Mozilla Firefox vulnerabilities
3,702 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,702
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1095MEDIUM1343LOW68UNKNOWN215
Vulnerabilities
Page 141 of 186
CVE-2026-117866P4UNKNOWNfixed in Firefox 159
CVE-2026-117866 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117866
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117866
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-109770P4UNKNOWNfixed in Firefox 158
CVE-2026-109770 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109770
Mozilla Foundation Security Advisory 2026-106
CVE: CVE-2026-109770
Product: Firefox
Impact: low
Fixed in: Firefox 158
mozilla
CVE-2026-117864P4UNKNOWNfixed in Firefox 159
CVE-2026-117864 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117864
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117864
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117991P4UNKNOWNfixed in Firefox 159
CVE-2026-117991 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117991
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117991
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117970P4UNKNOWNfixed in Firefox 159
CVE-2026-117970 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117970
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117970
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117959P4UNKNOWNfixed in Firefox 159
CVE-2026-117959 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117959
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117959
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117984P4UNKNOWNfixed in Firefox 159
CVE-2026-117984 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117984
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117984
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117898P4UNKNOWNfixed in Firefox 159
CVE-2026-117898 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117898
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117898
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117961P4UNKNOWNfixed in Firefox 159
CVE-2026-117961 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117961
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117961
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117890P4UNKNOWNfixed in Firefox 159
CVE-2026-117890 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117890
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117890
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117976P4UNKNOWNfixed in Firefox 159
CVE-2026-117976 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117976
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117976
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-117947P4UNKNOWNfixed in Firefox 159
CVE-2026-117947 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117947
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-117947
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118007P4UNKNOWNfixed in Firefox 159
CVE-2026-118007 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118007
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118007
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2026-118022P4UNKNOWNfixed in Firefox 159
CVE-2026-118022 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118022
Mozilla Foundation Security Advisory 2026-118
CVE: CVE-2026-118022
Product: Firefox
Impact: low
Fixed in: Firefox 159
mozilla
CVE-2011-0059P4MEDIUMCVSS 6.8v3.6v3.6.2+96 more2011-03-02
CVE-2011-0059 [MEDIUM] CWE-352 CVE-2011-0059: Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.
Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.
nvd
CVE-2009-2065P4MEDIUMCVSS 6.8≤ 3.0.9v0.1+77 more2009-06-15
CVE-2009-2065 [MEDIUM] CWE-287 CVE-2009-2065: Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only wh
Mozilla Firefox 3.0.10, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP
nvd
CVE-2007-0779P4MEDIUMCVSS 6.4v0.8v0.9.1+28 more2007-02-26
CVE-2007-0779 [MEDIUM] CVE-2007-0779: GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMo
GUI overlay vulnerability in Mozilla Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 allows remote attackers to spoof certain user interface elements, such as the host name or security indicators, via the CSS3 hotspot property with a large, transparent, custom cursor.
nvd
CVE-2018-18510P4MEDIUMCVSS 6.5fixed in 64.0≥ unspecified, < 642019-04-26
CVE-2018-18510 [MEDIUM] CVE-2018-18510: The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are
The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. This vulnerability affects Firefox < 64.
nvdosv
CVE-2016-9895P4MEDIUMCVSS 6.1fixed in 50.1fixed in 45.6.0+1 more2018-06-11
CVE-2016-9895 [MEDIUM] CWE-254 CVE-2016-9895: Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) th
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
nvd
CVE-2016-1975P4MEDIUMCVSS 6.3≤ 44.0.22016-03-13
CVE-2016-1975 [MEDIUM] CWE-362 CVE-2016-1975: Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation i
Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
nvd