CVE-2026-0880

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird due to an integer overflow (numerical overflow). This flaw can allow an attacker to execute arbitrary code on a system or disclose sensitive information. Affected versions include Firefox < 147, ...

CVE-2026-100810

An issue exists within the DevTools component in Mozilla Firefox and Thunderbird . This vulnerability affects versions prior to 157 . The impact of this vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8 , potentially leading to high confidentiality, integrity, and availability impac...

CVE-2026-92026

A use-after-free vulnerability exists in the Networking component of the Mozilla Firefox and Thunderbird applications. This issue is addressed in the following versions: Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . No specif...

CVE-2026-92039

A mitigation bypass exists in the DOM: Notifications component of the Mozilla Firefox browser and Thunderbird. This vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific details regarding the root cause or exploit vectors are provid...

CVE-2026-0879

This vulnerability involves a sandbox escape caused by incorrect boundary conditions within the Graphics component of Mozilla products. Impacted software includes Firefox , Firefox ESR , and Thunderbird . Exploitation of this flaw can allow an attacker to execute arbitrary code or cause the appli...

CVE-2026-12300

A memory safety bug exists in Mozilla Firefox and Thunderbird versions earlier than 152.0 . The vulnerability involves operations escaping beyond buffer boundaries in memory, which could allow a remote attacker to access confidential data . To remediate this issue, users should update to the late...

CVE-2026-2798

A use-after-free vulnerability exists in the DOM: Core & HTML components of the Mozilla Firefox web browser and Mozilla Thunderbird email client. This flaw allows for the reuse of memory after it has been freed, which can be exploited by a remote attacker to trigger service interruptions or failu...

CVE-2026-4689

CVE-2026-4689: A sandbox-escape issue caused by incorrect boundary conditions and an integer overflow in the XPCOM component. Public disclosures across multiple sources show affected products include Firefox and Thunderbird (various release tracks), with fixes implemented in Firefox 149, ESR 115....

CVE-2026-4694

CVE-2026-4694: A vulnerability in the Graphics component (incorrect boundary conditions, integer overflow) affecting Firefox and Firefox ESR releases prior to 149/115.34 and 140.9. Patches are available in Firefox 149 and ESR 115.34, ESR 140.9. Other connected advisories reiterate related Firefox...

CVE-2026-92029

A use-after-free vulnerability exists in the SVG component of Mozilla Firefox and Mozilla Thunderbird . This flaw can potentially lead to memory corruption or execution flow issues. Affected versions include various releases, and the vulnerability has been addressed in Firefox 156 , Firefox ESR 1...

CVE-2025-10528

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape due to undefined behavior and an invalid pointer within the Graphics: Canvas2D component. This flaw allows an attacker to bypass the sandbox, potentially leading to privilege escalation. The vulnerability affects v...

CVE-2025-11708

A Use-after-free vulnerability exists in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox , Firefox ESR , and Thunderbird . This memory safety issue allows a malicious actor to execute arbitrary code . The vulnerability affects Firefox < 144 , Firefox ESR < 140.4 , Thu...

CVE-2025-11712

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by CVE-2025-11712 , where a malicious page can use the type attribute of an OBJECT tag to override default browser behavior when encountering a web resource served without a content-type header. This flaw could lead to Cross-Site Script...

CVE-2026-100785

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in various releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the memory sa...

CVE-2026-100818

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free in the Widget: Gtk component. This vulnerability was addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitation information are provide...

CVE-2026-12321

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of Firefox and Thunderbird . The flaw is attributed to the implementation of incorrect flow control , which could allow a remote attacker to access sensitive data and compromise the integrity of the browser. The is...

CVE-2026-2776

CVE-2026-2776 involves a sandbox escape due to incorrect boundary conditions in the Telemetry component of External Software. Impacted products are Mozilla Firefox (including Firefox 148 and ESR releases 115.33 and 140.8) and Thunderbird (both 148 and 140.8). The underlying issue is a boundary-co...

CVE-2026-8960

A spoofing issue in the WebExtensions component of the Firefox web browser and Thunderbird email client allows a malicious actor to bypass authentication processes through spearfishing . Exploiting this vulnerability enables remote compromise of data integrity . The issue was resolved in Firefox ...

CVE-2026-92078

A Denial-of-Service vulnerability exists in the Security component of Mozilla Firefox and Thunderbird . This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit information is provided in the documentation.

CVE-2025-11709

Mozilla Firefox and Thunderbird are vulnerable to out-of-bounds reads and writes in a privileged process caused by manipulated WebGL textures . The vulnerability exists in the WebGL Texture Handler component, where a compromised web process can trigger memory corruption to execute arbitrary code ...

CVE-2026-0886

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability in the Graphics component caused by incorrect boundary conditions . This flaw can lead to memory operations outside of the buffer , potentially allowing a remote attacker to compromise the confidentiality of protected...

CVE-2026-100782

The Firefox browser is affected by a privilege escalation vulnerability (CVE-2026-100782 ) caused by incorrect boundary conditions in the Graphics component . This flaw allows for unauthorized privilege escalation and has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 ,...

CVE-2026-2768

CVE-2026-2768 is a vulnerability in the Storage: IndexedDB component that enables a sandbox escape. The issue affects Mozilla Firefox and Thunderbird products (including Firefox/Firefox ESR and Thunderbird releases) and is tied to the IndexedDB storage path. The description provided states that t...

CVE-2026-2786

Technical details for CVE-2026-2786 are not publicly available in the provided documents. Monitor for updates and additional provenance.

CVE-2026-2800

CVE-2026-2800 affects Firefox for Android, specifically a spoofing vulnerability in the WebAuthn component. The issue is described as a spoofing flaw in WebAuthn that affects the Android Firefox and has been fixed in Firefox 148 (and Thunderbird 148). The available connected sources corroborate t...

CVE-2026-2803

CVE-2026-2803 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an information disclosure with mitigation bypass in the Settings UI component, fixed in Firefox 148 and Thunderbird 148. Connected advisories confirm affected products and versions, and note remediation to update to the l...

CVE-2026-2807

CVE-2026-2807 affects Firefox 147 and Thunderbird 147 with memory-safety bugs that can lead to memory corruption and potential arbitrary code execution; the flaws are fixed in Firefox 148 and Thunderbird 148. Connected sources describe exploitable memory safety issues across components (e.g., DOM...

CVE-2026-8964

A spoofing issue exists in the Popup Blocker component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from the false representation of critical information within the user interface, which could allow a remote malicious actor to compromise data in...

CVE-2026-2770

CVE-2026-2770 is a use-after-free in the DOM: Bindings (WebIDL) component. Affected products include Firefox (fixed in Firefox 148 and Firefox ESR 115.33/140.8) and Thunderbird (fixed in 148 and 140.8). The connected advisories confirm the same flaw and fix versions; no exploitation details are p...

CVE-2026-84639

Mozilla Thunderbird is affected by CVE-2026-84639 , where triggering an error condition in certain MIME bodies causes the use of uninitialized memory . This vulnerability could potentially lead to arbitrary code execution or information disclosure. The issue has been addressed in Thunderbird vers...

CVE-2026-8967

The Firefox web browser and Thunderbird email client are vulnerable to an information disclosure vulnerability within the Graphics: WebGPU component. This flaw allows a remote attacker to gain access to confidential data . The issue was addressed in Firefox 151 and Thunderbird 151 . No specific e...

CVE-2026-92015

A privilege escalation vulnerability exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This flaw was addressed in the following releases: Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thu...

CVE-2026-92025

A use-after-free vulnerability exists in the DOM: Navigation component of the Mozilla Firefox and Thunderbird browsers. This security flaw impacts several versions of the software. Remediation is available in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird ...

CVE-2026-92031

CVE-2026-92031 is an information disclosure vulnerability affecting the Graphics: ImageLib component in the Mozilla Firefox and Mozilla Thunderbird applications. The flaw allows for the unauthorized disclosure of information. Remediation is available in Firefox 156 , Firefox ESR 140.16 , Firefox ...

CVE-2026-92068

A site isolation issue exists in the Reader Mode component of the Mozilla Firefox and Thunderbird browsers. This vulnerability was addressed in Firefox versions 156 and ESR 153.3, and Thunderbird versions 156 and 153.3. No specific exploit details or in-the-wild exploitation information are provi...

CVE-2026-92077

A Denial-of-Service (DoS) vulnerability exists in the SVG component of the Mozilla Firefox and Thunderbird browsers. This vulnerability is confirmed to affect the SVG component and was addressed in several security updates. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird...

CVE-2025-10537

Mozilla Firefox and Thunderbird are affected by memory safety bugs that exhibit evidence of memory corruption . These vulnerabilities could potentially be exploited to execute arbitrary code or cause service interruptions by performing operations outside of the buffer in memory. The affected vers...

CVE-2026-2791

CVE-2026-2791 is a mitigation bypass in the Networking: Cache component. Public sources confirm Firefox and Thunderbird updates fix the issue: Firefox to version 148 (and ESR 140.8), Thunderbird to 148 (and 140.8). The impact is described via CVSS as CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-6780

The Audio/Video: Playback component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an uncontrolled resource consumption issue within the playback functions, which can be exploited by an attacker to trigger service interruptions . Th...

CVE-2026-92016

A use-after-free vulnerability exists in the Disability Access APIs component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability is cha...

CVE-2025-11711

This vulnerability exists in Mozilla Firefox and Thunderbird due to a flaw that allows an attacker to modify the values of JavaScript Object properties that are intended to be non-writeable. Affected versions include Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird &...

CVE-2026-0890

A spoofing issue exists in the DOM: Copy & Paste and Drag & Drop components of Mozilla Firefox and Mozilla Thunderbird . This vulnerability allows attackers to carry out deceptive attacks by exploiting errors in these specific components. Affected versions include Firefox < 147 , Firefox ESR &...

CVE-2026-100816

A site isolation issue exists in the DOM: Networking component of Mozilla products. This vulnerability affects Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . The issue has been addressed in these specific versions. No specific exploit details or in-the-wild exploitati...

CVE-2026-8965

The Firefox web browser and Thunderbird email client are affected by an information disclosure vulnerability within the DOM: Security component . This flaw allows a remote attacker to gain unauthorized access to confidential data . The vulnerability has been addressed in versions 151 of both Mozi...

CVE-2026-92063

A Denial-of-service vulnerability exists in the Audio/Video component of Firefox and Thunderbird . This issue has been addressed in Firefox 156 and Thunderbird 156 . While specific technical root causes are not detailed in the provided documents, the vulnerability is confirmed to impact these spe...

CVE-2026-0887

CVE-2026-0887 involves a clickjacking issue and information disclosure within the PDF Viewer component of Mozilla products. This vulnerability impacts Firefox versions prior to 147, Firefox ESR versions prior to 140.7, Thunderbird versions prior to 147, and Thunderbird versions prior to 140.7. Ex...

CVE-2026-92040

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird . This flaw was addressed in versions 156 of both products. While the vulnerability is confirmed, specific details regarding the root cause, technical impact, or exploit availability ...

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-4720

Memory safety bugs exist in Mozilla Firefox and Thunderbird (specifically versions Firefox ESR 140.8 , Thunderbird ESR 140.8 , Firefox 148 , and Thunderbird 148 ). These vulnerabilities involve memory corruption that could potentially be exploited with significant effort to achieve arbitrary code...