Mozilla Firefox vulnerabilities

CVE-2024-2611 [MEDIUM] CVE-2024-2611: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user in A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2019-11761 [MEDIUM] CWE-362 CVE-2019-11761: By using a form with a data URI it was possible to gain access to the privileged JSONView object tha By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

CVE-2021-29965 [MEDIUM] CWE-610 CVE-2021-29965: A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.

CVE-2023-5723 [MEDIUM] CVE-2023-5723: An attacker with temporary script access to a site could have set a cookie containing invalid charac An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown errors. This vulnerability affects Firefox < 119.

CVE-2024-11696 [MEDIUM] CWE-347 CVE-2024-11696: The application failed to account for exceptions thrown by the `loadManifestFromFile` method during The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated ad

CVE-2026-12298 [MEDIUM] CWE-125 CVE-2026-12298: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2024-53976 [MEDIUM] CWE-1021 CVE-2024-53976: Under certain circumstances, navigating to a webpage would result in the address missing from the lo Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS < 133.

CVE-2026-109725 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109725 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109725 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-84120 [MEDIUM] CWE-416 CVE-2026-84120: Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ES Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVE-2026-92030 [MEDIUM] CWE-693 CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed i Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-109713 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109713 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109713 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-84122 [MEDIUM] CWE-416 CVE-2026-84122: Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ES Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVE-2026-74974 [MEDIUM] CWE-346 CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firef Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-74963 [MEDIUM] CWE-346 CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Fire Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2024-5687 [MEDIUM] CWE-284 CVE-2024-5687: If a specific sequence of actions is performed when opening a new tab, the triggering principal asso If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the `Referer` and `Sec-*` headers, meaning there is the potential for incorrect security checks within the browser in addition to incor

CVE-2026-6774 [MEDIUM] CWE-693 CVE-2026-6774: Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Th Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-0883 [MEDIUM] CWE-200 CVE-2026-0883: Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Fir Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

CVE-2026-0888 [MEDIUM] CWE-200 CVE-2026-0888: Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunder Information disclosure in the XML component. This vulnerability was fixed in Firefox 147 and Thunderbird 147.

CVE-2024-9395 [MEDIUM] CVE-2024-9395: A specially crafted filename containing a large number of spaces could obscure the file's extension A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131.

CVE-2026-8391 [MEDIUM] CWE-20 CVE-2026-8391: Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Fir Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.