CVE Intelligence

Mozilla vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Mozilla products: 653 record(s), with severity, exploitation and fixes.

Firefox 617Thunderbird 534Firefox Mobile 17Firefox ESR 12Firefox Focus 4Focus 3Thunderbird Esr 2Firefox for Android 2Firefox Os 1Seamonkey 1Thin-vec 10din Scanner 1Rhino 1Klar 1Node-convict 1Network Security Services 1

Exploited only (KEV) →

CVE-2026-2807 Critical · 9.8 CWE-787 Feb 24, 2026
Memory safety bugs fixed in Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2806 Critical · 9.1 CWE-908 Feb 24, 2026
Uninitialized memory in the Graphics: Text component
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2805 Critical · 9.8 CWE-824 Feb 24, 2026
Invalid pointer in the DOM: Core & HTML component
Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2804 Medium · 5.4 CWE-416 Feb 24, 2026
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2803 High · 7.5 CWE-200 Feb 24, 2026
Information disclosure, mitigation bypass in the Settings UI component
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2802 Medium · 4.2 CWE-362 Feb 24, 2026
Race condition in the JavaScript: GC component
Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2801 High · 7.5 CWE-754 Feb 24, 2026
Incorrect boundary conditions in the JavaScript: WebAssembly component
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2800 Critical · 9.8 CWE-290 Feb 24, 2026
Spoofing issue in the WebAuthn component in Firefox for Android
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2799 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2798 High · 8.8 CWE-416 Feb 24, 2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2797 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2796 Critical · 9.8 CWE-843 Feb 24, 2026
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2795 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2794 High · 7.5 CWE-908 Feb 24, 2026
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.
CVE-2026-2793 Critical · 9.8 CWE-787 Feb 24, 2026
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2792 Critical · 9.8 CWE-787 Feb 24, 2026
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2791 Critical · 9.8 CWE-288 Feb 24, 2026
Mitigation bypass in the Networking: Cache component
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2790 Critical · 9.8 CWE-346 Feb 24, 2026
Same-origin policy bypass in the Networking: JAR component
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2789 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2788 Critical · 9.8 CWE-119 Feb 24, 2026
Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2787 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the DOM: Window and Location component
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2786 Critical · 9.8 CWE-416 Feb 24, 2026
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2785 Critical · 9.8 CWE-824 Feb 24, 2026
Invalid pointer in the JavaScript Engine component
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2784 Critical · 9.8 CWE-288 Feb 24, 2026
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2783 High · 7.5 CWE-843 Feb 24, 2026
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.