1355 matches found
CVE-2026-8952
CVE-2026-8952 describes a privilege-escalation issue in the Application Update component. Public documentation consistently states the vulnerability was fixed in Firefox 151 and Thunderbird 151. Affected product scope shown in connected sources includes Mozilla Thunderbird versions earlier than 1...
CVE-2025-11714
CVE-2025-11714 is a memory-safety vulnerability in Mozilla Firefox/Thunderbird stack, affecting Firefox and Thunderbird releases older than 144 (and Firefox ESR releases older than 115.29/140.4; Thunderbird ESR releases older than 140.4). The connected documents confirm the issue as memory-corrup...
CVE-2025-14330
CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR
CVE-2026-0882
CVE-2026-0882 : Use-after-free in the IPC component exposed in Firefox < 147, Firefox ESR < 115.32 and < 140.7, Thunderbird < 147 and
CVE-2026-16382
CVE-2026-16382 is a critical mitigation-bypass vulnerability in the Firefox DOM: Service Workers component. The issue affects Firefox versions prior to 153 and is fixed in Firefox 153. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation details are not provided in t...
CVE-2026-74943
A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...
CVE-2026-74963
Firefox and Thunderbird suffer a same-origin policy bypass in their Networking: Cookies component, allowing cross-origin access to cookies. CVSS 5.4 (Medium). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, 153.1. No in-the-wild exploitation reported; user interaction requir...
CVE-2026-74967
Firefox and Thunderbird's Audio/Video: Playback component has a same-origin policy bypass (CVSS 5.4, MEDIUM) exploitable via a crafted page requiring user interaction. Fixed in Firefox 154, Firefox ESR 140.14/153.1, Thunderbird 154, and Thunderbird 140.14/153.1. No in-the-wild exploitation report...
CVE-2026-84140
CVE-2026-84140 is a site isolation issue in the DOM: Navigation component affecting Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Per Kaspersky analysis, this vulnerability enables remote code execution when exploited, allowing arbitrary code to run on the target system. The...
CVE-2026-16393
CVE-2026-16393 affects the Graphics: WebGPU component in Firefox. The root cause is incorrect boundary conditions in this component, leading to a potential impact on confidentiality and availability (C:H I:N A:H) with a high-severity rating (CVSS 3.1: 9.1, Network attack, no user interaction). Th...
CVE-2026-16402
CVE-2026-16402 describes an integer overflow in the Graphics: ImageLib component. The vulnerability is confirmed across multiple advisories and vendors (SUSE, Ubuntu OSV, Debian, EUVD, CIRCL, CVE.org, etc.). The issue is fixed in Firefox version 153. The available connected sources do not provide...
CVE-2026-4371
CVE-2026-4371 concerns Thunderbird's IMAP parsing. A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer and potentially crash Thunderbird or leak data. Affected are Thunderbird versions prior to 149 and prior to 140.9. Th...
CVE-2026-84136
CVE-2026-84136 is a remote code execution vulnerability in the DOM: Navigation component of Mozilla products, affecting Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (before 153.2). Per Kaspersky, it can be exploited remotely to execute arbitrary ...
CVE-2026-16376
CVE-2026-16376 is a denial-of-service vulnerability in the Graphics: WebGPU component of Firefox. Affected software refers to Mozilla Firefox before version 153, where the issue was fixed in Firefox 153. The available sources confirm a DoS impact in the Graphics: WebGPU pipeline but do not provid...
CVE-2026-4718
CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...
CVE-2026-4726
CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...
CVE-2026-74981
Mozilla Firefox and Thunderbird are vulnerable to a site isolation bypass in the Audio/Video: Web Codecs component, allowing cross-origin data access (CVSS 8.1, HIGH). Exploitation requires user interaction; no in-the-wild exploitation is reported. Remediation: upgrade to Firefox 154/ESR 153.1 or...
CVE-2026-8965
CVE-2026-8965 is an information-disclosure vulnerability in the DOM: Security component, affecting Mozilla Firefox and Mozilla Thunderbird up to version 151. The issue is fixed in Firefox 151 and Thunderbird 151. Affected products include Mozilla Firefox earlier than 151.0 and Mozilla Thunderbird...
CVE-2026-0881
CVE-2026-0881 describes a sandbox escape in the Messaging System component affecting Mozilla Firefox and Mozilla Thunderbird before version 147. The root cause is a vulnerability in the Messaging System that can lead to arbitrary code execution with total impact (confidentiality, integrity, and a...
CVE-2026-0889
CVE-2026-0889 describes a Denial-of-Service in the DOM: Service Workers component, affecting Mozilla Firefox and Mozilla Thunderbird versions earlier than 147. The CVE’s publicly documented impact is DoS with the DOM Service Workers, and the related advisory notes advise updating to the latest ve...
CVE-2026-12300
CVE-2026-12300 describes a memory-safety issue that was fixed in Firefox 152 and Thunderbird 152. The available sources confirm the affected products are Mozilla Firefox/Thunderbird, with the underlying problem labeled as a memory safety bug. The CVSS metrics in the initial document indicate a ba...
CVE-2026-16399
Technical details about CVE-2026-16399 are not publicly available in the provided documents. The sources summarize a site isolation issue in the DOM: Navigation component with Firefox fix in version 153. Monitor for updates.
CVE-2026-84141
CVE-2026-84141 is an integer overflow in the Graphics: ImageLib component of Mozilla's image processing library, enabling remote code execution via crafted image content. The vulnerability affects Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (bef...
CVE-2026-12323
CVE-2026-12323 describes a spoofing issue in the DOM: Core & HTML component. The vulnerability affected Mozilla Firefox and Thunderbird and was fixed in Firefox 152 and Thunderbird 152. The available references confirm the DOM spoofing flaw and its patch in version 152. Practical impact is modest...
CVE-2026-16398
CVE-2026-16398 is a site isolation issue in Firefox's Graphics component. Affected product: Mozilla Firefox prior to version 153. Root cause: site isolation in the Graphics component. Impact: confidentiality impact (C), no integrity or availability impact described; CVSSv3.1 shows 7.5 (HIGH) with...
CVE-2026-4727
CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...
CVE-2026-4728
CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...
CVE-2025-14332
CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...
CVE-2026-84138
CVE-2026-84138 is a denial-of-service vulnerability in the PDF Viewer component of Mozilla Firefox and Thunderbird . It was fixed in Firefox 155 and Thunderbird 155 (also in Firefox ESR 115.40, 140.15, 153.2, and Thunderbird 140.15, 153.2 per the associated Nessus plugins). The NVD rates it CVSS ...
CVE-2026-84142
CVE-2026-84142 covers internally discovered bugs in Thunderbird 154 that showed evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with sufficient effort. The fix ships in Thunderbird 155 , Firefox 155 , and corresponding ESR releases...
CVE-2025-11713
CVE-2025-11713: Potential user-assisted code execution via the Copy as cURL feature. Affected products per the sources include Firefox versions prior to 144, Firefox ESR prior to 140.4, Thunderbird versions prior to 144, and Thunderbird prior to 140.4. Root cause: insufficient escaping in the Cop...
CVE-2025-11715
CVE-2025-11715 is part of a family of memory-safety issues affecting Mozilla Firefox and Thunderbird. Connected sources confirm memory safety bugs and memory corruption with potential to execute arbitrary code, affecting Firefox/Thunderbird and their ESR releases prior to version 144 (and ESR 140...
CVE-2026-6781
CVE-2026-6781 is a denial-of-service vulnerability in the Mozilla Firefox/Thunderbird Audio/Video: Playback component. The issue is fixed in Firefox 150 and Thunderbird 150. Affected products are Firefox and Thunderbird; the root cause is described only as a DoS in the playback component, with no...
CVE-2026-84123
CVE-2026-84123 is a privilege escalation vulnerability in Firefox caused by a use-after-free flaw in the Graphics: WebGPU component. The flaw allows an attacker to escalate privileges when a user interacts with a malicious WebGPU workload in the browser. CVSS 3.1 rates it 8.8 (HIGH) with a vector...
CVE-2026-84144
CVE-2026-84144 covers internally found bugs in Mozilla Thunderbird 154 and Thunderbird ESR 153.1 , some showing evidence of memory corruption or other security-relevant defects. The vendor presumes some could have been exploited with sufficient effort. The issue is fixed in Thunderbird 155 , Thun...
CVE-2026-84145
Internally discovered bugs in Firefox 154 , Firefox ESR 153.1 , Firefox ESR 140.14 , and Firefox ESR 115.39 included defects showing evidence of memory corruption or other security-relevant issues. Mozilla noted that with enough effort some of these bugs could potentially have been exploited, tho...
CVE-2026-4724
CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...
CVE-2026-8967
CVE-2026-8967 affects Mozilla graphics stack via the Graphics: WebGPU component, leading to information disclosure. Public documentation in connected sources indicates the vulnerability was fixed in Firefox 151 and Thunderbird 151, with affected products listed as Mozilla Thunderbird and Mozilla ...
CVE-2026-84126
CVE-2026-84126 is a vulnerability in the Layout: Grid component of Firefox , caused by incorrect boundary conditions . The flaw allows a network-based attack with low complexity and no required privileges , but user interaction is required (e.g., visiting a crafted page). The impact is limited to...
CVE-2026-84139
A clickjacking vulnerability in the DOM: Events component affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . It was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability is part of a broader batch of issues disclosed via Mozilla adviso...
CVE-2025-14326
CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird
CVE-2026-12321
Summary: CVE-2026-12321 is a JIT miscompilation in the JavaScript: WebAssembly component. Affected products: Firefox and Thunderbird (WebAssembly/JS engine). Root cause: JIT miscompilation in the WebAssembly component. Impact: Not explicitly quantified beyond miscompilation; CVSS v3.1 base score ...
CVE-2026-5735
CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...
CVE-2026-84122
CVE-2026-84122 is a use-after-free vulnerability in the Audio/Video component of Mozilla Firefox. The flaw was fixed in Firefox 155 , Firefox ESR 140.15 , and Firefox ESR 153.2 . The CVSS 3.1 score is 5.4 (MEDIUM) , requiring user interaction with low impacts to confidentiality and integrity and ...
CVE-2026-84130
CVE-2026-84130 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The flaw can be exploited remotely to obtain sensitive information . The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, lo...
CVE-2026-84125
A use-after-free vulnerability in the DOM: Core & HTML component of Firefox could allow a remote attacker to execute arbitrary code , according to Red Hat's assessment. The CVSS 3.1 score is 5.4 (Medium) with a network attack vector, low complexity, no required privileges, but user interaction re...
CVE-2026-84124
CVE-2026-84124 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox . The CVSS 3.1 score is 5.4 (MEDIUM) , with a network-based attack vector requiring user interaction and no privileges , resulting in low impacts to confidentiality and integrity but no impact to...
CVE-2026-84637
CVE-2026-84637 is a critical (CVSS 9.8) vulnerability in Mozilla Thunderbird where malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows , bypassing Thunderbird's normal executable attachment protections. With the new invitation dis...
CVE-2026-84640
CVE-2026-84640 is a one-byte buffer over-read in the mail header parser of Mozilla Thunderbird, triggered by a maliciously constructed mail header. The vulnerability is rated CVSS 3.1 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N , indicating a network-exploitable flaw requiring...