CVE-2026-84129

CVE-2026-84129 is a site isolation issue in the DOM: Navigation component of Mozilla's browser and email products. The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity,...

CVE-2026-84121

CVE-2026-84121 is a sandbox escape in Mozilla Firefox caused by a use-after-free in the DOM: Security component. A successful exploit allows an attacker to escape the browser sandbox, resulting in total technical impact (high confidentiality, integrity, and availability impact) across a changed s...

CVE-2026-84119

CVE-2026-84119 is a sandbox escape in Mozilla Firefox caused by a use-after-free bug in the DOM: Navigation component. An attacker can exploit this via a network vector with low complexity and user interaction to gain full confidentiality, integrity, and availability impact (scope changed), yield...

CVE-2026-84131

CVE-2026-84131 is a privilege escalation vulnerability in the Graphics component of Firefox , caused by an invalid pointer . According to Red Hat, a local attacker could exploit this to gain unauthorized access to sensitive system resources or execute arbitrary code with elevated permissions. The...

CVE-2026-84639

CVE-2026-84639 affects Mozilla Thunderbird 's MIME parsing component. Triggering an error condition in certain MIME bodies causes uninitialized memory to be used , leading to a remote denial-of-service as noted by Kaspersky. The CVSS 3.1 score is 9.1 (Critical) with a network attack vector, low c...

CVE-2026-84137

CVE-2026-84137 is a spoofing (Security UI) vulnerability in the DOM: Core & HTML component of Mozilla products, allowing an attacker to spoof the user interface. It was fixed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Notably, NVD assigns a 4.3 (Medium) score w...

CVE-2026-84143

CVE-2026-84143 covers internally found bugs in Thunderbird 154 , Thunderbird ESR 153.1 , and Thunderbird ESR 140.14 , some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with enough effort, but no confirmed in-the-wild exp...

CVE-2026-84144

CVE-2026-84144 covers internally found bugs in Mozilla Thunderbird 154 and Thunderbird ESR 153.1 , some showing evidence of memory corruption or other security-relevant defects. The vendor presumes some could have been exploited with sufficient effort. The issue is fixed in Thunderbird 155 , Thun...

CVE-2026-84136

CVE-2026-84136 is a remote code execution vulnerability in the DOM: Navigation component of Mozilla products, affecting Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (before 153.2). Per Kaspersky, it can be exploited remotely to execute arbitrary ...

CVE-2026-84134

CVE-2026-84134 is an issue in the Profile Backup component of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. The NVD description labels it as an "Other issue," while Kaspersky characterizes it as a denial of service vulnerability exploitable remotely. It carries a CVSS 9.8 (CRITI...

CVE-2026-84140

CVE-2026-84140 is a site isolation issue in the DOM: Navigation component affecting Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Per Kaspersky analysis, this vulnerability enables remote code execution when exploited, allowing arbitrary code to run on the target system. The...

CVE-2026-84133

CVE-2026-84133 is a site isolation issue in the DOM: Push Subscriptions component of Mozilla products. It affects Firefox (fixed in 155), Firefox ESR (fixed in 153.2), Thunderbird (fixed in 155), and Thunderbird ESR (fixed in 153.2). The CNA-assigned CVSS 3.1 score is 9.8 (Critical) with a vector...

CVE-2026-84141

CVE-2026-84141 is an integer overflow in the Graphics: ImageLib component of Mozilla's image processing library, enabling remote code execution via crafted image content. The vulnerability affects Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (bef...

CVE-2026-84122

CVE-2026-84122 is a use-after-free vulnerability in the Audio/Video component of Mozilla Firefox. The flaw was fixed in Firefox 155 , Firefox ESR 140.15 , and Firefox ESR 153.2 . The CVSS 3.1 score is 5.4 (MEDIUM) , requiring user interaction with low impacts to confidentiality and integrity and ...

CVE-2026-84145

Internally discovered bugs in Firefox 154 , Firefox ESR 153.1 , Firefox ESR 140.14 , and Firefox ESR 115.39 included defects showing evidence of memory corruption or other security-relevant issues. Mozilla noted that with enough effort some of these bugs could potentially have been exploited, tho...

CVE-2026-84120

A use-after-free vulnerability in the Audio/Video component of Firefox and Firefox ESR allows a remote attacker to achieve arbitrary code execution . The flaw occurs when the program uses memory that has already been deallocated, leading to memory corruption. The CVSS 3.1 score is 5.4 (Medium) , ...

CVE-2026-84130

CVE-2026-84130 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The flaw can be exploited remotely to obtain sensitive information . The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, lo...

CVE-2026-84139

A clickjacking vulnerability in the DOM: Events component affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . It was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. The vulnerability is part of a broader batch of issues disclosed via Mozilla adviso...

CVE-2026-84118

CVE-2026-84118 is a use-after-free vulnerability in the JavaScript GC (Garbage Collector) component of Mozilla Firefox . The flaw can lead to low confidentiality and integrity impact when a user interacts with a crafted page, but does not affect availability (CVSS 3.1 score: 5.4 MEDIUM , vector A...

CVE-2026-84125

A use-after-free vulnerability in the DOM: Core & HTML component of Firefox could allow a remote attacker to execute arbitrary code , according to Red Hat's assessment. The CVSS 3.1 score is 5.4 (Medium) with a network attack vector, low complexity, no required privileges, but user interaction re...

CVE-2026-84637

CVE-2026-84637 is a critical (CVSS 9.8) vulnerability in Mozilla Thunderbird where malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows , bypassing Thunderbird's normal executable attachment protections. With the new invitation dis...

CVE-2026-84642

CVE-2026-84642 affects Mozilla Thunderbird , where the mail.allowed_attachment_hostnames advanced config setting values were inserted into a regular expression without escaping . For certain valid hostnames, this regex injection allowed unintended hostnames to match , enabling remote attachments ...

CVE-2026-84124

CVE-2026-84124 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox . The CVSS 3.1 score is 5.4 (MEDIUM) , with a network-based attack vector requiring user interaction and no privileges , resulting in low impacts to confidentiality and integrity but no impact to...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability in the Networking: HTTP component of Mozilla's Firefox and Thunderbird products. A remote attacker with no privileges and no user interaction can obtain sensitive information, resulting in high confidentiality impact with no integrity or a...

CVE-2026-84640

CVE-2026-84640 is a one-byte buffer over-read in the mail header parser of Mozilla Thunderbird, triggered by a maliciously constructed mail header. The vulnerability is rated CVSS 3.1 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N , indicating a network-exploitable flaw requiring...

CVE-2026-84641

A use-after-free in Mozilla Thunderbird's IMAP ID response handling allows a malicious IMAP server to trigger heap-memory disclosure. The leaked heap contents can ultimately be persisted to prefs.js , enabling an attacker to recover sensitive data without user interaction. The vulnerability carri...

CVE-2026-84123

CVE-2026-84123 is a privilege escalation vulnerability in Firefox caused by a use-after-free flaw in the Graphics: WebGPU component. The flaw allows an attacker to escalate privileges when a user interacts with a malicious WebGPU workload in the browser. CVSS 3.1 rates it 8.8 (HIGH) with a vector...