Mozilla Firefox vulnerabilities

CVE-2016-1962 [CRITICAL] CVE-2016-1962: Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefo Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.

CVE-2011-0085 [CRITICAL] CWE-399 CVE-2011-0085: Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18 Use-after-free vulnerability in the nsXULCommandDispatcher function in Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater.

CVE-2026-12297 [CRITICAL] CWE-119 CVE-2026-12297: Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12296 [CRITICAL] CWE-693 CVE-2026-12296: Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefo Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2013-5600 [CRITICAL] CVE-2013-5600: Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors involving a blob: URL.

CVE-2026-84121 [CRITICAL] CWE-416 CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVE-2013-5601 [CRITICAL] CVE-2013-5601: Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Fire Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through

CVE-2026-100800 [CRITICAL] CWE-416 CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2012-5839 [CRITICAL] CWE-787 CVE-2012-5839: Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.

CVE-2026-100828 [CRITICAL] CWE-693 CVE-2026-100828: Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2012-3973 [HIGH] CWE-264 CVE-2012-3973: The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging The debugger in the developer-tools subsystem in Mozilla Firefox before 15.0, when remote debugging is disabled, does not properly restrict access to the remote-debugging service, which allows remote attackers to execute arbitrary code by leveraging the presence of the HTTPMonitor extension and connecting to that service through the HTTPMonitor port.

CVE-2016-5280 [CRITICAL] CWE-416 CVE-2016-5280: Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap funct Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.

CVE-2026-92059 [CRITICAL] CWE-119 CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-4724 [CRITICAL] CWE-758 CVE-2026-4724: Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thu Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

CVE-2026-8948 [CRITICAL] CWE-942 CVE-2026-8948: Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-92050 [CRITICAL] CWE-362 CVE-2026-92050: Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Fir Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.

CVE-2013-1738 [CRITICAL] CWE-399 CVE-2013-1738: Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24. Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.

CVE-2025-54145 [CRITICAL] CWE-601 CVE-2025-54145: The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a mal The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141.

CVE-2025-1941 [CRITICAL] CVE-2025-1941: Under certain circumstances, a user opt-in setting that Focus should require authentication before u Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.

CVE-2024-2614 [HIGH] CWE-787 CVE-2024-2614: Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these b Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.