Mozilla Firefox vulnerabilities
3,536 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,536
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1094MEDIUM1343LOW68UNKNOWN50
Vulnerabilities
Page 10 of 177
CVE-2022-24791P3CRITICALCVSS 9.8≥ 0, < 1:1snap1-0ubuntu12022-03-31
CVE-2022-24791 [CRITICAL] CVE-2022-24791: Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift
Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference type
osv
CVE-2021-30547P3HIGHCVSS 8.8fixed in 97.02021-06-15
CVE-2021-30547 [HIGH] CWE-787 CVE-2021-30547: Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to po
Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
nvd
CVE-2026-4696P3CRITICALCVSS 9.8fixed in 115.34.0fixed in 149.0+1 more2026-03-24
CVE-2026-4696 [CRITICAL] CWE-416 CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149,
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
nvd
CVE-2026-2775P3CRITICALCVSS 9.8fixed in 115.33.0fixed in 148.0+1 more2026-02-24
CVE-2026-2775 [CRITICAL] CWE-288 CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Fi
Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
nvd
CVE-2026-2770P3CRITICALCVSS 9.8fixed in 115.33.0fixed in 148.0+1 more2026-02-24
CVE-2026-2770 [CRITICAL] CWE-416 CVE-2026-2770: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148,
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
nvd
CVE-2026-2772P3CRITICALCVSS 9.8fixed in 115.33.0fixed in 148.0+1 more2026-02-24
CVE-2026-2772 [CRITICAL] CWE-416 CVE-2026-2772: Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148,
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
nvd
CVE-2026-4705P3CRITICALCVSS 9.8fixed in 140.9.0fixed in 149.02026-03-24
CVE-2026-4705 [CRITICAL] CWE-758 CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149,
Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
nvd
CVE-2026-2787P3CRITICALCVSS 9.8fixed in 115.33.0fixed in 148.0+1 more2026-02-24
CVE-2026-2787 [CRITICAL] CWE-416 CVE-2026-2787: Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 14
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
nvd
CVE-2026-16395P3CRITICALCVSS 9.8fixed in 153.0.02026-07-21
CVE-2026-16395 [CRITICAL] CWE-190 CVE-2026-16395: Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thund
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-16408P3CRITICALCVSS 9.8fixed in 153.0.02026-07-21
CVE-2026-16408 [CRITICAL] CWE-190 CVE-2026-16408: Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-74943P3CRITICALCVSS 9.8fixed in 115.39.0≥ 116.0, < 140.14.0+1 more2026-08-18
CVE-2026-74943 [CRITICAL] CWE-416 CVE-2026-74943: Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Fir
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16355P3CRITICALCVSS 9.8fixed in 115.38.0fixed in 153.0.0+1 more2026-07-21
CVE-2026-16355 [CRITICAL] CWE-843 CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-16353P3CRITICALCVSS 9.8fixed in 115.38.0fixed in 153.0.0+1 more2026-07-21
CVE-2026-16353 [CRITICAL] CWE-416 CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153
Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-84134P3CRITICALCVSS 9.8fixed in 153.2.0≥ 154.0.0, < 155.0.02026-09-01
CVE-2026-84134 [CRITICAL] CWE-200 CVE-2026-84134: Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ES
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
nvdmozilla
CVE-2026-16368P3CRITICALCVSS 9.8fixed in 140.13.0fixed in 153.0.02026-07-21
CVE-2026-16368 [CRITICAL] CWE-119 CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-16382P3CRITICALCVSS 9.8fixed in 153.0.02026-07-21
CVE-2026-16382 [CRITICAL] CWE-693 CVE-2026-16382: Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-92066P3CRITICALCVSS 9.8fixed in 156.0.02026-09-15
CVE-2026-92066 [CRITICAL] CWE-693 CVE-2026-92066: Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thun
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
nvdmozilla
CVE-2026-16407P3CRITICALCVSS 9.8fixed in 153.0.02026-07-21
CVE-2026-16407 [CRITICAL] CWE-284 CVE-2026-16407: Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-0884P3CRITICALCVSS 9.8fixed in 140.7.0fixed in 147.02026-01-13
CVE-2026-0884 [CRITICAL] CWE-416 CVE-2026-0884: Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Fire
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
nvd
CVE-2026-4711P3CRITICALCVSS 9.8fixed in 140.9.0fixed in 149.02026-03-24
CVE-2026-4711 [CRITICAL] CWE-416 CVE-2026-4711: Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox
Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
nvd