Total
3487 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-29540 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 6.1 MEDIUM |
| Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2022-26485 | 1 Mozilla | 4 Firefox, Firefox Focus, Firefox Mobile and 1 more | 2026-08-19 | N/A | 8.8 HIGH |
| Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. | |||||
| CVE-2023-29533 | 1 Mozilla | 5 Firefox, Firefox Esr, Firefox Mobile and 2 more | 2026-08-19 | N/A | 4.3 MEDIUM |
| A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. | |||||
| CVE-2020-6829 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 5.0 MEDIUM | 5.3 MEDIUM |
| When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. This vulnerability affects Firefox < 80 and Firefox for Android < 80. | |||||
| CVE-2023-29551 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 8.8 HIGH |
| Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2023-29549 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 6.5 MEDIUM |
| Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2020-15670 | 1 Mozilla | 4 Firefox, Firefox Esr, Firefox Mobile and 1 more | 2026-08-19 | 6.8 MEDIUM | 8.8 HIGH |
| Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. | |||||
| CVE-2023-29544 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | N/A | 6.5 MEDIUM |
| If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | |||||
| CVE-2026-74967 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 5.4 MEDIUM |
| Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74976 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 6.5 MEDIUM |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74963 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 5.4 MEDIUM |
| Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74958 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 7.5 HIGH |
| Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74956 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 9.1 CRITICAL |
| Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74954 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 7.5 HIGH |
| Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74938 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74937 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 8.8 HIGH |
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2024-9680 | 2 Debian, Mozilla | 3 Debian Linux, Firefox, Thunderbird | 2026-08-04 | N/A | 9.8 CRITICAL |
| An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0. | |||||
| CVE-2026-8967 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-23 | N/A | 7.5 HIGH |
| Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | |||||
| CVE-2026-8965 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-23 | N/A | 7.5 HIGH |
| Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | |||||
| CVE-2026-8970 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-23 | N/A | 8.8 HIGH |
| Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||