Firefox (Mozilla) - vulnerabilities (CVEs)

3445 CVEs, 328 in the last 30 days, 1263 known versions, newest CVE from 2026-10-27. Vendor: Mozilla.

CVEs of Firefox

• CVE-2026-118027, 2026-10-27: Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
• CVE-2026-118025, 2026-10-27: Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118024, 2026-10-27: Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118026, 2026-10-27: Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118021, 2026-10-27: Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118023, 2026-10-27: Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118022, 2026-10-27: Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118020, 2026-10-27: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118019, 2026-10-27: Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118018, 2026-10-27: Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
• CVE-2026-118017, 2026-10-27: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118016, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118015, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118014, 2026-10-27: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118013, 2026-10-27: Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118012, 2026-10-27: Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118011, 2026-10-27: Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118010, 2026-10-27: Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118009, 2026-10-27: Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118008 - CVSS 8.8 (high), 2026-10-27: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118007, 2026-10-27: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118005, 2026-10-27: Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118006, 2026-10-27: Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
• CVE-2026-118004, 2026-10-27: Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird…
• CVE-2026-118002, 2026-10-27: Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-118003, 2026-10-27: Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117998, 2026-10-27: Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-118000, 2026-10-27: Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117999, 2026-10-27: Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117995, 2026-10-27: Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117997, 2026-10-27: Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117996, 2026-10-27: Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117992, 2026-10-27: Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117994, 2026-10-27: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117993, 2026-10-27: Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117991, 2026-10-27: Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117990, 2026-10-27: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6,…
• CVE-2026-117988, 2026-10-27: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6,…
• CVE-2026-117987, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117989, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117985, 2026-10-27: Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117984, 2026-10-27: Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird…
• CVE-2026-117986, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117983, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117982, 2026-10-27: Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117979, 2026-10-27: Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117981, 2026-10-27: Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117980, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117976, 2026-10-27: Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117978, 2026-10-27: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117977, 2026-10-27: Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117975, 2026-10-27: Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117974, 2026-10-27: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117973, 2026-10-27: Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117972, 2026-10-27: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117971, 2026-10-27: Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117969, 2026-10-27: Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117968, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117970, 2026-10-27: Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117966, 2026-10-27: Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117965, 2026-10-27: Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117967, 2026-10-27: Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117963, 2026-10-27: Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117962, 2026-10-27: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6,…
• CVE-2026-117964, 2026-10-27: Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117960, 2026-10-27: Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117961, 2026-10-27: Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117959, 2026-10-27: Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117958, 2026-10-27: Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117957, 2026-10-27: Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117956, 2026-10-27: Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117955, 2026-10-27: JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117954, 2026-10-27: Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117953, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117952, 2026-10-27: Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117951, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117950, 2026-10-27: Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117949, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117948, 2026-10-27: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117947, 2026-10-27: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117946, 2026-10-27: Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117944, 2026-10-27: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117943, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117945, 2026-10-27: Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117940, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117942, 2026-10-27: Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6,…
• CVE-2026-117941, 2026-10-27: Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117937, 2026-10-27: Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117939, 2026-10-27: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117938, 2026-10-27: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117936, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117935, 2026-10-27: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117934, 2026-10-27: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117933, 2026-10-27: Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird…
• CVE-2026-117932, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
• CVE-2026-117931, 2026-10-27: Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117930, 2026-10-27: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,…
• CVE-2026-117929, 2026-10-27: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117928, 2026-10-27: Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and…
• CVE-2026-117927, 2026-10-27: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.