Total
3487 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100815 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100816 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.1 HIGH |
| Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100818 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.6 CRITICAL |
| Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |||||
| CVE-2026-100777 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100778 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.6 CRITICAL |
| Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100779 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100780 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2025-8027 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 6.5 MEDIUM |
| On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. | |||||
| CVE-2025-0240 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 4.0 MEDIUM |
| Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6. | |||||
| CVE-2025-1012 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 7.5 HIGH |
| A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. | |||||
| CVE-2025-1011 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. | |||||
| CVE-2025-1930 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. | |||||
| CVE-2025-0246 | 2 Google, Mozilla | 2 Android, Firefox | 2026-10-05 | N/A | 6.5 MEDIUM |
| When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-0244. This vulnerability was fixed in Firefox 134. | |||||
| CVE-2025-8364 | 2 Google, Mozilla | 2 Android, Firefox | 2026-10-05 | N/A | 4.3 MEDIUM |
| A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 141. | |||||
| CVE-2025-2857 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 10.0 CRITICAL |
| Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1. | |||||
| CVE-2025-5020 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 4.3 MEDIUM |
| Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139. | |||||
| CVE-2025-55030 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 6.1 MEDIUM |
| Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142. | |||||
| CVE-2025-14860 | 1 Mozilla | 1 Firefox | 2026-10-05 | N/A | 9.8 CRITICAL |
| Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. | |||||
| CVE-2025-1019 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 4.3 MEDIUM |
| The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135. | |||||
| CVE-2025-0239 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 4.0 MEDIUM |
| When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6. | |||||