CVE Intelligence

Mozilla vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Mozilla products: 642 record(s), with severity, exploitation and fixes.

Firefox 606Thunderbird 523Firefox Mobile 17Firefox ESR 11Firefox Focus 4Focus 3Thunderbird Esr 2Firefox for Android 2Firefox Os 1Seamonkey 1Thin-vec 10din Scanner 1Rhino 1Klar 1Node-convict 1Network Security Services 1

Exploited only (KEV) →

CVE-2026-3889 Medium · 6.5 CWE-451 Mar 24, 2026
Spoofing issue in Thunderbird
Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
CVE-2026-4729 Critical · 9.8 CWE-120 Mar 24, 2026
Memory safety bugs fixed in Firefox 149 and Thunderbird 149
Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4728 Medium · 6.5 CWE-290 Mar 24, 2026
Spoofing issue in the Privacy: Anti-Tracking component
Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4727 High · 7.5 CWE-400 Mar 24, 2026
Denial-of-service in the Libraries component in NSS
Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4726 High · 7.5 CWE-400 Mar 24, 2026
Denial-of-service in the XML component
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4725 Critical · 10.0 CWE-416 Mar 24, 2026
Sandbox escape due to use-after-free in the Graphics: Canvas2D component
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4724 Critical · 9.1 CWE-758 Mar 24, 2026
Undefined behavior in the Audio/Video component
Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4723 Critical · 9.8 CWE-416 Mar 24, 2026
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4722 High · 8.8 Mar 24, 2026
Privilege escalation in the IPC component
Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4721 Critical · 9.8 CWE-120 Mar 24, 2026
Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4720 Critical · 9.8 CWE-120 Mar 24, 2026
Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4719 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Text component
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4718 High · 8.1 CWE-758 Mar 24, 2026
Undefined behavior in the WebRTC: Signaling component
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4717 Critical · 9.8 Mar 24, 2026
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4716 Critical · 9.1 CWE-908 Mar 24, 2026
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4715 Critical · 9.1 CWE-908 Mar 24, 2026
Uninitialized memory in the Graphics: Canvas2D component
Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4714 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video component
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4713 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4712 High · 7.5 CWE-200 Mar 24, 2026
Information disclosure in the Widget: Cocoa component
Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4711 Critical · 9.8 CWE-416 Mar 24, 2026
Use-after-free in the Widget: Cocoa component
Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4710 Critical · 9.8 CWE-119 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video component
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4709 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4708 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4707 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4706 High · 7.5 CWE-754 Mar 24, 2026
Incorrect boundary conditions in the Graphics: Canvas2D component
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.