Mozilla vulnerabilities

Published CVEs affecting Mozilla products: 642 record(s), with severity, exploitation and fixes.

Firefox 606 Thunderbird 523 Firefox Mobile 17 Firefox ESR 11 Firefox Focus 4 Focus 3 Thunderbird Esr 2 Firefox for Android 2 Firefox Os 1 Seamonkey 1 Thin-vec 1 0din Scanner 1 Rhino 1 Klar 1 Node-convict 1 Network Security Services 1

Exploited only (KEV) →

CVE-2026-74940 Critical · 9.8 CWE-416 Aug 18, 2026

Use-after-free in the Graphics: Text component

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74939 High · 8.8 CWE-269 Aug 18, 2026

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74938 Critical · 9.1 CWE-693 Aug 18, 2026

Mitigation bypass in the JavaScript: GC component

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74937 High · 8.8 CWE-416 Aug 18, 2026

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74936 Critical · 9.8 CWE-416 Aug 18, 2026

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74935 High · 8.8 CWE-269 Aug 18, 2026

Privilege escalation in the DOM: Networking component

Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74934 High · 7.5 CWE-200 Aug 18, 2026

Site isolation issue in the Graphics: CanvasWebGL component

Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-14899 High · 7.5 CWE-193 Jul 22, 2026

Off-by-one out of bounds read in MIME header parser for forwarding

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

CVE-2026-16412 Critical · 9.8 CWE-119 Jul 21, 2026

Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16411 Critical · 9.8 CWE-119 Jul 21, 2026

Memory safety bugs fixed in Firefox 153

Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16410 Critical · 9.8 CWE-843 Jul 21, 2026

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16409 High · 7.5 CWE-824 Jul 21, 2026

Invalid pointer in the Security: PSM component

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16408 Critical · 9.8 CWE-190 Jul 21, 2026

Integer overflow in the Audio/Video: Playback component

Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16407 Critical · 9.8 CWE-284 Jul 21, 2026

Mitigation bypass in the DOM: Service Workers component

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16406 Critical · 9.1 CWE-693 Jul 21, 2026

Mitigation bypass in the Networking component

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16405 High · 7.5 CWE-200 Jul 21, 2026

Information disclosure in the Networking: WebSockets component

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16404 High · 7.4 CWE-290 Jul 21, 2026

Spoofing issue in Firefox for Android

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-16403 Medium · 6.5 CWE-451 Jul 21, 2026

Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16402 Critical · 9.8 CWE-190 Jul 21, 2026

Integer overflow in the Graphics: ImageLib component

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16401 High · 8.8 CWE-269 Jul 21, 2026

Privilege escalation in the Data Loss Prevention component

Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16400 High · 7.5 CWE-200 Jul 21, 2026

Information disclosure in the DOM: Security component

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16399 High · 7.5 CWE-346 Jul 21, 2026

Site isolation issue in the DOM: Navigation component

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16398 High · 7.5 CWE-200 Jul 21, 2026

Site isolation issue in the Graphics component

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16397 Medium · 6.5 CWE-1021 Jul 21, 2026

Clickjacking issue in the WebExtensions component in Firefox for Android

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-16396 High · 8.8 CWE-269 Jul 21, 2026

Privilege escalation in WebExtensions

Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.