SUSE/Fedora/Red Hat) enumerate the same CVE among a broader set of related issues and indicat...

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-84129

CVE-2026-84129 is a site isolation issue in the DOM: Navigation component of Mozilla's browser and email products. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity,...

CVE-2025-10527

The CVE-2025-10527 entry corresponds to a sandbox escape via use-after-free in the Graphics: Canvas2D component. Affected products include Firefox <143, Firefox ESR <140.3, Thunderbird <143, and Thunderbird

CVE-2026-8953

CVE-2026-8953 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. Affected products include Firefox (fixed in Firefox 151) and Firefox ESR (115.36, 140.11), as well as Thunderbird (151, 140.11). The public records indicate a memory-unsafe defect in the D...

CVE-2026-0877

CVE-2026-0877 is a mitigation bypass in the DOM: Security component, affecting Firefox versions below 147, including Firefox ESR <115.32 and ESR

CVE-2026-16384

CVE-2026-16384 : Information disclosure caused by uninitialized memory in Firefox’s Graphics: WebGPU component. Affected product: Firefox (Graphics: WebGPU). Root cause: uninitialized memory leading to potential leakage. Impact per CVSS: Confidentiality High; no integrity/availability impact repo...

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-74956

Firefox and Thunderbird's DOM: Service Workers component has a same-origin policy bypass allowing cross-origin data access and manipulation. CVSS 9.1 (critical). Fixed in Firefox 154, ESR 153.1, Thunderbird 154, and 153.1. No exploitation reported in provided documents. Debian/Ubuntu users withou...

CVE-2026-74979

A mitigation bypass in Firefox/Thunderbird's Add-ons Manager allows a network-based attacker with no privileges to execute arbitrary code, achieving full confidentiality, integrity, and availability impact. Patches are available in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ...

CVE-2026-12310

CVE-2026-12310 is a memory-safety bug in Mozilla Firefox/Thunderbird fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction required, and impact limited to confidentiality. The connec...

CVE-2026-12325

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...

CVE-2026-16410

CVE-2026-16410: A JIT miscompilation in the JavaScript Engine's JIT component of Firefox was fixed in Firefox 153. Affected versions are prior to 153; use of the vulnerable JIT code could lead to high-severity impact per reported CVSS metrics (CRITICAL, HIGH confidentiality, integrity, availabili...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...