Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Telemetry componentCVE-2026-4687Fix available8.6 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D componentCVE-2026-4686Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Graphics: Canvas2D componentCVE-2026-4685Fix available7.5 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreRace condition, use-after-free in the Graphics: WebRender componentCVE-2026-4684Fix available7.5 High
- mozilla firefoxMemory safety bugs fixed in Firefox 148.0.2CVE-2026-38478.8 High
- mozilla firefoxSame-origin policy bypass in the CSS Parsing and Computation componentCVE-2026-38466.5 Medium
- mozilla firefoxHeap buffer overflow in the Audio/Video: Playback component in Firefox for AndroidCVE-2026-38458.8 High
- mozilla focus for ios, firefox focus +1 moreAttacker-controlled content shown under spoofed domains in Focus for iOS via stalled navigation and iframe redirectCVE-2026-29194.3 Medium
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreMemory safety bugs fixed in Firefox 148 and Thunderbird 148CVE-2026-28079.8 Critical
- mozilla firefox, thunderbird +1 moreUninitialized memory in the Graphics: Text componentCVE-2026-28069.1 Critical
- mozilla firefox, thunderbird +1 moreInvalid pointer in the DOM: Core & HTML componentCVE-2026-28059.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly componentCVE-2026-28045.4 Medium
- mozilla firefox, thunderbird +1 moreInformation disclosure, mitigation bypass in the Settings UI componentCVE-2026-28037.5 High
- mozilla firefox, thunderbird +1 moreRace condition in the JavaScript: GC componentCVE-2026-28024.2 Medium
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript: WebAssembly componentCVE-2026-28017.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the WebAuthn component in Firefox for AndroidCVE-2026-28009.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreUse-after-free in the DOM: Core & HTML componentCVE-2026-27999.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreUse-after-free in the DOM: Core & HTML componentCVE-2026-27988.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreUse-after-free in the JavaScript: GC componentCVE-2026-27979.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreJIT miscompilation in the JavaScript: WebAssembly componentCVE-2026-2796Public exploit9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +4 more +6 moreUse-after-free in the JavaScript: GC componentCVE-2026-27959.8 Critical
- mozilla firefox, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreInformation disclosure due to uninitialized memory in Firefox and Firefox Focus for AndroidCVE-2026-27947.5 High
- mozilla firefox, firefox for ios +1 moreSpoofed web content presented under trusted domains using scripted navigation on Firefox iOSCVE-2026-26349.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148CVE-2026-2793Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMemory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148CVE-2026-2792Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Networking: Cache componentCVE-2026-2791Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Networking: JAR componentCVE-2026-2790Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Graphics: ImageLib componentCVE-2026-2789Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Audio/Video: GMP componentCVE-2026-2788Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Window and Location componentCVE-2026-2787Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript Engine componentCVE-2026-2786Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreInvalid pointer in the JavaScript Engine componentCVE-2026-2785Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Security componentCVE-2026-2784Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure due to JIT miscompilation in the JavaScript Engine: JIT componentCVE-2026-2783Fix available7.5 High
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Netmonitor componentCVE-2026-2782Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreInteger overflow in the Libraries component in NSSCVE-2026-2781Fix available9.8 Critical
- mozilla firefox, thunderbird +1 morePrivilege escalation in the Netmonitor componentCVE-2026-2780Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Networking: JAR componentCVE-2026-2779Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the DOM: Core & HTML componentCVE-2026-2778Fix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 morePrivilege escalation in the Messaging System componentCVE-2026-2777Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape due to incorrect boundary conditions in the Telemetry component in External SoftwareCVE-2026-2776Fix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the DOM: HTML Parser componentCVE-2026-2775Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreInteger overflow in the Audio/Video componentCVE-2026-2774Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreIncorrect boundary conditions in the Web Audio componentCVE-2026-2773Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Audio/Video: Playback componentCVE-2026-2772Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUndefined behavior in the DOM: Core & HTML componentCVE-2026-2771Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the DOM: Bindings (WebIDL) componentCVE-2026-2770Fix available9.8 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the Storage: IndexedDB componentCVE-2026-2769Fix available8.8 High
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreSandbox escape in the Storage: IndexedDB componentCVE-2026-2768Fix available10.0 Critical
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreUse-after-free in the JavaScript: WebAssembly componentCVE-2026-2767Fix available9.8 Critical
- Show moreLoading…