Mozilla
Page 2 of 37 — Mozilla CVEs from a corpus of 3627, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12305 | High | 7.5 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12304 | Critical | 9.1 | 2026-06-16 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbi… |
CVE-2026-12303 | Medium | 4.3 | 2026-06-16 | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12302 | Medium | 6.5 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12301 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12300 | Medium | 5.3 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12299 | Medium | 5.4 | 2026-06-16 | JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and… |
CVE-2026-12298 | Medium | 5.4 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
CVE-2026-12297 | Critical | 9.6 | 2026-06-16 | Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 1… |
CVE-2026-12296 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird… |
CVE-2026-12295 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thun… |
CVE-2026-12294 | Critical | 9.6 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunder… |
CVE-2026-12293 | Critical | 9.8 | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
CVE-2026-12292 | High | 8.1 | 2026-06-16 | Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140… |
CVE-2026-12291 | High | 8.8 | 2026-06-16 | Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thu… |
CVE-2026-12290 | High | 8.1 | 2026-06-16 | Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 1… |
CVE-2026-12289 | High | 8.8 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152… |
CVE-2026-45173 | Medium | 6.5 | 2026-06-11 | Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page ver… |
CVE-2026-11799 | High | 7.5 | 2026-06-09 | UXSS in Focus for iOS / Klar Webkit navigation. This vulnerability was fixed in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. |
CVE-2026-10702 | Medium | 4.3 | 2026-06-02 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3. |
CVE-2026-10701 | High | 7.5 | 2026-06-02 | Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3. |
CVE-2026-9309 | Medium | 5.4 | 2026-06-01 | Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and l… |
CVE-2026-9308 | Medium | 5.4 | 2026-06-01 | Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placehold… |
CVE-2026-9078 | Medium | 5.4 | 2026-05-25 | Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RT… |
CVE-2026-8706 | Medium | 6.5 | 2026-05-19 | Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receiv… |
CVE-2026-8975 | High | 8.8 | 2026-05-19 | Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume th… |
CVE-2026-8974 | High | 8.8 | 2026-05-19 | Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effor… |
CVE-2026-8973 | High | 8.8 | 2026-05-19 | Memory safety bugs present in Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2026-8972 | High | 8.8 | 2026-05-19 | Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8971 | Medium | 6.5 | 2026-05-19 | Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8970 | High | 8.8 | 2026-05-19 | Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8969 | High | 8.1 | 2026-05-19 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8968 | High | 7.5 | 2026-05-19 | Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird… |
CVE-2026-8967 | High | 7.5 | 2026-05-19 | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8966 | High | 7.5 | 2026-05-19 | Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8965 | High | 7.5 | 2026-05-19 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8964 | High | 7.5 | 2026-05-19 | Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8963 | High | 7.5 | 2026-05-19 | Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8962 | High | 8.1 | 2026-05-19 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8961 | Medium | 6.5 | 2026-05-19 | Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8960 | High | 7.5 | 2026-05-19 | Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8959 | Critical | 9.6 | 2026-05-19 | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbir… |
CVE-2026-8958 | High | 8.6 | 2026-05-19 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderb… |
CVE-2026-8957 | High | 8.8 | 2026-05-19 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 14… |
CVE-2026-8956 | Critical | 9.8 | 2026-05-19 | Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8955 | High | 8.8 | 2026-05-19 | Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8954 | High | 7.5 | 2026-05-19 | Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151… |
CVE-2026-8953 | Critical | 9.6 | 2026-05-19 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140… |
CVE-2026-8952 | High | 8.8 | 2026-05-19 | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8951 | Medium | 6.5 | 2026-05-19 | Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151. |
CVE-2026-8950 | Critical | 9.3 | 2026-05-19 | Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird… |
CVE-2026-8949 | High | 7.5 | 2026-05-19 | Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
CVE-2026-8948 | Critical | 9.1 | 2026-05-19 | Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
CVE-2026-8947 | High | 7.3 | 2026-05-19 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, a… |
CVE-2026-8946 | High | 7.5 | 2026-05-19 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Th… |
CVE-2026-8945 | High | 7.5 | 2026-05-19 | Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. |
CVE-2026-8401 | Critical | 9.8 | 2026-05-12 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. |
CVE-2026-8391 | Medium | 5.3 | 2026-05-12 | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. |
CVE-2026-8390 | High | 7.3 | 2026-05-12 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. |
CVE-2026-8389 | High | 8.8 | 2026-05-12 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3. |
CVE-2026-8388 | Medium | 6.5 | 2026-05-12 | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11… |
CVE-2026-41512 | Critical | 9.9 | 2026-05-08 | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via… |
CVE-2026-8094 | Critical | 9.8 | 2026-05-07 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2. |
CVE-2026-8093 | High | 8.1 | 2026-05-07 | Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-8092 | High | 8.1 | 2026-05-07 | Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we pr… |
CVE-2026-8091 | Critical | 9.8 | 2026-05-07 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thund… |
CVE-2026-8090 | High | 7.3 | 2026-05-07 | Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0… |
CVE-2026-7324 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these… |
CVE-2026-7323 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7322 | High | 7.3 | 2026-04-28 | Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2026-7321 | Critical | 9.6 | 2026-04-28 | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox… |
CVE-2026-7320 | High | 7.5 | 2026-04-28 | Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1… |
CVE-2026-6786 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-6785 | High | 7.5 | 2026-04-26 | Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence… |
CVE-2026-6784 | High | 7.5 | 2026-04-21 | Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-6783 | Medium | 5.3 | 2026-04-21 | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6782 | High | 7.5 | 2026-04-21 | Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6781 | High | 7.5 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6780 | High | 7.5 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6779 | Medium | 5.3 | 2026-04-21 | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6778 | Medium | 5.3 | 2026-04-21 | Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6777 | Medium | 5.3 | 2026-04-21 | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6776 | High | 7.8 | 2026-04-21 | Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunde… |
CVE-2026-6775 | Medium | 5.3 | 2026-04-21 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6774 | Medium | 5.4 | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6773 | High | 7.5 | 2026-04-21 | Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6772 | High | 7.5 | 2026-04-21 | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbi… |
CVE-2026-6771 | Critical | 9.8 | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6770 | Medium | 6.5 | 2026-04-21 | Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6769 | High | 8.8 | 2026-04-21 | Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6768 | Critical | 9.8 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6767 | Medium | 5.3 | 2026-04-21 | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunde… |
CVE-2026-6766 | High | 7.5 | 2026-04-21 | Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderb… |
CVE-2026-6765 | Medium | 5.3 | 2026-04-21 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6764 | Medium | 6.5 | 2026-04-21 | Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Th… |
CVE-2026-6763 | Medium | 6.5 | 2026-04-21 | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6762 | Medium | 6.3 | 2026-04-21 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thu… |
CVE-2026-6761 | High | 8.8 | 2026-04-21 | Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6760 | Critical | 9.8 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6759 | High | 7.5 | 2026-04-21 | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |