Mozilla
Page 3 of 37 — Mozilla CVEs from a corpus of 3627, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6758 | High | 7.5 | 2026-04-21 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6757 | Medium | 6.3 | 2026-04-21 | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140… |
CVE-2026-6756 | High | 7.5 | 2026-04-21 | Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150. |
CVE-2026-6755 | Medium | 6.5 | 2026-04-21 | Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
CVE-2026-6754 | High | 7.5 | 2026-04-21 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Th… |
CVE-2026-6753 | High | 7.3 | 2026-04-21 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6752 | High | 7.3 | 2026-04-21 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, an… |
CVE-2026-6751 | High | 7.3 | 2026-04-21 | Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbir… |
CVE-2026-6750 | High | 8.8 | 2026-04-21 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150… |
CVE-2026-6749 | High | 7.5 | 2026-04-21 | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefo… |
CVE-2026-6748 | Critical | 9.8 | 2026-04-21 | Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbir… |
CVE-2026-6747 | High | 7.5 | 2026-04-21 | Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2026-6746 | High | 7.5 | 2026-04-21 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thu… |
CVE-2026-6654 | Medium | 5.1 | 2026-04-20 | Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_place` skips setting… |
CVE-2026-5735 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough… |
CVE-2026-5734 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memo… |
CVE-2026-5733 | High | 8.8 | 2026-04-07 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2. |
CVE-2026-5732 | High | 8.8 | 2026-04-07 | Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderb… |
CVE-2026-5731 | Critical | 9.8 | 2026-04-07 | Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs s… |
CVE-2026-4371 | High | 7.4 | 2026-03-24 | A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connectio… |
CVE-2026-3889 | Medium | 6.5 | 2026-03-24 | Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9. |
CVE-2026-4729 | Critical | 9.8 | 2026-03-24 | Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-4728 | Medium | 6.5 | 2026-03-24 | Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4727 | High | 7.5 | 2026-03-24 | Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4726 | High | 7.5 | 2026-03-24 | Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4725 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4724 | Critical | 9.1 | 2026-03-24 | Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4723 | Critical | 9.8 | 2026-03-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4722 | High | 8.8 | 2026-03-24 | Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
CVE-2026-4721 | Critical | 9.8 | 2026-03-24 | Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence… |
CVE-2026-4720 | Critical | 9.8 | 2026-03-24 | Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-4719 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird… |
CVE-2026-4718 | High | 8.1 | 2026-03-24 | Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4717 | Critical | 9.8 | 2026-03-24 | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4716 | Critical | 9.1 | 2026-03-24 | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunder… |
CVE-2026-4715 | Critical | 9.1 | 2026-03-24 | Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140… |
CVE-2026-4714 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 14… |
CVE-2026-4713 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4712 | High | 7.5 | 2026-03-24 | Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4711 | Critical | 9.8 | 2026-03-24 | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4710 | Critical | 9.8 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 14… |
CVE-2026-4709 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbir… |
CVE-2026-4708 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4707 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderb… |
CVE-2026-4706 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderb… |
CVE-2026-4705 | Critical | 9.8 | 2026-03-24 | Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4704 | High | 7.5 | 2026-03-24 | Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4702 | Critical | 9.8 | 2026-03-24 | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4701 | Critical | 9.8 | 2026-03-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4700 | Critical | 9.8 | 2026-03-24 | Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. |
CVE-2026-4699 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thun… |
CVE-2026-4698 | Critical | 9.8 | 2026-03-24 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149… |
CVE-2026-4697 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Th… |
CVE-2026-4696 | Critical | 9.8 | 2026-03-24 | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, an… |
CVE-2026-4695 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Th… |
CVE-2026-4694 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9… |
CVE-2026-4693 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thund… |
CVE-2026-4692 | Critical | 10.0 | 2026-03-24 | Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, an… |
CVE-2026-4691 | Critical | 9.8 | 2026-03-24 | Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 14… |
CVE-2026-4690 | High | 8.6 | 2026-03-24 | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34… |
CVE-2026-4689 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34… |
CVE-2026-4688 | Critical | 10.0 | 2026-03-24 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149… |
CVE-2026-4687 | High | 8.6 | 2026-03-24 | Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 14… |
CVE-2026-4686 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderb… |
CVE-2026-4685 | High | 7.5 | 2026-03-24 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderb… |
CVE-2026-4684 | High | 7.5 | 2026-03-24 | Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunde… |
CVE-2026-3847 | High | 8.8 | 2026-03-10 | Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these cou… |
CVE-2026-3846 | Medium | 6.5 | 2026-03-10 | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2. |
CVE-2026-3845 | High | 8.8 | 2026-03-10 | Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2. |
CVE-2026-2919 | Medium | 4.3 | 2026-03-09 | Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and tr… |
CVE-2026-2807 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2026-2806 | Critical | 9.1 | 2026-02-24 | Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2805 | Critical | 9.8 | 2026-02-24 | Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2804 | Medium | 5.4 | 2026-02-24 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2803 | High | 7.5 | 2026-02-24 | Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2802 | Medium | 4.2 | 2026-02-24 | Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2801 | High | 7.5 | 2026-02-24 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2800 | Critical | 9.8 | 2026-02-24 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2799 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2798 | High | 8.8 | 2026-02-24 | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2797 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2796 | Critical | 9.8 | 2026-02-24 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2795 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
CVE-2026-2794 | High | 7.5 | 2026-02-24 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148. |
CVE-2026-2793 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence… |
CVE-2026-2792 | Critical | 9.8 | 2026-02-24 | Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruptio… |
CVE-2026-2791 | Critical | 9.8 | 2026-02-24 | Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2790 | Critical | 9.8 | 2026-02-24 | Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 14… |
CVE-2026-2789 | Critical | 9.8 | 2026-02-24 | Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Th… |
CVE-2026-2788 | Critical | 9.8 | 2026-02-24 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbir… |
CVE-2026-2787 | Critical | 9.8 | 2026-02-24 | Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148… |
CVE-2026-2786 | Critical | 9.8 | 2026-02-24 | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2785 | Critical | 9.8 | 2026-02-24 | Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2784 | Critical | 9.8 | 2026-02-24 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2783 | High | 7.5 | 2026-02-24 | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thund… |
CVE-2026-2782 | Critical | 9.8 | 2026-02-24 | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2781 | Critical | 9.8 | 2026-02-24 | Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Fir… |
CVE-2026-2780 | Critical | 9.8 | 2026-02-24 | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. |
CVE-2026-2779 | Critical | 9.8 | 2026-02-24 | Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbir… |
CVE-2026-2778 | Critical | 10.0 | 2026-02-24 | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox… |