Mozilla Firefox vulnerabilities
3,702 known vulnerabilities affecting mozilla/firefox.
Total CVEs
3,702
CISA KEV
15
actively exploited
Public exploits
126
Exploited in wild
34
Severity breakdown
CRITICAL981HIGH1095MEDIUM1343LOW68UNKNOWN215
Vulnerabilities
Page 35 of 186
CVE-2026-0882P3HIGHCVSS 8.8fixed in 115.32.0fixed in 147.0+1 more2026-01-13
CVE-2026-0882 [HIGH] CWE-416 CVE-2026-0882: Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32
Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
nvd
CVE-2026-74947P3HIGHCVSS 8.8fixed in 153.1.0fixed in 154.0.02026-08-18
CVE-2026-74947 [HIGH] CWE-763 CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74965P3HIGHCVSS 8.8fixed in 140.14.0fixed in 154.0.0+1 more2026-08-18
CVE-2026-74965 [HIGH] CWE-269 CVE-2026-74965: Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74953P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0.0, < 153.1.02026-08-18
CVE-2026-74953 [HIGH] CWE-269 CVE-2026-74953: Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 1
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16371P3HIGHCVSS 8.8fixed in 140.13.0fixed in 153.0.02026-07-21
CVE-2026-16371 [HIGH] CWE-269 CVE-2026-16371: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153,
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
nvdmozilla
CVE-2026-92040P3HIGHCVSS 8.8fixed in 156.0.02026-09-15
CVE-2026-92040 [HIGH] CWE-416 CVE-2026-92040: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
nvdmozilla
CVE-2026-74952P3HIGHCVSS 8.8fixed in 154.0.02026-08-18
CVE-2026-74952 [HIGH] CWE-269 CVE-2026-74952: Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
nvdmozilla
CVE-2026-8952P3HIGHCVSS 8.8fixed in 151.0.02026-05-19
CVE-2026-8952 [HIGH] CWE-269 CVE-2026-8952: Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-84131P3HIGHCVSS 8.8fixed in 115.40.0≥ 116.0, < 140.15.0+2 more2026-09-01
CVE-2026-84131 [HIGH] CWE-763 CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
nvdmozilla
CVE-2024-5696P3HIGHCVSS 8.6fixed in 115.12fixed in 127.0+1 more2024-06-11
CVE-2024-5696 [HIGH] CWE-787 CVE-2024-5696: By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory lea
By manipulating the text in an ` ` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
nvd
CVE-2026-100768P3HIGHCVSS 8.8fixed in 157.0.02026-09-29
CVE-2026-100768 [HIGH] CWE-416 CVE-2026-100768: Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 an
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
nvdmozilla
CVE-2026-100796P3HIGHCVSS 8.8fixed in 157.0.02026-09-29
CVE-2026-100796 [HIGH] CWE-416 CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
nvdmozilla
CVE-2026-24869P3HIGHCVSS 8.8fixed in 147.0.22026-01-27
CVE-2026-24869 [HIGH] CWE-416 CVE-2026-24869: Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Fire
Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.
nvd
CVE-2026-16365P3HIGHCVSS 8.8fixed in 153.0.02026-07-21
CVE-2026-16365 [HIGH] CWE-269 CVE-2026-16365: Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thu
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
nvdmozilla
CVE-2026-92053P3HIGHCVSS 8.8fixed in 153.3.0≥ 154.0.0, < 156.0.02026-09-15
CVE-2026-92053 [HIGH] CWE-269 CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla
CVE-2026-100832P3HIGHCVSS 8.8fixed in 115.42.0≥ 116.0, < 140.17.0+1 more2026-09-29
CVE-2026-100832 [HIGH] CWE-416 CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, Firefox ESR 115.42, and Firefox ESR 140.17.
nvd
CVE-2026-92014P3HIGHCVSS 8.8fixed in 115.41.0≥ 116.0, < 140.16.02026-09-15
CVE-2026-92014 [HIGH] CWE-120 CVE-2026-92014: Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerabil
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.
nvd
CVE-2026-100820P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100820 [HIGH] CWE-269 CVE-2026-100820: Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4
Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100831P3HIGHCVSS 8.8fixed in 153.4.0≥ 154.0.0, < 157.0.02026-09-29
CVE-2026-100831 [HIGH] CWE-416 CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Fir
Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
nvdmozilla
CVE-2026-100807P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100807 [HIGH] CWE-269 CVE-2026-100807: Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
nvdmozilla