Mozilla Firefox vulnerabilities

CVE-2026-14241 [CRITICAL] CWE-787 CVE-2026-14241: Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.

CVE-2026-4710 [CRITICAL] CWE-119 CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-2793 [CRITICAL] CWE-787 CVE-2026-2793: Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Fire

CVE-2026-2634 [CRITICAL] CWE-451 CVE-2026-2634: Malicious scripts could cause desynchronization between the address bar and web content before a res Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4.

CVE-2026-5731 [CRITICAL] CWE-119 CVE-2026-5731: Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fi Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firef

CVE-2025-14860 [CRITICAL] CWE-416 CVE-2025-14860: Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146. Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.

CVE-2026-16358 [CRITICAL] CWE-346 CVE-2026-16358: Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1 Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16375 [CRITICAL] CWE-346 CVE-2026-16375: Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-6768 [CRITICAL] CWE-288 CVE-2026-6768: Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-6760 [CRITICAL] CWE-288 CVE-2026-6760: Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2015-4477 [CRITICAL] CVE-2015-4477: Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allo Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.

CVE-2020-15663 [HIGH] CWE-427 CVE-2020-15663: If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation

CVE-2010-0166 [MEDIUM] CWE-119 CVE-2010-0166: The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mo The gfxTextRun::SanitizeGlyphRuns function in gfx/thebes/src/gfxFont.cpp in the browser engine in Mozilla Firefox 3.6 before 3.6.2 on Mac OS X, when the Core Text API is used, does not properly perform certain deletions, which allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary

CVE-2005-2262 [MEDIUM] CVE-2005-2262: Firefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tr Firefox 1.0.3 and 1.0.4, and Netscape 8.0.2, allows remote attackers to execute arbitrary code by tricking the user into using the "Set As Wallpaper" (in Firefox) or "Set as Background" (in Netscape) context menu on an image URL that is really a javascript: URL with an eval statement, aka "Firewalling."

CVE-2010-3766 [CRITICAL] CWE-399 CVE-2010-3766: Use-after-free vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey Use-after-free vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allows remote attackers to execute arbitrary code via vectors involving a change to an nsDOMAttribute node.

CVE-2026-74986 [CRITICAL] CWE-200 CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in F Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74956 [CRITICAL] CWE-843 CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Fir Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74961 [CRITICAL] CWE-203 CVE-2026-74961: Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 15 Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74938 [CRITICAL] CWE-693 CVE-2026-74938: Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Fire Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-16380 [CRITICAL] CWE-693 CVE-2026-16380: Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thund Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.