CVE Intelligence

Mozilla vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Mozilla products: 642 record(s), with severity, exploitation and fixes.

Firefox 606Thunderbird 523Firefox Mobile 17Firefox ESR 11Firefox Focus 4Focus 3Thunderbird Esr 2Firefox for Android 2Firefox Os 1Seamonkey 1Thin-vec 10din Scanner 1Rhino 1Klar 1Node-convict 1Network Security Services 1

Exploited only (KEV) →

CVE-2026-84139 Medium · 6.1 CWE-1021 Sep 1, 2026
Clickjacking issue in the DOM: Events component
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84138 Medium · 6.5 CWE-400 Sep 1, 2026
Denial-of-service in the PDF Viewer component
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84137 Medium · 4.3 CWE-346 Sep 1, 2026
Spoofing issue in the DOM: Core & HTML component
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84136 Medium · 6.1 CWE-79 Sep 1, 2026
Other issue in the DOM: Navigation component
Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84135 Critical · 9.8 CWE-20 Sep 1, 2026
Other issue in Firefox Focus for Android
Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.
CVE-2026-84134 Critical · 9.8 CWE-200 Sep 1, 2026
Other issue in the Profile Backup component
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84133 Critical · 9.8 CWE-346 Sep 1, 2026
Site isolation issue in the DOM: Push Subscriptions component
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84132 High · 7.5 CWE-200 Sep 1, 2026
Information disclosure in the Networking: HTTP component
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84131 High · 8.8 CWE-763 Sep 1, 2026
Privilege escalation due to invalid pointer in the Graphics component
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84130 High · 7.5 CWE-200 Sep 1, 2026
Information disclosure in the Graphics: WebGPU component
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84129 Critical · 9.8 CWE-346 Sep 1, 2026
Site isolation issue in the DOM: Navigation component
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84128 High · 8.8 CWE-284 Sep 1, 2026
Privilege escalation in the WebDriver BiDi component
Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84127 Medium · 4.3 CWE-200 Sep 1, 2026
Information disclosure in the WebExtensions component in Firefox for Android
Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.
CVE-2026-84126 Medium · 4.3 CWE-120 Sep 1, 2026
Incorrect boundary conditions in the Layout: Grid component
Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
CVE-2026-84125 Medium · 5.4 CWE-416 Sep 1, 2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84124 Medium · 5.4 CWE-416 Sep 1, 2026
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84123 High · 8.8 CWE-416 Sep 1, 2026
Privilege escalation due to use-after-free in the Graphics: WebGPU component
Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84122 Medium · 5.4 CWE-416 Sep 1, 2026
Use-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84121 Critical · 9.6 CWE-416 Sep 1, 2026
Sandbox escape due to use-after-free in the DOM: Security component
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84120 Medium · 5.4 CWE-416 Sep 1, 2026
Use-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84119 Critical · 9.6 CWE-416 Sep 1, 2026
Sandbox escape due to use-after-free in the DOM: Navigation component
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84118 Medium · 5.4 CWE-416 Sep 1, 2026
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-84117 High · 8.8 CWE-284 Sep 1, 2026
Privilege escalation in Firefox for Android
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.
CVE-2026-81267 Medium · 5.4 CWE-451 Aug 31, 2026
Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS
A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.
CVE-2026-75874 Critical · 10.0 CWE-693 Aug 18, 2026
Sandbox escape in the Remote Settings Client component
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.