Filtered by vendor Mozilla
Subscribe
Total
3978 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100809 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.1 HIGH |
| Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100819 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.6 CRITICAL |
| Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100820 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |||||
| CVE-2026-100832 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-96869 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 4.3 MEDIUM |
| Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |||||
| CVE-2026-100782 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100783 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 4.3 MEDIUM |
| Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100784 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100785 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 8.8 HIGH |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100786 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.6 CRITICAL |
| Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2026-100787 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-05 | N/A | 9.6 CRITICAL |
| Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2025-3608 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 6.5 MEDIUM |
| A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2. | |||||
| CVE-2025-3035 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 5.3 MEDIUM |
| By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137. | |||||
| CVE-2025-3033 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 7.7 HIGH |
| After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137. | |||||
| CVE-2025-9187 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 9.8 CRITICAL |
| Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142. | |||||
| CVE-2025-49709 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 9.8 CRITICAL |
| Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4. | |||||
| CVE-2025-3034 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 8.1 HIGH |
| Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137 and Thunderbird 137. | |||||
| CVE-2025-6435 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 8.1 HIGH |
| If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and Thunderbird 140. | |||||
| CVE-2025-5270 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 7.5 HIGH |
| In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. | |||||
| CVE-2025-6433 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 9.8 CRITICAL |
| If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed in Firefox 140 and Thunderbird 140. | |||||