Mozilla
3627 CVEs across 64 Mozilla products. Browse Mozilla vulnerabilities, severities, and proof-of-concept exploits.
Mozilla products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-18809 | Medium | 6.5 | 2026-08-04 | Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3. |
CVE-2026-14899 | High | 7.5 | 2026-07-22 | The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a singl… |
CVE-2026-16412 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effor… |
CVE-2026-16411 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2026-16410 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16409 | High | 7.5 | 2026-07-21 | Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16408 | Critical | 9.8 | 2026-07-21 | Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16407 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16406 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16405 | High | 7.5 | 2026-07-21 | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbi… |
CVE-2026-16404 | High | 7.4 | 2026-07-21 | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16403 | Medium | 6.5 | 2026-07-21 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16402 | Critical | 9.8 | 2026-07-21 | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16401 | High | 8.8 | 2026-07-21 | Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16400 | High | 7.5 | 2026-07-21 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16399 | High | 7.5 | 2026-07-21 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16398 | High | 7.5 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16397 | Medium | 6.5 | 2026-07-21 | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16396 | High | 8.8 | 2026-07-21 | Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16395 | Critical | 9.8 | 2026-07-21 | Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16394 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16393 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16392 | Critical | 9.1 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16391 | High | 7.5 | 2026-07-21 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16390 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16389 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16388 | Critical | 9.8 | 2026-07-21 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16387 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16386 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16385 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16384 | High | 7.5 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16383 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16382 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16381 | Critical | 9.1 | 2026-07-21 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16380 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16379 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16378 | High | 7.5 | 2026-07-21 | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16377 | Critical | 9.8 | 2026-07-21 | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16376 | High | 7.5 | 2026-07-21 | Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16375 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16374 | High | 7.5 | 2026-07-21 | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbir… |
CVE-2026-16373 | High | 7.5 | 2026-07-21 | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2026-16372 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16371 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16370 | Critical | 9.1 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16369 | Critical | 9.8 | 2026-07-21 | Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 14… |
CVE-2026-16368 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and T… |
CVE-2026-16367 | Critical | 10.0 | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16366 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16365 | High | 8.8 | 2026-07-21 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16364 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16363 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird… |
CVE-2026-16362 | High | 8.8 | 2026-07-21 | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16361 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of th… |
CVE-2026-16360 | Critical | 9.8 | 2026-07-21 | Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume th… |
CVE-2026-16359 | Critical | 9.1 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbi… |
CVE-2026-16358 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16357 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16356 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16355 | Critical | 9.8 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-16354 | High | 7.5 | 2026-07-21 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-16353 | Critical | 9.8 | 2026-07-21 | Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16352 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140… |
CVE-2026-16351 | Critical | 9.8 | 2026-07-21 | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thu… |
CVE-2026-16350 | Critical | 9.8 | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunder… |
CVE-2026-16349 | Critical | 9.8 | 2026-07-21 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-15719 | Medium | 5.4 | 2026-07-14 | We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefo… |
CVE-2026-15718 | Medium | 4.3 | 2026-07-14 | We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefo… |
CVE-2026-14906 | Medium | 5.3 | 2026-07-13 | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox… |
CVE-2026-13356 | Medium | 6.3 | 2026-07-07 | A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin… |
CVE-2026-57963 | Medium | 6.5 | 2026-07-01 | An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. Thi… |
CVE-2026-57962 | Medium | 5.3 | 2026-07-01 | A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplie… |
CVE-2026-14241 | Critical | 9.8 | 2026-06-30 | Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-53900 | Medium | 4.3 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject a… |
CVE-2026-53899 | Medium | 6.5 | 2026-06-16 | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging… |
CVE-2026-12330 | Medium | 5.4 | 2026-06-16 | Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 14… |
CVE-2026-12329 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12. |
CVE-2026-12328 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed eviden… |
CVE-2026-12327 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corrupt… |
CVE-2026-12326 | High | 8.1 | 2026-06-16 | Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-12325 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, an… |
CVE-2026-12324 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thu… |
CVE-2026-12323 | Medium | 5.4 | 2026-06-16 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12322 | Medium | 5.4 | 2026-06-16 | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12321 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12320 | Medium | 4.3 | 2026-06-16 | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12319 | Medium | 6.5 | 2026-06-16 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12318 | High | 7.3 | 2026-06-16 | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12317 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12316 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12315 | Critical | 9.1 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12314 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12313 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12312 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12311 | Medium | 4.7 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderb… |
CVE-2026-12310 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12309 | Medium | 6.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12308 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12307 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12306 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |