CVE-2026-8973

CVE-2026-8973 corresponds to memory safety bugs in Mozilla Thunderbird 150. The connected SUSE/NVD/NVD-like entries indicate these bugs show evidence of memory corruption and, with enough effort, could be exploited to run arbitrary code. The advisories state the vulnerability was fixed in Thunder...

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-16362

CVE-2026-16362 is a use-after-free in Firefox’s WebRTC Audio/Video component. The issue affects Firefox and Firefox ESR prior to the listed fixes, with the vulnerability fixed in Firefox 153 and Firefox ESR 140.13. The CVSS–3.1 metrics indicate network attack vector, no privileges, user interacti...

CVE-2026-2764

CVE-2026-2764: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. Affected products include Firefox/Firefox ESR (pre-148 and ESR

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-4720

CVE-2026-4720 is a memory-safety issue affecting Mozilla products (Firefox/Thunderbird). Connected advisories confirm memory-corruption-type bugs in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148, with the practical impact stated as potential arbitrary code execution. ...

CVE-2026-74939

Mozilla Firefox's DOM: Navigation component contains a privilege escalation flaw (CVSS 8.8 HIGH). Exploitation requires a network-based attacker to lure a user into visiting a crafted page. Affected versions must be upgraded to Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 1...

CVE-2026-74979

A mitigation bypass in Firefox/Thunderbird's Add-ons Manager allows a network-based attacker with no privileges to execute arbitrary code, achieving full confidentiality, integrity, and availability impact. Patches are available in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird ...

CVE-2026-74987

CVE-2026-74987 covers internally discovered bugs in Thunderbird ESR 140.13 , Thunderbird ESR 153.0 , and Thunderbird 153 , with some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes that with sufficient effort some could have been exploited. The CVSS 3.1 ...

CVE-2026-8968

Denial-of-service in the Audio/Video: Web Codecs component of Firefox caused by an invalid pointer. Affected product: Firefox WebCodecs; root cause: invalid pointer in the WebCodecs code path. Impact (per CVSS 3.1): HIGH with Availability impact; Attack Vector: NETWORK; Attack Complexity: LOW; Pr...

CVE-2026-8971

The CVE-2026-8971 issue is described across multiple sources as a same-origin policy bypass in the Networking: JAR component, with remediation issued as Firefox 151. The documents do not specify the exact affected product versions beyond Firefox, nor any exploits or in-the-wild use. Root cause de...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2026-12323

CVE-2026-12323 describes a spoofing issue in the DOM: Core & HTML component. The vulnerability affected Mozilla Firefox and Thunderbird and was fixed in Firefox 152 and Thunderbird 152. The available references confirm the DOM spoofing flaw and its patch in version 152. Practical impact is modest...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-4729

CVE-2026-4729 affects Firefox 148 and Thunderbird 148, with memory-safety bugs that could lead to memory corruption and potential arbitrary-code execution. The issues were fixed in Firefox 149 and Thunderbird 149. Mitigation: upgrade to the fixed versions (Firefox 149 / Thunderbird 149). Exploita...

CVE-2026-74941

Mozilla Firefox's CanvasWebGL graphics component allows privilege escalation. Fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. CVSS 8.8 (HIGH) with network attack vector requiring user interaction. No exploitation reported in the wild; users should update to the patched versions. ...

CVE-2026-74950

A privilege escalation flaw in the Downloads API component of Firefox and Thunderbird allows network-based attackers to gain elevated privileges with user interaction. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1; no exploitation evidence reported by CISA. Updat...

CVE-2026-74956

Firefox and Thunderbird's DOM: Service Workers component has a same-origin policy bypass allowing cross-origin data access and manipulation. CVSS 9.1 (critical). Fixed in Firefox 154, ESR 153.1, Thunderbird 154, and 153.1. No exploitation reported in provided documents. Debian/Ubuntu users withou...

CVE-2026-8966

CVE-2026-8966 affects Mozilla Thunderbird (earlier than 151.0) and concerns information disclosure in the IP Protection component. Multiple connected sources corroborate the impact as information disclosure, with the vulnerability fixed in Thunderbird 151 (and Firefox 151 per the initial entry). ...

CVE-2025-11708

CVE-2025-11708 is a use-after-free in MediaTrackGraphImpl::GetInstance() affecting Firefox before version 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird before 140.4. Connected advisories corroborate multiple vendors and distributions addressing these Firefox/Thunderbird m...

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2025-11714

CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2025-14325

CVE-2025-14325 is a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146 and Firefox ESR

CVE-2026-0890

The CVE-2026-0890 entry describes a spoofing issue in the DOM: Copy & Paste and Drag & Drop component affecting Mozilla products. Affected products/components: Firefox (versions before 147) and Firefox ESR (before 140.7); Thunderbird (before 147) and Thunderbird (before 140.7). Root cause and imp...

CVE-2026-12302

CVE-2026-12302 is a mitigation bypass in the DOM: Security component that has been fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. Multiple advisories and vendor notes confirm the patch exists in these versions. Affected products in the conne...

CVE-2026-16353

The CVE-2026-16353 entry concerns Mozilla Firefox/Firefox ESR and the DOM Bindings (WebIDL) component. Affected component: Invalid pointer in the DOM: Bindings (WebIDL). Root cause: invalid pointer handling in the DOM Bindings. Impact: high confidentiality, integrity, and availability (per CVSS 3...

CVE-2026-16380

CVE-2026-16380 describes a mitigation bypass in the Networking component of Mozilla Firefox. The issue is characterized in the sources as a bypass vulnerability that was fixed in Firefox 153. The affected product is Mozilla Firefox; detailed root cause and affected subcomponents are not explicitl...

CVE-2026-2773

CVE-2026-2773 is a Chrome-like vulnerability in Firefox’s Web Audio component caused by incorrect boundary conditions, fixed in Firefox 148 and corresponding ESR releases (ESR 115.33 and ESR 140.8). The issue is documented across multiple advisories (Firefox security notes and vendor feeds) and i...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-74938

A mitigation bypass in the JavaScript: GC component of Firefox and Thunderbird allows remote attackers to bypass memory-protection mitigations, potentially leading to arbitrary code execution. CVSS 9.1 (CRITICAL). Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1 . S...

CVE-2026-74990

CVE-2026-74990 affects Thunderbird ESR 140.13, ESR 153.0, and Thunderbird 153, where internally found bugs showed evidence of memory corruption or security-relevant defects. Mozilla assesses that, with enough effort, some could have been exploitable, scoring it Critical (CVSS 9.8). The vulnerabil...

CVE-2026-0881

CVE-2026-0881 describes a sandbox escape in the Messaging System component affecting Mozilla Firefox and Mozilla Thunderbird before version 147. The root cause is a vulnerability in the Messaging System that can lead to arbitrary code execution with total impact (confidentiality, integrity, and a...

CVE-2026-12303

CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...

CVE-2026-12322

CVE-2026-12322 is a clickjacking vulnerability in the Gtk Widget component affecting Mozilla Firefox and Thunderbird. The issue, described across multiple sources, is due to a UI framing/embedding flaw that could enable deceptive UI interaction. Affected products were updated to mitigate the vuln...

CVE-2026-16374

The CVE-2026-16374 entry concerns information disclosure in the Framework component of Firefox DevTools. Affected product: Mozilla Firefox (DevTools Framework). Root cause/impact: information disclosure; CVSS_BASE score 7.5 (HIGH) with network access and no user interaction. Mitigation: upgrade t...

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-74937

CVE-2026-74937 is a use-after-free vulnerability in the JavaScript: GC component of Mozilla Firefox and Thunderbird . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges required, but user interaction required, leading to high impact on confidentiality, in...

CVE-2026-74954

A side-channel flaw in Firefox/Thunderbird's Storage: Cache API enables network-based information disclosure. Affected versions are fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. No public exploit or in-the-wild exploitation is reported. Users should upgrade to t...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2026-16382

CVE-2026-16382 is a critical mitigation-bypass vulnerability in the Firefox DOM: Service Workers component. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation details are not provided in t...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-4371

CVE-2026-4371 concerns Thunderbird's IMAP parsing. A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer and potentially crash Thunderbird or leak data. Affected are Thunderbird versions prior to 149 and prior to 140.9. Th...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-74947

A privilege escalation flaw in Firefox's Graphics component stems from an invalid pointer. CVSS 8.8 (HIGH) rates network attack vector with no privileges required. Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported; CISA SSVC marks it non-automatable with total techn...