Total
3487 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-74939 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74935 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-21 | N/A | 8.8 HIGH |
| Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74961 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-20 | N/A | 9.1 CRITICAL |
| Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74968 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-20 | N/A | 5.4 MEDIUM |
| Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74979 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-20 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74971 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 4.3 MEDIUM |
| Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74972 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 4.3 MEDIUM |
| Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74973 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 4.2 MEDIUM |
| Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74974 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 5.4 MEDIUM |
| Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74964 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 9.8 CRITICAL |
| Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74962 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 8.1 HIGH |
| Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2020-15664 | 1 Mozilla | 4 Firefox, Firefox Esr, Firefox Mobile and 1 more | 2026-08-19 | 4.3 MEDIUM | 6.5 MEDIUM |
| By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. | |||||
| CVE-2026-74983 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 8.1 HIGH |
| Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2023-29538 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 4.3 MEDIUM |
| Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2022-26486 | 1 Mozilla | 4 Firefox, Firefox Focus, Firefox Mobile and 1 more | 2026-08-19 | N/A | 9.6 CRITICAL |
| An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. | |||||
| CVE-2020-12400 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 1.2 LOW | 4.7 MEDIUM |
| When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | |||||
| CVE-2020-15666 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 4.3 MEDIUM | 6.5 MEDIUM |
| When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | |||||
| CVE-2020-12401 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 1.9 LOW | 4.7 MEDIUM |
| During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | |||||
| CVE-2023-29537 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 7.5 HIGH |
| Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2023-29543 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 8.8 HIGH |
| An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||