CVE-2026-12317

CVE-2026-12317 is a memory-safety vulnerability fixed in Firefox 152 and Thunderbird 152. Affected products are Firefox/Thunderbird; root cause is a memory-safety bug.remediation is to upgrade to Firefox 152 / Thunderbird 152 as indicated by multiple advisories (e.g., Mozilla MFSA advisories and ...

CVE-2026-16353

The CVE-2026-16353 entry concerns Mozilla Firefox/Firefox ESR and the DOM Bindings (WebIDL) component. Affected component: Invalid pointer in the DOM: Bindings (WebIDL). Root cause: invalid pointer handling in the DOM Bindings. Impact: high confidentiality, integrity, and availability (per CVSS 3...

CVE-2026-4720

CVE-2026-4720 is a memory-safety issue affecting Mozilla products (Firefox/Thunderbird). Connected advisories confirm memory-corruption-type bugs in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, and Thunderbird 148, with the practical impact stated as potential arbitrary code execution. ...

CVE-2025-10534

CVE-2025-10534 is a spoofing vulnerability in the Site Permissions component affecting Mozilla Firefox and Mozilla Thunderbird. Affected versions are Firefox < 143 and Thunderbird

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-16374

The CVE-2026-16374 entry concerns information disclosure in the Framework component of Firefox DevTools. Affected product: Mozilla Firefox (DevTools Framework). Root cause/impact: information disclosure; CVSS_BASE score 7.5 (HIGH) with network access and no user interaction. Mitigation: upgrade t...

CVE-2026-16380

CVE-2026-16380 describes a mitigation bypass in the Networking component of Mozilla Firefox. The issue is characterized in the sources as a bypass vulnerability that was fixed in Firefox 153. The affected product is Mozilla Firefox; detailed root cause and affected subcomponents are not explicitl...

CVE-2026-16401

Vulnerability CVE-2026-16401 is a privilege-escalation issue in the Data Loss Prevention component affecting Firefox and Thunderbird. The flaw, classified as high impact (CVSSv3.1: 8.8, CONF/I/H/A), is mitigated by upgrading to Firefox 153 and Thunderbird 153. The CVSS vector indicates network at...

CVE-2026-6780

CVE-2026-6780 is a denial-of-service in the Audio/Video: Playback component for Mozilla Firefox/Thunderbird. The vulnerability is addressed in Firefox 150 and Thunderbird 150. The provided sources confirm a fix version but do not include concrete exploit details, affected versions beyond the fix,...

CVE-2026-74973

CVE-2026-74973 is a race condition leading to use-after-free in the Graphics component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 4.2 (Medium) , reflecting a network attack vector with high complexity, required user interaction, and low impact on confidentiality and integrity with ...

CVE-2026-84131

CVE-2026-84131 is a privilege escalation vulnerability in the Graphics component of Firefox , caused by an invalid pointer . According to Red Hat, a local attacker could exploit this to gain unauthorized access to sensitive system resources or execute arbitrary code with elevated permissions. The...

CVE-2025-10530

CVE-2025-10530 describes a spoofing vulnerability in the WebAuthn component of Firefox for Android. Affected products and versions: Firefox < 143 and Thunderbird

CVE-2025-14329

CVE-2025-14329 is a Privilege escalation in the Netmonitor component affecting Firefox/Firefox ESR and Thunderbird (per connected advisories). Affected: Firefox < 146 and Firefox ESR

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-74971

Mozilla Firefox and Thunderbird are vulnerable to information disclosure via the DOM UI Events & Focus Handling component. CVSS 3.1 scores this MEDIUM (4.3) with network attack vector, low complexity, and no privileges required. Exploitation details are not provided in the documents. Affected ver...

CVE-2026-84128

CVE-2026-84128 is a privilege escalation vulnerability in the WebDriver BiDi component of Firefox , fixed in Firefox 155 . The bug is tracked in Mozilla Bugzilla #2044280 and disclosed via MFSA2026-82 . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges r...

CVE-2026-8969

CVE-2026-8969 is a mitigation bypass in the DOM: Security component that was fixed in Firefox 151 and Thunderbird 151. The CVSS 3.1 base vector indicates Network attack vector, no privileges required, user interaction required, with high impact to confidentiality and integrity and no impact on av...

CVE-2025-11710

CVE-2025-11710 is reported across Mozilla products (Firefox and Thunderbird). A compromised web process could abuse malicious IPC messages to cause a privileged browser process to leak memory blocks to the compromised process. Affected: Firefox <144, Firefox ESR <115.29 and <140.4, Thund...

CVE-2025-11716

CVE-2025-11716 affects Firefox and Thunderbird prior to version 144. The issue arises when links in a sandboxed iframe can trigger an external Android app without the required allow- permission, enabling potential unintended app launches. Reported as part of a broader Mozilla 2025- era set of fix...

CVE-2025-14328

CVE-2025-14328: Privilege escalation in the Netmonitor component affects Firefox and Firefox ESR (Firefox < 146; ESR

CVE-2026-12301

CVE-2026-12301 is a memory-safety vulnerability that is fixed in Firefox 152 and Thunderbird 152. The Connected sources consistently describe the issue as a memory-safety bug resolved by upgrading to Firefox 152/Thunderbird 152; no exploitation details are provided in the documents. Affected comp...

CVE-2026-16378

CVE-2026-16378 concerns a DOM-related issue in Firefox’s Copy & Paste and Drag & Drop component. The vulnerability is fixed in Firefox 153. CVSSv3.1 metrics indicate high impact with network attack vector, low complexity, no privileges, and no user interaction required, but the document does not ...

CVE-2026-74966

Firefox and Thunderbird are vulnerable to information disclosure via the Form Autofill component. CVSS 7.5 (network, no auth/interaction required) rates it HIGH for confidentiality. CISA SSVC marks exploitation as none. Fix: upgrade to Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbi...

CVE-2026-74968

Firefox's WebRender component has a site isolation flaw allowing cross-site data access or tampering, rated CVSS 5.4 (Medium). Fixed in Firefox 154 and Firefox ESR 153.1. No in-the-wild exploitation reported. Users should update immediately. Mozilla advisories: mfsa2026-74, mfsa2026-77.

CVE-2026-84143

CVE-2026-84143 covers internally found bugs in Thunderbird 154 , Thunderbird ESR 153.1 , and Thunderbird ESR 140.14 , some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with enough effort, but no confirmed in-the-wild exp...

CVE-2026-8963

CVE-2026-8963 is a Web Speech-related spoofing issue affecting Firefox (and Thunderbird) languages/feature usage. The entry notes an upgrade patch: Firefox 151 and Thunderbird 151 mitigate the vulnerability. The CVSSv3.1 vector in the record indicates a Network-exposed, low-attack-complexity flaw...

CVE-2025-10529

CVE-2025-10529 describes a Same-origin policy bypass in the Firefox/Thunderbird Layout component. The connected sources confirm the vulnerability affects Firefox versions below 143 and Firefox ESR below 140.3, and Thunderbird versions below 143 and below 140.3. The impact is implied by the descri...

CVE-2026-0883

CVE-2026-0883 corresponds to information disclosure in the Networking component affecting Mozilla Firefox versions below 147 (and Firefox ESR below 140.7) and Mozilla Thunderbird versions below 147 (and Thunderbird ESR below 140.7). The linked advisories and Debian advisories list this CVE among ...

CVE-2026-0891

CVE-2026-0891 corresponds to memory-safety bugs in Mozilla products: Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. The issue is described as memory corruption in certain bugs that could, with sufficient effort, be exploited to execute arbitrary code. Affected products...

CVE-2026-0892

CVE-2026-0892 concerns memory safety bugs in Mozilla Firefox and Thunderbird prior to version 147. The CVE description notes memory corruption with potential for arbitrary code execution, affecting Firefox < 147 and Thunderbird

CVE-2026-12303

CVE-2026-12303 concerns information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. The vulnerability affects Firefox and Thunderbird and is fixed in Firefox 152 and Thunderbird 152. Root cause: boundary condition handling in WebGPU. Impact is information disclo...

CVE-2026-12307

CVE-2026-12307 is a memory-safety vulnerability in Mozilla Firefox and Thunderbird that was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Reports from multiple feeds (NVD, Debian, Fedora, OSV) confirm a single fixed public CU for Firefox/Thunderbird. The Debia...

CVE-2026-16364

CVE-2026-16364 describes incorrect boundary conditions in Mozilla Firefox's Audio/Video: Playback component, with impact per sources as a high-severity issue fixed in Firefox 153. Affected product: Mozilla Firefox versions earlier than 153.0. Root cause: boundary-condition error in the Playback s...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-74942

A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...

CVE-2026-74972

Information disclosure in Firefox/Thunderbird's DOM: Push Subscriptions component exposes sensitive data to malicious sites. CVSS 4.3 (MEDIUM), network-reachable with user interaction required. Fixed in Firefox 154, ESR 140.14/153.1, Thunderbird 154/140.14/153.1. No in-the-wild exploitation repor...

CVE-2026-74984

A race condition in the Firefox/Thunderbird JavaScript Engine allows remote attackers (with user interaction) to achieve high confidentiality and integrity impact. CISA reports no exploitation. Remediation: upgrade to Firefox 154, Firefox ESR 153.1, Thunderbird 154, or Thunderbird 153.1.

CVE-2026-84639

CVE-2026-84639 affects Mozilla Thunderbird 's MIME parsing component. Triggering an error condition in certain MIME bodies causes uninitialized memory to be used , leading to a remote denial-of-service as noted by Kaspersky. The CVSS 3.1 score is 9.1 (Critical) with a network attack vector, low c...

CVE-2026-8960

Summary: CVE-2026-8960 is a spoofing issue in WebExtensions that affects Firefox (and Thunderbird per NVD) and was fixed in Firefox 151 and Thunderbird 151. According to the sources, the vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with network attack vector, low attack complexity, no p...

CVE-2025-14323

CVE-2025-14323 describes a privilege-escalation vulnerability in the DOM: Notifications component affecting Firefox < 146, Firefox ESR < 115.31, and Firefox ESR

CVE-2025-14325

CVE-2025-14325 is a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146 and Firefox ESR

CVE-2026-12322

CVE-2026-12322 is a clickjacking vulnerability in the Gtk Widget component affecting Mozilla Firefox and Thunderbird. The issue, described across multiple sources, is due to a UI framing/embedding flaw that could enable deceptive UI interaction. Affected products were updated to mitigate the vuln...

CVE-2026-16409

CVE-2026-16409 is an invalid pointer issue in the Security: PSM component that affects Firefox and Thunderbird. The vulnerability is documented as fixed in Firefox 153 and Thunderbird 153, with a CVSS 3.1 base score of 7.5 (High) and an exploit vector of NETWORK with no user interaction required....

CVE-2026-84133

CVE-2026-84133 is a site isolation issue in the DOM: Push Subscriptions component of Mozilla products. It affects Firefox (fixed in 155), Firefox ESR (fixed in 153.2), Thunderbird (fixed in 155), and Thunderbird ESR (fixed in 153.2). The CNA-assigned CVSS 3.1 score is 9.8 (Critical) with a vector...

CVE-2026-84134

CVE-2026-84134 is an issue in the Profile Backup component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The NVD description labels it as an "Other issue," while Kaspersky characterizes it as a denial of service vulnerability exploitable remotely. It carries a CVSS 9.8 (CRITI...

CVE-2026-84137

CVE-2026-84137 is a spoofing (Security UI) vulnerability in the DOM: Core & HTML component of Mozilla products, allowing an attacker to spoof the user interface. It was fixed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Notably, NVD assigns a 4.3 (Medium) score w...

CVE-2026-8964

The CVE-2026-8964 entry describes a spoofing issue in the Popup Blocker component. The vulnerability is stated to be fixed in Firefox 151 and Thunderbird 151, indicating a patch/upgrade is available for mitigation. The available data list the impact as high (I: High) with a network attack vector ...

CVE-2026-12319

CVE-2026-12319 is a reported DoS in the Audio/Video: Playback component. Multiple connected sources confirm the issue affects Firefox and Thunderbird and that it was fixed in Firefox 152 and Thunderbird 152. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges...

CVE-2026-74982

CVE-2026-74982 is a denial-of-service vulnerability in the Widget component of Firefox and Thunderbird . The CVSS 3.1 score is 7.5 (High) , with a network attack vector requiring no privileges or user interaction, resulting in high availability impact. CISA's SSVC assessment indicates no known ex...