CVE-2025-9179

CVE-2025-9179 describes a memory corruption vulnerability in the GMP process used by Firefox/Thunderbird for encrypted media handling, with privileges that are sandboxed yet could allow total impact (CVE-2025-9179). Affected products include Firefox < 142, Firefox ESR < 115.27/128.14/140.2,...

CVE-2025-8032

CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...

CVE-2025-8027

CVE-2025-8027 describes a 64-bit value handling bug in the Firefox/Thunderbird JavaScript engines: on 64-bit platforms IonMonkey-JIT writes only 32 bits of a 64-bit return value to the stack, while Baseline-JIT reads all 64 bits. This can disclose or mishandle information in the return value spac...

CVE-2026-12289

CVE-2026-12289 describes a privilege-escalation vulnerability in the Graphics: WebRender component. The public description and connected advisories indicate this affects Mozilla Firefox and Thunderbird products, with fixes shipped in: Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbi...

CVE-2026-8092

CVE-2026-8092 refers to memory safety bugs in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (and related Firefox components) with evidence of memory corruption and a potential for arbitrary code execution. The vulnerability was addressed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 11...

CVE-2026-6767

CVE-2026-6767 is a vulnerability in the NSS Libraries component described as “Other issue in the Libraries component in NSS.” It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 5.3 (attack vector: network, attac...

CVE-2026-6785

CVE-2026-6785 affects memory-safety bugs in Mozilla Firefox/Thunderbird components across Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The issues potentially allow memory corruption and could enable arbitrary code execution; Mozilla fixed these bugs in F...

CVE-2025-8030

CVE-2025-8030 is publicly known and tied to an insufficent escaping in the “Copy as cURL” feature that could lead to code execution. The connected Astra Linux and Amazon/Linux advisories confirm the issue affects Firefox and Thunderbird across multiple tracks (e.g., Firefox < 141, Firefox ESR ...

CVE-2025-9180

CVE-2025-9180 describes a same-origin policy bypass in the Graphics: Canvas2D component affecting Firefox and Thunderbird. Affected versions include Firefox and Thunderbird before 142, and ESR channels before 115.27, 128.14, or 140.2. Several connected advisories confirm the same issue and provid...

CVE-2025-8035

CVE-2025-8035 affects Mozilla Firefox and Thunderbird desktop clients (Firefox/Firefox ESR and Thunderbird up to versions around 140.x/141.x). The connected sources describe memory-safety bugs in Firefox ESR 128.12, 140.0, and Firefox/Thunderbird 140, plus similar issues in Thunderbird ESR lines,...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2026-6786

CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...

CVE-2026-8091

CVE-2026-8091 affects Mozilla Audio/Video: Playback with an incorrect boundary condition in the component. It is fixed by updating to Firefox 150, Thunderbird 150, and Firefox ESR 140.10.1 (and 140.10.2 per ESR updates) as well as Firefox ESR 115.35.2. Connected disclosures corroborate this is a ...

CVE-2025-8033

The CVE-2025-8033 issue is a memory-safety bug in Mozilla’s JavaScript engine where closing generators could be resumed, causing a null pointer dereference. Affected products include Firefox and Thunderbird forks across multiple release lines (Firefox < 141, ESR tracks <115.26, <128.13, ...

CVE-2025-8034

CVE-2025-8034 involves memory safety bugs in Mozilla Firefox/Thunderbird across multiple releases (Firefox ESR 115.25, 128.12; Firefox/Thunderbird 140.x; ESR 115.26, 128.13, 140.1). Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected products list i...

CVE-2025-8029

CVE-2025-8029: Thunderbird and Firefox products are affected by a vulnerability where javascript: URLs are executed when used inside object and embed tags. The impact list states affected versions include Firefox < 141 and Thunderbird < 141 (and ESR branches

CVE-2025-8028

CVE-2025-8028 describes a vulnerability in Firefox and Thunderbird affecting arm64 WASM, where a br_table with many entries can cause the branch label to be miscomputed due to truncation. Affected are Firefox and Firefox ESR versions prior to 141/115.26/128.13/140.1 and Thunderbird versions prior...

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2025-8031

CVE-2025-8031 concerns a vulnerability where the username:password portion is not correctly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. The CVE’s context across connected documents shows affected software including Firefox and Thunderbird variants...

CVE-2026-6771

CVE-2026-6771 is a mitigation bypass in the DOM: Security component. The affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Actionability: update to the listed versions to remediate. Connected...

CVE-2026-6751

CVE-2026-6751 is a vulnerability described as an uninitialized memory issue in the Audio/Video: Web Codecs component. The primary CVE entry references Firefox (fixed in Firefox 150 and Firefox ESR 140.10), Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). Connected advisories confirm...

CVE-2026-6752

CVE-2026-6752 is a WebRTC boundary-conditions vulnerability in Mozilla Firefox/Thunderbird. The issue is caused by incorrect boundary conditions in the WebRTC component, leading to potential impact as described in the advisory. The connected sources confirm fixed versions: Firefox 150, Firefox ES...

CVE-2026-6764

CVE-2026-6764 is an issue described as incorrect boundary conditions in the DOM: Device Interfaces component, affecting Firefox/Thunderbird. Public references in the connected advisories show fixes for this CVE in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and Thunderbird 140.10). The root...

CVE-2026-12290

A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...

CVE-2026-6753

CVE-2026-6753 : This is a memory/boundary-condition vulnerability in the WebRTC component. The initial report identifies the root cause as incorrect boundary conditions in the WebRTC component, with an impact profile of Confidentiality, Integrity, and Availability all rated Low, and an overall CV...

CVE-2026-6762

CVE-2026-6762 is a spoofing issue in the DOM: Core & HTML component. Connected advisories confirm it affects Firefox/Thunderbird stacks and was fixed in Firefox 150, ESR 115.35, ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS 3.1 base score is 6.3 (MEDIUM) with NETWORK attack vector...

CVE-2026-6759

CVE-2026-6759 is a use-after-free in the Mozilla Widget: Cocoa component. Affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This is confirmed across multiple connected advisories and CVE l...

CVE-2026-12311

CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...

CVE-2026-12329

CVE-2026-12329 is a memory-safety bug fixed in Thunderbird ESR 140.12 (and Firefox ESR 140.12). Affected products include Thunderbird/Firefox ESR 140.12; CVSSv3.1 base score 7.5 (HIGH) with NETWORK attack vector, high confidentiality/integrity/availability impact, user interaction required. Remed...

CVE-2026-6763

CVE-2026-6763 is a mitigation bypass in the File Handling component that was fixed in Firefox 150 and Firefox ESR 140.10, and in Thunderbird 150 and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:15892, ALSA-2… etc.) corroborate that Thunderbird/firefo...

CVE-2026-12299

CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...

CVE-2026-12325

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...

CVE-2026-12298

CVE-2026-12298 is a memory-safety bug affecting Firefox and Thunderbird components, with fixes in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Connected advisories (ALSA/RLSA/SUSE/Fedora/Red Hat) enumerate the same CVE among a broader set of related issues and indicat...

CVE-2026-12313

CVE-2026-12313 affects Firefox and Thunderbird: Information disclosure and sandbox escape in the Security: Process Sandboxing component. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 (per Mozilla advisories and downstream vendor trackers). ...

CVE-2026-12327

CVE-2026-12327 relates to memory safety bugs in Mozilla products: Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The issue was fixed in Firefox 152, Firefox ESR ...

CVE-2026-12328

CVE-2026-12328 pertains to memory safety bugs in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed memory corruption and could potentially be exploited to run arbitrary code. Remediations are available: Firefox 152, Firefox ESR 140....

CVE-2026-6757

CVE-2026-6757 corresponds to an invalid pointer in the JavaScript: WebAssembly component. The connected advisories confirm affected products as Firefox (including Firefox 150 and Firefox ESR 140.10) and Thunderbird (150 and 140.10), with fixes in those respective versions. Several entries (ALSA p...

CVE-2026-12330

CVE-2026-12330 corresponds to an issue in the Internationalization component with incorrect boundary conditions. Public disclosures in connected advisories confirm multiple Mozilla products are affected, including Firefox ESR and Thunderbird. Debian’s advisory shows the vulnerability affecting fi...