CVE-2026-0891

Mozilla Firefox and Thunderbird products are affected by memory safety bugs that can lead to memory corruption. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the system. This issue impacts Firefox ESR 140.6 , Thunderbird ESR 140.6 , Firefox 146 , and Thu...

CVE-2026-100780

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Firefox browser. This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . While the specific technical root cause is not detailed beyond the...

CVE-2025-11710

A compromised web process could use malicious IPC messages to cause the privileged browser process to reveal blocks of its memory. This vulnerability affects Firefox versions earlier than 144, Firefox ESR earlier than 115.29 and 140.4, and Thunderbird versions earlier than 144 and 140.4. Remediat...

CVE-2025-14329

The Netmonitor component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a privilege escalation flaw due to insecure management of privileges. An attacker could exploit this vulnerability to remotely enhance their privileges. This issue is fixed in Firefox 146 , Firefox ESR 14...

CVE-2026-100808

A mitigation bypass exists in the DOM: Service Workers component of the Mozilla Firefox web browser. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While specific technical root causes are not detailed in the provided documents...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-3889

A spoofing vulnerability exists in the Mozilla Thunderbird email client, affecting versions prior to 149 and 140.9 . This flaw allows attackers to conduct spoofing attacks against users. The vulnerability was addressed in the release of Thunderbird versions 149 and 140.9 . While the documents con...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2025-11716

Mozilla Firefox and Mozilla Thunderbird versions prior to 144.0 are vulnerable to a security bypass where links in a sandboxed iframe can open external apps on Android without the required "allow-" permission. This flaw allows attackers to bypass security restrictions. Remediation involves updati...

CVE-2026-100820

A privilege escalation vulnerability exists in the Address Bar component of the Firefox web browser. This flaw allows for elevated privileges during use. The issue has been addressed in Firefox ESR 153.4 , Firefox 157 , and Firefox ESR 140.17 . No specific exploit details or in-the-wild exploitat...

CVE-2025-10530

A spoofing vulnerability exists in the WebAuthn component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an error in the authentication process, specifically the incorrect display of the domain name in the address bar. This allows a remote attacker to perform spear-phishing attack...

CVE-2025-14323

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the DOM: Notifications component. The root cause involves the execution of operations outside the buffer while processing DOM objects, which could allow an attacker to increase their privileges remotely. Affec...

CVE-2026-100783

A high-impact uninitialized memory vulnerability exists in the Audio/Video component of Firefox . This flaw was addressed in several versions, including Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17 . While the specific root cause is not detailed beyond the uninitiali...

CVE-2026-100786

A sandbox escape vulnerability exists in the Graphics component of the Firefox browser due to a use-after-free condition. This flaw was addressed in multiple releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or external...

CVE-2025-10529

A same-origin policy bypass exists in the Layout component of Mozilla Firefox , Firefox ESR , and Thunderbird . The vulnerability is caused by the use of an untrusted intermediate policy file , which can allow a remote attacker to execute arbitrary code . Affected versions include Firefox < 14...

CVE-2025-10534

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a spoofing vulnerability in the Site Permissions component. The root cause is related to a lack of measures to protect the structure of web pages, which can be exploited by a malicious actor to perform cross-site scr...

CVE-2025-14328

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by a privilege escalation vulnerability in the Netmonitor component. The root cause is attributed to the insecure management of privileges, which could allow an attacker to enhance their privileges remotely. This issue ...

CVE-2026-100784

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Firefox browser. This flaw has a high impact and was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Specific details regarding the root ca...

CVE-2026-100813

The Firefox web browser is affected by an invalid pointer vulnerability within the JavaScript Engine: JIT component . This flaw was addressed in Firefox 157 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2026-100815

A use-after-free vulnerability exists in the CSS Parsing and Computation component of the Firefox browser. This flaw was addressed and fixed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation records are provided in the documents.

CVE-2025-14325

A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of the Mozilla Firefox browser and the Thunderbird email client. The flaw is caused by improper code generation management , which can allow an attacker to achieve remote arbitrary code execution . This vulnerabilit...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2026-0882

A use-after-free vulnerability exists in the IPC component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . Exploiting this flaw could allow an attacker to execute arbitrary code on a system or interfere with the confidentiality, integrity, and accessibility of protected i...

CVE-2026-0883

CVE-2026-0883 identifies an information disclosure vulnerability within the Networking component of Mozilla products. This flaw can allow a malicious actor to gain access to confidential data . The vulnerability impacts Firefox (versions prior to 147), Firefox ESR (versions prior to 140.7), Thund...

CVE-2026-100768

A use-after-free vulnerability exists in the Graphics: WebGPU component of the Firefox browser. This issue was addressed and fixed in Firefox 157 . The vulnerability was reported by Yaqoub Aldurayhim and is associated with Bugzilla report Bug 2064832 . No specific exploitation details or direct l...

CVE-2026-100814

The Firefox browser is affected by a vulnerability caused by incorrect boundary conditions within the JavaScript Engine: JIT component. This flaw allows for potential exploitation through the Just-In-Time compiler. Remediation is available in Firefox ESR 153.4 and Firefox 157 . No specific exploi...

CVE-2026-0881

A sandbox escape vulnerability exists in the Messaging System component of Mozilla Firefox and the Thunderbird email client. The flaw originates from a weakness in data protection mechanisms , which could allow an attacker to bypass security restrictions and execute arbitrary code remotely . This...

CVE-2026-100832

Firefox is affected by a use-after-free vulnerability in the Graphics: Canvas2D component. This flaw was addressed in Firefox ESR 153.4 , Firefox ESR 115.42 , and Firefox ESR 140.17 . The vulnerability is associated with Bug 2072467 and is categorized as having high impact by the reporter. No spe...

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2026-57963

The Thunderbird email client is vulnerable to a chat UI manipulation flaw where an attacker sending HTML chat messages (via Matrix or XMPP ) can inject arbitrary styled content , phishing links , and CSS to manipulate the chat interface. This issue was addressed in versions 152.0.1 and 140.12.1 ....

CVE-2025-11714

Mozilla Firefox and Thunderbird are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . Affected versions include Firefox ESR 115.28 , Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , ...

CVE-2026-92070

CVE-2026-92070 involves an information disclosure vulnerability in the Networking component of Mozilla products. The issue is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the exact root cause is not specified in the provided documents, other repor...

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-57962

The Thunderbird email client is vulnerable to a memory exhaustion attack via a malicious LDAP server . If a user is configured to query an untrusted LDAP server for address-book autocomplete , the attacker can stash arbitrarily large amounts of data into the Thunderbird LDAP client, leading to a ...

CVE-2026-6781

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Playback component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an uncontrolled resource consumption issue within the playback functions, which could allow an attacker to trigger a service failure or service inte...

CVE-2026-100809

A Same-origin policy bypass exists in the DevTools component of the Mozilla Firefox web browser and Mozilla Thunderbird mail client. This vulnerability is fixed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the documents. P...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-0889

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a Denial-of-Service (DoS) attack. The root cause is an error in the DOM: Service Workers component involving uncontrolled resource consumption . A malicious actor can exploit this flaw to cause the browser to c...

CVE-2026-100779

Firefox is impacted by a use-after-free vulnerability in the XSLT component . This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or direct links to exploitation are provided in the docu...

CVE-2026-100828

A mitigation bypass exists in the Bookmarks & History component of various Mozilla products. The vulnerability affects Firefox , Firefox ESR , and Thunderbird . Impacting functionality can include a protection mechanism failure (CWE-692 ). Remediation is available as the issue has been fixed in F...

CVE-2026-84640

Mozilla Thunderbird is vulnerable to a one-byte read past the end of a buffer caused by a maliciously constructed mail header. This issue is identified as a mail parser vulnerability. The flaw has been remediated in Thunderbird versions 155 , 140.15 , and 153.2 . Specific distribution updates, su...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2026-92021

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox browser and Thunderbird mail client. This flaw was addressed in Firefox ESR 140.16 and Thunderbird 140.16 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2025-11713

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a code execution flaw due to insufficient escaping in the "Copy as cURL" feature. On Windows , this issue could trick users into executing unexpected code. The vulnerability is mitigated by updating to Firefox...

CVE-2026-0888

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by an information disclosure vulnerability within the XML component . This flaw allows a malicious actor to potentially gain access to confidential data . The vulnerability has been addressed in Firefox 147 and Thun...

CVE-2025-14326

CVE-2025-14326 is a use-after-free in the Audio/Video: GMP component affecting Firefox < 146 and Thunderbird

CVE-2026-100812

A Denial-of-Service vulnerability exists in the Graphics component of Firefox . This flaw allows for an attack that impacts the availability of the application. The issue has been addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation information ...

CVE-2026-100829

A mitigation bypass exists in the DOM: Security component of certain Mozilla products. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While the vulnerability is confirmed through multiple sources, specific technical details reg...