1309 matches found
CVE-2026-8960
Summary: CVE-2026-8960 is a spoofing issue in WebExtensions that affects Firefox (and Thunderbird per NVD) and was fixed in Firefox 151 and Thunderbird 151. According to the sources, the vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no p...
CVE-2025-14323
CVE-2025-14323 describes a privilege-escalation vulnerability in the DOM: Notifications component affecting Firefox < 146, Firefox ESR < 115.31, and Firefox ESR
CVE-2026-0879
CVE-2026-0879 is a sandbox escape in the Graphics component that affects Firefox and Thunderbird prior to certain versions. Concrete details from connected documents show: the vulnerability is described as a Sandbox escape due to incorrect boundary conditions in the Graphics component, affecting ...
CVE-2026-12319
CVE-2026-12319 is a reported DoS in the Audio/Video: Playback component. Multiple connected sources confirm the issue affects Firefox and Thunderbird and that it was fixed in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges...
CVE-2026-74944
CVE-2026-74944 is a use-after-free in Firefox/Thunderbird's DOM: Core & HTML component, rated Critical (CVSS 9.8, network-exploitable, no auth or user interaction required). It enables arbitrary code execution, privilege escalation, and information disclosure. Affected versions: Firefox <154, ...
CVE-2026-74955
Mozilla Firefox's Request Handling component contains a privilege escalation flaw rated CVSS 8.8 (HIGH). Exploitation requires network access and user interaction but no prior privileges, with HIGH impacts to confidentiality, integrity, and availability. No in-the-wild exploitation is reported. R...
CVE-2026-74961
CVE-2026-74961 is a side-channel vulnerability in the Web Audio component of Mozilla Firefox and Thunderbird. It is rated CVSS 9.1 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on both confidentiality and integrity. The flaw allows an attacke...
CVE-2026-8964
The CVE-2026-8964 entry describes a spoofing issue in the Popup Blocker component. The vulnerability is stated to be fixed in Firefox 151 and Thunderbird 151, indicating a patch/upgrade is available for mitigation. The available data list the impact as high (I: High) with a network attack vector ...
CVE-2025-14332
CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...
CVE-2026-0882
CVE-2026-0882 : Use-after-free in the IPC component exposed in Firefox < 147, Firefox ESR < 115.32 and < 140.7, Thunderbird < 147 and
CVE-2026-0892
CVE-2026-0892 concerns memory safety bugs in Mozilla Firefox and Thunderbird prior to version 147. The CVE description notes memory corruption with potential for arbitrary code execution, affecting Firefox < 147 and Thunderbird
CVE-2026-12300
CVE-2026-12300 describes a memory-safety issue that was fixed in Firefox 152 and Thunderbird 152. The available sources confirm the affected products are Mozilla Firefox/Thunderbird, with the underlying problem labeled as a memory safety bug. The CVSS metrics in the initial document indicate a ba...
CVE-2026-2790
CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...
CVE-2026-74949
CVE-2026-74949 is a privilege escalation vulnerability in Mozilla Firefox and Thunderbird caused by a use-after-free in the Graphics: Canvas2D component. The CVSS 3.1 score is 8.8 (HIGH) , with a network attack vector requiring user interaction but no privileges. Successful exploitation could lea...
CVE-2026-74965
A privilege escalation vulnerability exists in the Shell Integration component of Firefox and Thunderbird. CVSS 8.8 (HIGH) with network attack vector, no privileges required and user interaction needed. CISA reports no known exploitation. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbir...
CVE-2026-8965
CVE-2026-8965 is an information-disclosure vulnerability in the DOM: Security component, affecting Mozilla Firefox and Mozilla Thunderbird up to version 151. The issue is fixed in Firefox 151 and Thunderbird 151. Affected products include Mozilla Firefox earlier than 151.0 and Mozilla Thunderbird...
CVE-2026-8969
CVE-2026-8969 is a mitigation bypass in the DOM: Security component that was fixed in Firefox 151 and Thunderbird 151. The CVSS 3.1 base vector indicates Network attack vector, no privileges required, user interaction required, with high impact to confidentiality and integrity and no impact on av...
CVE-2026-12321
Summary: CVE-2026-12321 is a JIT miscompilation in the JavaScript: WebAssembly component. Affected products: Firefox and Thunderbird (WebAssembly/JS engine). Root cause: JIT miscompilation in the WebAssembly component. Impact: Not explicitly quantified beyond miscompilation; CVSS v3.1 base score ...
CVE-2026-16393
CVE-2026-16393 affects the Graphics: WebGPU component in Firefox. The root cause is incorrect boundary conditions in this component, leading to a potential impact on confidentiality and availability (C:H I:N A:H) with a high-severity rating (CVSS 3.1: 9.1, Network attack, no user interaction). Th...
CVE-2026-16399
Technical details about CVE-2026-16399 are not publicly available in the provided documents. The sources summarize a site isolation issue in the DOM: Navigation component with Firefox fix in version 153. Monitor for updates.
CVE-2026-4718
CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...
CVE-2026-4728
CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...
CVE-2026-74952
Mozilla Firefox's Application Update component is affected by a privilege escalation flaw rated CVSS 8.8 (HIGH), exploitable remotely with no privileges but requiring user interaction. The vulnerability allows full confidentiality, integrity, and availability impact. It is fixed in Firefox 154 , ...
CVE-2025-11713
CVE-2025-11713: Potential user-assisted code execution via the Copy as cURL feature. Affected products per the sources include Firefox versions prior to 144, Firefox ESR prior to 140.4, Thunderbird versions prior to 144, and Thunderbird prior to 140.4. Root cause: insufficient escaping in the Cop...
CVE-2025-11715
CVE-2025-11715 is part of a family of memory-safety issues affecting Mozilla Firefox and Thunderbird. Connected sources confirm memory safety bugs and memory corruption with potential to execute arbitrary code, affecting Firefox/Thunderbird and their ESR releases prior to version 144 (and ESR 140...
CVE-2026-16398
CVE-2026-16398 is a site isolation issue in Firefox's Graphics component. Affected product: Mozilla Firefox prior to version 153. Root cause: site isolation in the Graphics component. Impact: confidentiality impact (C), no integrity or availability impact described; CVSSv3.1 shows 7.5 (HIGH) with...
CVE-2026-74940
CVE-2026-74940 is a use-after-free vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird . It carries a CVSS 3.1 score of 9.8 (Critical) with a network attack vector requiring no privileges or user interaction. The Debian advisory notes that the vulnerability could pote...
CVE-2026-74953
Firefox's Networking: Cookies component has a privilege escalation flaw. Exploitation requires user interaction (CVSS 8.8 HIGH). Patch available in Firefox 154, ESR 140.14, and ESR 153.1. No in-the-wild exploitation reported; root cause not specified in documents.
CVE-2026-74962
CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...
CVE-2026-74983
CVE-2026-74983 is a mitigation bypass in the Data Loss Prevention component of Mozilla Firefox and Thunderbird. The vulnerability allows an attacker to circumvent the DLP mechanism, potentially enabling unauthorized data exfiltration. The CVSS v3.1 score is 8.1 (HIGH) with a vector of AV:N/AC:L/P...
CVE-2026-16402
CVE-2026-16402 describes an integer overflow in the Graphics: ImageLib component. The vulnerability is confirmed across multiple advisories and vendors (SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, CVE.org, etc.). The issue is fixed in Firefox version 153. The available connected sources do not provide...
CVE-2026-8967
CVE-2026-8967 affects Mozilla graphics stack via the Graphics: WebGPU component, leading to information disclosure. Public documentation in connected sources indicates the vulnerability was fixed in Firefox 151 and Thunderbird 151, with affected products listed as Mozilla Thunderbird and Mozilla ...
CVE-2026-16376
CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Firefox. Affected software refers to Mozilla Firefox before version 153, where the issue was fixed in Firefox 153. The available sources confirm a DoS impact in the Graphics: WebGPU pipeline but do not provid...
CVE-2026-16409
CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....
CVE-2026-4727
CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...
CVE-2026-74967
Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...
CVE-2026-74989
CVE-2026-74989 affects Thunderbird 153 and Firefox 153 , encompassing internally discovered bugs that exhibited evidence of memory corruption or other security-relevant defects. Mozilla presumes that with sufficient effort, some of these bugs could have been exploited to achieve remote code execu...
CVE-2025-14326
CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird
CVE-2026-0889
CVE-2026-0889 describes a Denial-of-Service in the DOM: Service Workers component, affecting Mozilla Firefox and Mozilla Thunderbird versions earlier than 147. The CVE’s publicly documented impact is DoS with the DOM Service Workers, and the related advisory notes advise updating to the latest ve...
CVE-2026-16378
CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...
CVE-2026-4724
CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...
CVE-2026-5735
CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...
CVE-2026-6781
CVE-2026-6781 is a denial-of-service vulnerability in the Mozilla Firefox/Thunderbird Audio/Video: Playback component. The issue is fixed in Firefox 150 and Thunderbird 150. Affected products are Firefox and Thunderbird; the root cause is described only as a DoS in the playback component, with no...
CVE-2026-74964
An integer overflow in Firefox/Thunderbird's Graphics component (CVSS 9.8 critical, network-exploitable with no privileges) enables arbitrary code execution, information disclosure, and denial of service. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154/140.14/153.1; Debian stable ...
CVE-2026-74969
CVE-2026-74969 is a use-after-free vulnerability in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird. It carries a CVSS 3.1 score of 8.8 (HIGH) with a network attack vector, low complexity, no privileges required, and user interaction required, impacting confidentiality, in...
CVE-2026-74971
Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...
CVE-2026-74988
CVE-2026-74988 covers internally found bugs in Thunderbird ESR 153.0 , Thunderbird 153 , Firefox ESR 153.0 , and Firefox 153 . Some of these bugs showed evidence of memory corruption or another security-relevant defect, and Mozilla presumes that with enough effort some could have been exploited. ...
CVE-2026-74943
A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...
CVE-2026-74946
A privilege escalation flaw in Firefox/Thunderbird's Graphics: CanvasWebGL component stems from incorrect boundary conditions. CVSS 8.8 (HIGH) with no privileges required and user interaction needed. Patched in Firefox 154, ESR 115.39/140.14/153.1, and Thunderbird 154/140.14/153.1. No active expl...