CVE-2026-74976

The JavaScript Engine: JIT component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a JIT miscompilation flaw (CVE-2026-74976). This issue is addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While sever...

CVE-2026-74984

A race condition vulnerability exists in the JavaScript Engine component of several Mozilla products. This flaw, identified as CVE-2026-74984 , was patched in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . The vulnerability is characterized as CWE-362 (Concurrent Exec...

CVE-2026-8946

The Audio/Video: Web Codecs component in the Firefox web browser and Thunderbird email client is susceptible to a vulnerability caused by incorrect boundary conditions . This flaw allows a remote attacker to perform arbitrary code execution by triggering operations outside the buffer in memory. T...

CVE-2026-8955

A privilege escalation vulnerability exists in the DOM: Workers component of the Firefox web browser and Thunderbird email client. The flaw is caused by insecure management of privileges , which could allow a malicious actor to cause service interruptions or trigger service failures. This issue h...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird

CVE-2026-16362

A use-after-free vulnerability exists in the WebRTC: Audio/Video component of the Mozilla Firefox and Thunderbird browsers. This security flaw could potentially allow for the execution of arbitrary code. The issue has been resolved in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 ...

CVE-2026-74942

A privilege escalation vulnerability exists in the Remote Settings Client component of the Firefox browser and Thunderbird mail client. The vulnerability affects multiple versions and has been addressed in Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154...

CVE-2026-74953

A privilege escalation vulnerability exists in the Networking: Cookies component of Mozilla Firefox and Mozilla Thunderbird . The flaw was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . No specific root cause or e...

CVE-2026-92071

A sandbox escape vulnerability exists in the Widget: Win32 component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw allows an attacker to escape the sandbox environment, potentially leading to broader system impact. The issue was addressed in Firefox 156 , Firefox ESR ...

CVE-2026-92079

A mitigation bypass exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird . This vulnerability impacts several versions and was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific root cause is not detailed beyond the comp...

CVE-2008-4061

CVE-2008-4061: An integer overflow in the MathML component of Mozilla Firefox can be triggered by an mtd element with a large rowspan value. Affects Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12. Impact: remote memory corruption, denial of ...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...

CVE-2025-4085

The Firefox web browser and Thunderbird email client are affected by a vulnerability involving insecure management of privileges. An attacker who gains control over a content process can leverage the privileged UITour actor to leak sensitive information or escalate privileges. This flaw impacts v...

CVE-2025-4089

Mozilla Firefox and Thunderbird are vulnerable to local code execution due to insufficient escaping of special characters in the "copy as cURL" feature. An attacker could trick a user into executing a manipulated command, potentially leading to the execution of arbitrary code on the user's system...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-12313

A vulnerability in the Security: Process Sandboxing component of Mozilla Firefox and Mozilla Thunderbird products allows for information disclosure and a sandbox escape . The issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Specific details...

CVE-2026-16386

CVE-2026-16386 is an information disclosure vulnerability caused by uninitialized memory within the Graphics: WebGPU component. This issue was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or technical root causes beyond the memory initialization error are provided in...

CVE-2026-74982

CVE-2026-74982 describes a Denial-of-Service (DoS) vulnerability within the Widget component of the Mozilla software suite. This issue was addressed in several versions, including Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . The vulnerability is associated with CWE-...

CVE-2026-84126

The Firefox and Thunderbird browsers are affected by a vulnerability involving incorrect boundary conditions in the Layout: Grid component . The issue has been remediated in Firefox 155 and Thunderbird 155 . While the vulnerability was identified as having a Medium base severity (CVSS 4.3) and a ...

CVE-2026-6755

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by a mitigation bypass in the DOM: postMessage component. This vulnerability allows a malicious actor to remotely trigger a service failure . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploita...

CVE-2026-74972

A vulnerability in the DOM: Push Subscriptions component of the Mozilla Firefox browser and Mozilla Thunderbird mail client leads to information disclosure . This issue was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 1...

CVE-2026-74973

A race condition and use-after-free vulnerability exists in the Graphics component of Firefox and Thunderbird . This flaw affects several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , and the corresponding versions of Thunderbird . Remediation is ...

CVE-2026-74981

A site isolation issue exists in the Audio/Video: Web Codecs component of certain Mozilla products. This vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the provided documents confirm the existence of the vulnerability and the ...

CVE-2026-8950

A Same-origin policy bypass exists in the Networking: HTTP component of the Firefox web browser and Thunderbird email client. The vulnerability is caused by a lack of mechanisms for verifying the source of data , which could allow an attacker to gain access to confidential data and compromise dat...

CVE-2026-92051

The Mozilla Firefox and Thunderbird applications are affected by a spoofing issue within the Graphics component caused by an invalid pointer . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided in the documents, the vulnerability ...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-16370

CVE-2026-16370 identifies a mitigation bypass within the DOM: Networking component. This vulnerability affects the Mozilla Firefox and Mozilla Thunderbird browsers. The issue was officially addressed and fixed in Firefox 153 and Thunderbird 153 . No specific exploit details or in-the-wild exploit...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-74968

A site isolation issue exists in the Graphics: WebRender component of certain Mozilla products. This vulnerability is addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Information regarding specific exploit vectors or in-the-wild exploitation is not provided...

CVE-2026-8094

The WebRTC component in Mozilla Firefox ESR and the Thunderbird email client is vulnerable to a flaw caused by incorrect code generation . This vulnerability allows a remote attacker to achieve arbitrary code execution . Remediation is available in Firefox ESR 140.10.2 and Thunderbird 140.10.2 . ...

CVE-2026-84130

A vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure . This issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Exploitation details are not provided in the documents.

CVE-2026-8974

Memory safety bugs in Firefox ESR 140.10 , Firefox 150 , Thunderbird 140.10 , and Thunderbird 150 can lead to memory corruption. If successfully exploited with significant effort, these vulnerabilities could allow an attacker to execute arbitrary code . The issues are addressed in Firefox 151 , F...

CVE-2026-92019

A mitigation bypass vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Mozilla Thunderbird . This issue is present in various versions, including Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3, and Thunderbird 156, 140.16, and 153.3. The vulnerability was addresse...

CVE-2026-92041

A mitigation bypass vulnerability exists in the DOM: Networking component of the Firefox browser. This issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While specific technical root causes or exploit details are not provided, the vulnerability is ...

CVE-2026-92047

A privilege escalation vulnerability exists in the Crash Reporting component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The vulnerability was addressed in the aforementioned release...

CVE-2026-12306

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability affects multiple versions, including Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. While the specific root cause is described generally as a memory safety i...

CVE-2026-12328

Memory safety bugs exist in Firefox ESR 115.36 , Firefox ESR 140.11 , Thunderbird ESR 140.11 , Firefox 151 , and Thunderbird 151 . These vulnerabilities may result in memory corruption, which could potentially be exploited to execute arbitrary code with sufficient effort. Remediation is available...

CVE-2026-8953

A sandbox escape vulnerability exists in the Disability Access APIs component due to a use-after-free condition. This flaw affects the Firefox web browser (including Firefox ESR ) and the Thunderbird email client. Exploitation of this vulnerability could allow an attacker to escape the sandbox en...

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2025-4090

A vulnerability in Thunderbird for Android allows potentially sensitive library locations to be leaked via Logcat logs. This issue also impacts Firefox versions prior to 138 . The root cause involves the improper logging of internal paths, which could potentially provide information to an attacke...

CVE-2025-5272

Mozilla Firefox and Thunderbird versions prior to 139 (specifically version 138) are affected by memory safety bugs . These vulnerabilities involve memory corruption, which could potentially allow an attacker to execute arbitrary code with sufficient effort. The issue is mitigated by updating to ...

CVE-2026-16359

The Audio/Video: GMP component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw can lead to security risks, including potential arbitrary code execution, as indicated by related security advisories. The vulnerability has been addressed in Firefox 153 , Firefox...

CVE-2026-16366

CVE-2026-16366 identifies a privilege escalation vulnerability within the DOM: Navigation component . This security flaw has been addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the available documentation.

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

CVE-2026-84122

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The issue is resolved in Firefox 155 , Firefox ESR 140.1...

CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...