CVE-2026-12309

CVE-2026-12309 describes a memory-safety bug in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The Debian/Ubuntu/Nessus notes corroborate that Firefox ESR was updated to 140.12.x and Firefox to 152.x, indicating remediat...

CVE-2026-12315

The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...

CVE-2026-12316

CVE-2026-12316 describes a mitigation bypass in the DOM: Security component that was fixed in Mozilla Firefox 152 and Thunderbird 152. The connected documents confirm that this is a software-level patch by Mozilla, addressing a DOM-related security bypass. The vulnerability details in the public ...

CVE-2026-2771

CVE-2026-2771 is an undefined-behavior vulnerability in the DOM: Core & HTML component of Mozilla Firefox/Thunderbird family that was fixed in Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148 and 140.8. The issue is reported across multiple advisories (Astra Linux bulletin and Amazon Li...

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2026-5734

CVE-2026-5734 involves memory safety bugs in Mozilla products. Affected: Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. The issue is addressed by fixes in Firefox 14...

CVE-2026-57963

The CVE-2026-57963 issue affects chat UI in Thunderbird where an attacker able to send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Underlying risk is manipulation of the chat interface and potential phishing wi...

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2025-14325

CVE-2025-14325 is a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146 and Firefox ESR

CVE-2025-14328

CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR

CVE-2026-12306

CVE-2026-12306 is a memory-safety vulnerability fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The connected sources confirm the affected products and versions, with the Debian Fedora OSV entries echoing the same remediation. Practical impact is a potential sec...

CVE-2026-12310

CVE-2026-12310 is a memory-safety bug in Mozilla Firefox/Thunderbird fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction required, and impact limited to confidentiality. The connec...

CVE-2026-6780

CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-12308

CVE-2026-12308 is a memory-safety vulnerability affecting Mozilla Firefox and Thunderbird components. Connected advisories confirm the issue is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s DSA-6350-1 lists CVE-2026-12308 among multiple Firefox ESR fi...

CVE-2026-12327

CVE-2026-12327 relates to memory safety bugs in Mozilla products: Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The issue was fixed in Firefox 152, Firefox ESR ...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-8958

This CVE affects the Firefox Security: Process Sandboxing component and related Thunderbird variants, causing information disclosure and sandbox escape. The NVD/NVDC and CVE records state fixes in Firefox 151 and Firefox ESR 140.11, and in Thunderbird 151 and 140.11, addressing the underlying san...

CVE-2026-0881

CVE-2026-0881 describes a sandbox escape in the Messaging System component affecting Mozilla Firefox and Mozilla Thunderbird before version 147. The root cause is a vulnerability in the Messaging System that can lead to arbitrary code execution with total impact (confidentiality, integrity, and a...

CVE-2026-0886

CVE-2026-0886 : The vulnerability arises from incorrect boundary conditions in the Graphics component, affecting Firefox versions below 147, Firefox ESR below 115.32 and 140.7, and Thunderbird below 147 and 140.7. The connected documents confirm the same issue is referenced across Mozilla advisor...

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-12314

CVE-2026-12314 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird addressed by updates to Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debian’s advisory confirms Firefox ESR 140.12.0esr-1~deb13u1 fixes the issue for firefox-esr in the stable trixie packag...

CVE-2026-12318

CVE-2026-12318 concerns the Mozilla NSS Libraries component. The vulnerability is described as incorrect boundary conditions in the NSS Libraries, with the fixed versions identified as Firefox 152 and Thunderbird 152. Connected sources confirm this fix and cite Firefox/Thunderbird 152 as the reme...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-2766

CVE-2026-2766 is a use-after-free in the JavaScript Engine: JIT component of Firefox/Firefox ESR that was fixed in Firefox 148, ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products in the provided documents include Firefox-based browsers and Thunderbird; multiple advisories (Astra...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-4692

This CVE (CVE-2026-4692) is a confirmed issue in the Responsive Design Mode component, leading to sandbox escape. The primary affected product is Mozilla Firefox (and related ESR builds) with versions prior to the fixed releases: Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9; Thunderbird...

CVE-2026-8968

Denial-of-service in the Audio/Video: Web Codecs component of Firefox caused by an invalid pointer. Affected product: Firefox WebCodecs; root cause: invalid pointer in the WebCodecs code path. Impact (per CVSS 3.1): HIGH with Availability impact; Attack Vector: NETWORK; Attack Complexity: LOW; Pr...

CVE-2026-8970

The CVE describes a privilege-escalation in the Firefox Security component. Concrete detail from sources: the flaw is fixed in Firefox 151 and Firefox ESR 140.11. Affected scope is stated only as the Security component; no deeper root cause, affected subcomponents, or explicit exploit paths are p...

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2025-14331

CVE-2025-14331: Same-origin policy bypass in the Request Handling component affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and

CVE-2026-0880

CVE-2026-0880 is a sandbox-escape vulnerability: sandbox escape due to an integer overflow in the Graphics component. Affected products include Firefox (<147), Firefox ESR (<115.32 and <140.7), Thunderbird (<147 and

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-12302

CVE-2026-12302 is a mitigation bypass in the DOM: Security component that has been fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Multiple advisories and vendor notes confirm the patch exists in these versions. Affected products in the conne...

CVE-2026-2769

CVE-2026-2769 is a use-after-free vulnerability in Firefox’s Storage: IndexedDB component. Affected products are Firefox versions earlier than 148, Firefox ESR earlier than 115.33, and Firefox ESR earlier than 140.8. The issue arises from a memory safety flaw in IndexedDB storage handling, leadin...

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-4721

CVE-2026-4721 refers to memory-safety bugs in Firefox/Thunderbird across Firefox ESR 115.33, ESR 140.8, and Firefox/Thunderbird 148. Some flaws show memory corruption and could be exploitable for arbitrary code with enough effort per the initial entry. The issues were fixed in Firefox 149, Firefo...

CVE-2026-4729

CVE-2026-4729 affects Firefox 148 and Thunderbird 148, with memory-safety bugs that could lead to memory corruption and potential arbitrary-code execution. The issues were fixed in Firefox 149 and Thunderbird 149. Mitigation: upgrade to the fixed versions (Firefox 149 / Thunderbird 149). Exploita...

CVE-2026-57962

CVE-2026-57962 affects Thunderbird’s LDAP address-book autocomplete. A malicious LDAP server can cause the Thunderbird LDAP client to stash attacker-supplied data, enabling memory exhaustion and a denial of service. Root cause is unbounded data processing by the LDAP client when queried by the Th...

CVE-2026-8949

CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...

CVE-2026-8955

CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...

CVE-2026-8957

CVE-2026-8957 involves a privilege-escalation issue in Mozilla Firefox/Thunderbird’s Enterprise Policies component. Affected products include Firefox and Thunderbird, with fixes in Firefox 151 and Firefox ESR 140.11 (and corresponding Thunderbird updates 151/140.11). The vulnerability details in ...

CVE-2026-8961

CVE-2026-8961 is a spoofing issue in the Mozilla form autofill component. Publicly documented fixes apply to Firefox and Thunderbird updates: Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. OpenSUSE and Slackware advisories list Firefox ESR/Thunderbird updates (e.g., fir...

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2025-11714

CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...

CVE-2026-0885

CVE-2026-0885 is a use-after-free in Firefox/Thunderbird’s JavaScript: GC component. Affected: Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, Thunderbird