1355 matches found
CVE-2026-0887
The PDF Viewer component in Firefox , Firefox ESR , and Thunderbird is vulnerable to a clickjacking issue and information disclosure . This vulnerability affects versions prior to Firefox 147 , Firefox ESR 140.7 , Thunderbird 147 , and Thunderbird 140.7 . Affected versions include those found in ...
CVE-2026-12317
CVE-2026-12317 is a memory-safety vulnerability fixed in Firefox 152 and Thunderbird 152. Affected products are Firefox/Thunderbird; root cause is a memory-safety bug.remediation is to upgrade to Firefox 152 / Thunderbird 152 as indicated by multiple advisories (e.g., Mozilla MFSA advisories and ...
CVE-2026-16353
Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-2776
CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...
CVE-2026-4720
Memory safety bugs exist in Firefox ESR 140.8 , Thunderbird ESR 140.8 , Firefox 148 , and Thunderbird 148 . These vulnerabilities involve memory corruption , which could potentially be exploited to execute arbitrary code with sufficient effort. The issues are addressed in versions Firefox 149 , F...
CVE-2026-84128
CVE-2026-84128 is a privilege escalation vulnerability in the WebDriver BiDi component of Firefox , fixed in Firefox 155 . The bug is tracked in Mozilla Bugzilla #2044280 and disclosed via MFSA2026-82 . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges r...
CVE-2025-10530
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
CVE-2025-14329
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14333
CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...
CVE-2026-16374
CVE-2026-16374 is an information disclosure vulnerability located in the Framework component of DevTools within the Firefox browser and Thunderbird mail client. The flaw was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . No specific exploit information ...
CVE-2026-16380
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16401
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-2793
CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...
CVE-2026-6780
Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-74973
CVE-2026-74973 is a race condition leading to use-after-free in the Graphics component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 4.2 (Medium) , reflecting a network attack vector with high complexity, required user interaction, and low impact on confidentiality and integrity with ...
CVE-2026-84131
CVE-2026-84131 is a privilege escalation vulnerability in the Graphics component of Firefox , caused by an invalid pointer . According to Red Hat, a local attacker could exploit this to gain unauthorized access to sensitive system resources or execute arbitrary code with elevated permissions. The...
CVE-2025-11716
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
CVE-2026-74971
Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...
CVE-2026-84143
CVE-2026-84143 covers internally found bugs in Thunderbird 154 , Thunderbird ESR 153.1 , and Thunderbird ESR 140.14 , some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with enough effort, but no confirmed in-the-wild exp...
CVE-2026-8969
Mozilla Firefox and Thunderbird are affected by a mitigation bypass within the DOM: Security component (CVE-2026-8969). The vulnerability stems from a lack of data security mechanisms , which could allow a malicious actor to access confidential data and compromise its integrity . This issue was a...
CVE-2025-11710
CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...
CVE-2025-14328
CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR
CVE-2026-12301
CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...
CVE-2026-12307
CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...
CVE-2026-16378
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-74966
Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74968
Firefox's WebRender component has a site isolation flaw allowing cross-site data access or tampering, rated CVSS 5.4 (Medium). Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported. Users should update immediately. Mozilla advisories: mfsa2026-74, mfsa2026-77.
CVE-2026-84134
CVE-2026-84134 is an issue in the Profile Backup component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The NVD description labels it as an "Other issue," while Kaspersky characterizes it as a denial of service vulnerability exploitable remotely. It carries a CVSS 9.8 (CRITI...
CVE-2026-84639
CVE-2026-84639 affects Mozilla Thunderbird 's MIME parsing component. Triggering an error condition in certain MIME bodies causes uninitialized memory to be used , leading to a remote denial-of-service as noted by Kaspersky. The CVSS 3.1 score is 9.1 (Critical) with a network attack vector, low c...
CVE-2026-8963
The Firefox web browser and Thunderbird email client are affected by a spoofing vulnerability in the Web Speech component. This security flaw allows a malicious actor to bypass authentication through spoofing, which can result in a compromise of data integrity . The issue was addressed in Firefox...
CVE-2025-10529
CVE-2025-10529 describes a Same-origin policy bypass in the Firefox/Thunderbird Layout component. The connected sources confirm the vulnerability affects Firefox versions below 143 and Firefox ESR below 140.3, and Thunderbird versions below 143 and below 140.3. The impact is implied by the descri...
CVE-2026-0883
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
CVE-2026-0891
Memory safety bugs in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR permit the execution of operations beyond the buffer in memory. This vulnerability affects Firefox < 147 , Firefox ESR < 140.7 , Thunderbird < 147 , and Thunderbird ESR
CVE-2026-0892
Mozilla Firefox and Thunderbird versions 146 are affected by memory safety bugs that can result in memory corruption . If successfully exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the system. These issues were addressed and fixed in Firefox version 147 and...
CVE-2026-12303
CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...
CVE-2026-16364
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-2772
CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...
CVE-2026-74942
Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74972
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74984
A race condition in the Firefox/Thunderbird JavaScript Engine allows remote attackers (with user interaction) to achieve high confidentiality and integrity impact. CISA reports no exploitation. Remediation: upgrade to Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbird 153.1.
CVE-2026-84133
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-8952
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8960
Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2025-14323
CVE-2025-14323 describes a privilege-escalation vulnerability in the DOM: Notifications component affecting Firefox < 146, Firefox ESR < 115.31, and Firefox ESR
CVE-2025-14325
A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of Mozilla Firefox and Thunderbird. The root cause is related to improper code generation management , which could allow a remote attacker to execute arbitrary code . This vulnerability affects Firefox < 146 , Fi...
CVE-2026-0882
A use-after-free vulnerability exists in the IPC component of Mozilla Firefox , Firefox ESR , and Thunderbird . Exploiting this flaw could allow a remote attacker to achieve arbitrary code execution on the target system, potentially compromising the confidentiality, integrity, and accessibility o...
CVE-2026-12322
CVE-2026-12322 is a clickjacking vulnerability in the Gtk Widget component affecting Mozilla Firefox and Thunderbird. The issue, described across multiple sources, is due to a UI framing/embedding flaw that could enable deceptive UI interaction. Affected products were updated to mitigate the vuln...
CVE-2026-16409
Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.