[ Vendor · 185 CVEs ]
Mozilla
CVEs affecting Mozilla published in the last 30 days, plus any Mozilla CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100818 | 29 Sep 2026 | CVSS 9.6 | Mozilla ThunderbirdSandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird… | |
| CVE-2026-100819 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100820 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdPrivilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100821 | 29 Sep 2026 | CVSS 4.7 | Mozilla FirefoxSite isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100822 | 29 Sep 2026 | CVSS 5.4 | Mozilla FirefoxSpoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox… | |
| CVE-2026-100823 | 29 Sep 2026 | CVSS 5.4 | Mozilla FirefoxSpoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. | |
| CVE-2026-100824 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxPrivilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |
| CVE-2026-100825 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100826 | 29 Sep 2026 | CVSS 6.5 | Mozilla FirefoxDenial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4… | |
| CVE-2026-100809 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxSame-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100810 | 29 Sep 2026 | CVSS 9.8 | Mozilla ThunderbirdOther issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100811 | 29 Sep 2026 | CVSS 9.6 | Mozilla ThunderbirdSandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100812 | 29 Sep 2026 | CVSS 6.5 | Mozilla FirefoxDenial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |
| CVE-2026-100813 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100814 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxIncorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100815 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4… | |
| CVE-2026-100816 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxSite isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100817 | 29 Sep 2026 | CVSS 5.4 | Mozilla ThunderbirdOther issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100800 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100801 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdPrivilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100802 | 29 Sep 2026 | CVSS 4.3 | Mozilla ThunderbirdUninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100803 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxSame-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100804 | 29 Sep 2026 | CVSS 9.6 | Mozilla ThunderbirdSandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100805 | 29 Sep 2026 | CVSS 7.5 | Mozilla ThunderbirdRace condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100806 | 29 Sep 2026 | CVSS 4.3 | Mozilla FirefoxUninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100807 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdPrivilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100808 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxMitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100790 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… | |
| CVE-2026-100791 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100792 | 29 Sep 2026 | CVSS 7.1 | Mozilla ThunderbirdJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100793 | 29 Sep 2026 | CVSS 6.5 | Mozilla ThunderbirdJIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100794 | 29 Sep 2026 | CVSS 9.6 | Mozilla ThunderbirdSandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4… | |
| CVE-2026-100795 | 29 Sep 2026 | CVSS 6.5 | Mozilla ThunderbirdDenial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100796 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100797 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxPrivilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100798 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxCryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100799 | 29 Sep 2026 | CVSS 4.3 | Mozilla ThunderbirdUninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100781 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4… | |
| CVE-2026-100782 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxPrivilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird… | |
| CVE-2026-100783 | 29 Sep 2026 | CVSS 4.3 | Mozilla FirefoxUninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100784 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100785 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100786 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird… | |
| CVE-2026-100787 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |
| CVE-2026-100788 | 29 Sep 2026 | CVSS 9.8 | Mozilla ThunderbirdInvalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100789 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100775 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… | |
| CVE-2026-100776 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100777 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100778 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100779 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… | |
| CVE-2026-100780 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100768 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdUse-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100769 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100770 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100771 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxUndefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100772 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100773 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100774 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100757 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… | |
| CVE-2026-100758 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird… | |
| CVE-2026-100759 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxUninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100760 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4… | |
| CVE-2026-100761 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdPrivilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100762 | 29 Sep 2026 | CVSS 9.6 | Mozilla FirefoxSandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157… | |
| CVE-2026-100763 | 29 Sep 2026 | CVSS 9.1 | Mozilla ThunderbirdIncorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |
| CVE-2026-100764 | 29 Sep 2026 | CVSS 8.8 | Mozilla ThunderbirdPrivilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and… | |
| CVE-2026-100765 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and… | |
| CVE-2026-100766 | 29 Sep 2026 | CVSS 4.3 | Mozilla FirefoxInformation disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100767 | 29 Sep 2026 | CVSS 8.8 | Mozilla FirefoxUse-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-100756 | 29 Sep 2026 | CVSS 8.1 | Mozilla FirefoxIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird… | |
| CVE-2024-9680 | 9 Oct 2024 | CVSS 9.8 | Mozilla Firefox Use-After-FreeAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of… | ExploitedFix |
| CVE-2024-9680 | 9 Oct 2024 | CVSS 9.8 | Mozilla Firefox Use-After-FreeAn attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of… | ExploitedFix |
| CVE-2022-26485 | 22 Dec 2022 | CVSS 8.8 | Mozilla Firefox Use-After-FreeRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing… | Exploited |
| CVE-2022-26486 | 22 Dec 2022 | CVSS 9.6 | Mozilla Firefox Use-After-FreeAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in… | Exploited |
| CVE-2020-6819 | 24 Apr 2020 | CVSS 8.1 | Mozilla Firefox And Thunderbird Use-After-FreeUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in… | Exploited |
| CVE-2020-6820 | 24 Apr 2020 | CVSS 8.1 | Mozilla Firefox And Thunderbird Use-After-FreeUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild… | Exploited |
| CVE-2019-17026 | 2 Mar 2020 | CVSS 8.8 | Mozilla Firefox And Thunderbird Type ConfusionIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in… | Exploited |
| CVE-2019-11707 | 23 Jul 2019 | CVSS 8.8 | Mozilla Firefox and Thunderbird Type ConfusionA type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We… | Exploited |
| CVE-2019-11708 | 23 Jul 2019 | CVSS 10.0 | Mozilla Firefox and Thunderbird Sandbox EscapeInsufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent… | Exploited |
| CVE-2016-9079 | 11 Jun 2018 | CVSS 7.5 | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-FreeA use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting… | Exploited |
| CVE-2015-4495 | 8 Aug 2015 | CVSS 8.8 | Mozilla Firefox Security Feature BypassThe PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | ExploitedFix |
| CVE-2013-1690 | 26 Jun 2013 | CVSS 8.8 | Mozilla Firefox and Thunderbird Denial-of-ServiceMozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Exploited |
| CVE-2013-1675 | 16 May 2013 | CVSS 6.5 | Mozilla Firefox Information DisclosureMozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly… | Exploited |
| CVE-2010-3765 | 28 Oct 2010 | CVSS 9.8 | Mozilla Multiple Products Remote Code ExecutionMozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before… | Exploited |
Page 2 of 2