Mozilla Firefox vulnerabilities
3,702 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,702
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1095MEDIUM1343LOW68UNKNOWN215
Vulnerabilities
Page 27 of 186
CVE-2024-8382P3HIGHCVSS 8.8fixed in 130.0≥ unspecified, < 1302024-09-03
CVE-2024-8382 [HIGH] CWE-273 CVE-2024-8382: Internal browser event interfaces were exposed to web content when privileged EventHandler listener
Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools consol
nvdosv
CVE-2011-2984P3CRITICALCVSS 10.0≤ 3.6.19v1.0+105 more2011-08-18
CVE-2011-2984 [CRITICAL] CWE-94 CVE-2011-2984: Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other prod
Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events.
nvd
CVE-2016-5274P3CRITICALCVSS 9.8≤ 48.0.2v45.1.0+3 more2016-09-22
CVE-2016-5274 [CRITICAL] CWE-416 CVE-2016-5274: Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox be
Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
nvd
CVE-2026-74941P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0.0, < 153.1.02026-08-18
CVE-2026-74941 [HIGH] CWE-269 CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74939P3HIGHCVSS 8.8fixed in 115.39.0≥ 116.0, < 140.14.0+1 more2026-08-18
CVE-2026-74939 [HIGH] CWE-269 CVE-2026-74939: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74935P3HIGHCVSS 8.8fixed in 115.39.0≥ 116.0, < 140.14.0+1 more2026-08-18
CVE-2026-74935 [HIGH] CWE-269 CVE-2026-74935: Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16396P3HIGHCVSS 8.8fixed in 140.13.0fixed in 153.0.02026-07-21
CVE-2026-16396 [HIGH] CWE-269 CVE-2026-16396: Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2012-3990P3CRITICALCVSS 9.3fixed in 10.0.8fixed in 16.02012-10-10
CVE-2012-3990 [CRITICAL] CWE-416 CVE-2012-3990: Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0,
Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
nvd
CVE-2026-74937P3HIGHCVSS 8.8fixed in 153.1.0fixed in 154.0.02026-08-18
CVE-2026-74937 [HIGH] CWE-416 CVE-2026-74937: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16362P3HIGHCVSS 8.8fixed in 140.13.0fixed in 153.0.02026-07-21
CVE-2026-16362 [HIGH] CWE-416 CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Fi
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2015-4480P3CRITICALCVSS 9.3≤ 39.0.3v38.0+3 more2015-08-16
CVE-2015-4480 [CRITICAL] CWE-189 CVE-2015-4480: Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Fire
Integer overflow in the stagefright::SampleTable::isValid function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via crafted MPEG-4 video data with H.264 encoding.
nvdosv
CVE-2026-74955P3HIGHCVSS 8.8fixed in 153.1.0fixed in 154.0.02026-08-18
CVE-2026-74955 [HIGH] CWE-269 CVE-2026-74955: Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154,
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16372P3HIGHCVSS 8.8fixed in 153.0.02026-07-21
CVE-2026-16372 [HIGH] CWE-269 CVE-2026-16372: Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefo
Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2025-14328P3HIGHCVSS 8.8fixed in 140.6.0fixed in 146.02025-12-09
CVE-2025-14328 [HIGH] CVE-2025-14328: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firef
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
nvd
CVE-2025-14329P3HIGHCVSS 8.8fixed in 140.6.0fixed in 146.02025-12-09
CVE-2025-14329 [HIGH] CVE-2025-14329: Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firef
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
nvd
CVE-2026-100773P3HIGHCVSS 8.8≥ 115.0, < 115.42.0≥ 140.0.0, < 140.17.0+2 more2026-09-29
CVE-2026-100773 [HIGH] CWE-416 CVE-2026-100773: Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100791P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+2 more2026-09-29
CVE-2026-100791 [HIGH] CWE-416 CVE-2026-100791: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-8955P3HIGHCVSS 8.8fixed in 140.11.0fixed in 151.0.02026-05-19
CVE-2026-8955 [HIGH] CWE-269 CVE-2026-8955: Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Fir
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
nvdmozilla
CVE-2026-12291P3HIGHCVSS 8.8fixed in 115.37.0fixed in 152.0.0+1 more2026-06-16
CVE-2026-12291 [HIGH] CWE-416 CVE-2026-12291: Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firef
Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
nvdmozilla
CVE-2025-8040P3HIGHCVSS 8.8fixed in 140.1fixed in 141.02025-07-22
CVE-2025-8040 [HIGH] CWE-119 CVE-2025-8040: Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderb
nvd