Mozilla Firefox vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mozilla Firefox: 607 record(s), with affected versions and fixes.cpe:2.3:a:mozilla:firefox
CVE-2026-4722
High · 8.8
Mar 24, 2026
Privilege escalation in the IPC component
Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4721
Critical · 9.8
CWE-120 Mar 24, 2026
Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4720
Critical · 9.8
CWE-120 Mar 24, 2026
Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4719
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Text component
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4718
High · 8.1
CWE-758 Mar 24, 2026
Undefined behavior in the WebRTC: Signaling component
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4717
Critical · 9.8
Mar 24, 2026
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4716
Critical · 9.1
CWE-908 Mar 24, 2026
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4715
Critical · 9.1
CWE-908 Mar 24, 2026
Uninitialized memory in the Graphics: Canvas2D component
Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4714
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video component
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4713
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4712
High · 7.5
CWE-200 Mar 24, 2026
Information disclosure in the Widget: Cocoa component
Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4711
Critical · 9.8
CWE-416 Mar 24, 2026
Use-after-free in the Widget: Cocoa component
Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4710
Critical · 9.8
CWE-119 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video component
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4709
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4708
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4707
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4706
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4705
Critical · 9.8
CWE-758 Mar 24, 2026
Undefined behavior in the WebRTC: Signaling component
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4704
High · 7.5
CWE-400 Mar 24, 2026
Denial-of-service in the WebRTC: Signaling component
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4702
Critical · 9.8
CWE-843 Mar 24, 2026
JIT miscompilation in the JavaScript Engine component
JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4701
Critical · 9.8
CWE-416 Mar 24, 2026
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4700
Critical · 9.8
CWE-288 Mar 24, 2026
Mitigation bypass in the Networking: HTTP component
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4699
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Layout: Text and Fonts component
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4698
Critical · 9.8
CWE-843 Mar 24, 2026
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4697
High · 7.5
CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video: Web Codecs component
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.