Mozilla Firefox vulnerabilities
3,702 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,702
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1095MEDIUM1343LOW68UNKNOWN215
Vulnerabilities
Page 28 of 186
CVE-2026-84117P3HIGHCVSS 8.8fixed in Firefox 155
CVE-2026-84117 [HIGH] Mozilla Foundation Security Advisory 2026-82: CVE-2026-84117
Mozilla Foundation Security Advisory 2026-82
CVE: CVE-2026-84117
Product: Firefox
Impact: high
Fixed in: Firefox 155
mozilla
CVE-2026-92033P3HIGHCVSS 8.8fixed in Firefox 156
CVE-2026-92033 [HIGH] Mozilla Foundation Security Advisory 2026-90: CVE-2026-92033
Mozilla Foundation Security Advisory 2026-90
CVE: CVE-2026-92033
Product: Firefox
Impact: low
Fixed in: Firefox 156
mozilla
CVE-2025-10537P3HIGHCVSS 8.8fixed in 140.3.0fixed in 143.02025-09-16
CVE-2025-10537 [HIGH] CWE-119 CVE-2025-10537: Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunde
nvd
CVE-2025-11714P3HIGHCVSS 8.8fixed in 115.29.0fixed in 144.0+1 more2025-10-14
CVE-2025-11714 [HIGH] CWE-119 CVE-2025-11714: Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox
Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefo
nvd
CVE-2026-8972P3HIGHCVSS 8.8fixed in 151.0.02026-05-19
CVE-2026-8972 [HIGH] CWE-269 CVE-2026-8972: Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 1
Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-92006P3HIGHCVSS 8.8fixed in 115.41.0≥ 116.0, < 140.16.0+2 more2026-09-15
CVE-2026-92006 [HIGH] CWE-120 CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2025-11715P3HIGHCVSS 8.8fixed in 140.4.0fixed in 144.02025-10-14
CVE-2025-11715 [HIGH] CWE-119 CVE-2025-11715: Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird
Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunde
nvd
CVE-2026-100779P3HIGHCVSS 8.8fixed in 157.0.0≥ 115.1.0, < 115.42.0+2 more2026-09-29
CVE-2026-100779 [HIGH] CWE-416 CVE-2026-100779: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100767P3HIGHCVSS 8.8≥ 115.0, < 115.42.0≥ 140.0, < 140.17.0+2 more2026-09-29
CVE-2026-100767 [HIGH] CWE-416 CVE-2026-100767: Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100784P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+2 more2026-09-29
CVE-2026-100784 [HIGH] CWE-416 CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-4722P3HIGHCVSS 8.8fixed in 149.02026-03-24
CVE-2026-4722 [HIGH] CVE-2026-4722: Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbi
Privilege escalation in the IPC component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
nvd
CVE-2026-100780P3HIGHCVSS 8.8fixed in 157.0.0≥ 115.1.0, < 115.42.0+2 more2026-09-29
CVE-2026-100780 [HIGH] CWE-416 CVE-2026-100780: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100774P3HIGHCVSS 8.8≥ 115.0, < 115.42.0≥ 140.0.0, < 140.17.0+2 more2026-09-29
CVE-2026-100774 [HIGH] CWE-416 CVE-2026-100774: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100790P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+2 more2026-09-29
CVE-2026-100790 [HIGH] CWE-416 CVE-2026-100790: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100785P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+2 more2026-09-29
CVE-2026-100785 [HIGH] CWE-416 CVE-2026-100785: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100789P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+2 more2026-09-29
CVE-2026-100789 [HIGH] CWE-416 CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100757P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0.0, < 140.17.0+2 more2026-09-29
CVE-2026-100757 [HIGH] CWE-416 CVE-2026-100757: Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100777P3HIGHCVSS 8.8≥ 115.0.1, < 115.42.0≥ 140.0.0, < 140.17.0+2 more2026-09-29
CVE-2026-100777 [HIGH] CWE-416 CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-92022P3HIGHCVSS 8.8fixed in 115.41.0≥ 116.0, < 140.16.0+2 more2026-09-15
CVE-2026-92022 [HIGH] CWE-416 CVE-2026-92022: Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firef
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92028P3HIGHCVSS 8.8fixed in 115.41.0≥ 116.0, < 140.16.0+2 more2026-09-15
CVE-2026-92028 [HIGH] CWE-416 CVE-2026-92028: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firef
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla