Mozilla Firefox Mobile
84 CVEs affecting Mozilla Firefox Mobile. Latest disclosed: 2026-09-01. Critical: 4, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84135 | Critical | 9.8 | 2026-09-01 | Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. |
CVE-2023-49060 | Critical | 9.8 | 2023-11-21 | An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability a… |
CVE-2022-26486 | Critical | 9.6 | 2022-12-22 | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abu… |
CVE-2023-29534 | Critical | 9.1 | 2023-06-19 | Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spo… |
CVE-2026-84117 | High | 8.8 | 2026-09-01 | Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155. |
CVE-2023-29551 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2023-29550 | High | 8.8 | 2023-06-02 | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort… |
CVE-2023-29543 | High | 8.8 | 2023-06-02 | An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerabil… |
CVE-2023-29541 | High | 8.8 | 2023-06-02 | Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug… |
CVE-2023-29539 | High | 8.8 | 2023-06-02 | When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could… |
CVE-2023-29536 | High | 8.8 | 2023-06-02 | An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruptio… |
CVE-2022-26485 | High | 8.8 | 2022-12-22 | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. Th… |
CVE-2020-15670 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that w… |
CVE-2024-7523 | High | 8.1 | 2024-08-06 | A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only a… |
CVE-2021-29993 | High | 8.1 | 2021-11-03 | Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox fo… |
CVE-2026-16373 | High | 7.5 | 2026-07-21 | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
CVE-2023-25747 | High | 7.5 | 2023-06-19 | A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox f… |
CVE-2023-29537 | High | 7.5 | 2023-06-02 | Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects F… |
CVE-2020-6830 | High | 7.5 | 2020-05-26 | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used… |
CVE-2026-16404 | High | 7.4 | 2026-07-21 | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. |