Mozilla Firefox vulnerabilities

CVE-2026-4693 [HIGH] CWE-754 CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed i Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2024-3852 [HIGH] CWE-386 CVE-2024-3852: GetBoundName could return the wrong version of an object when JIT optimizations were applied. This v GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2026-74977 [HIGH] CWE-190 CVE-2026-74977: Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74982 [HIGH] CWE-400 CVE-2026-74982: Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-4709 [HIGH] CWE-754 CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Fir Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-4706 [HIGH] CWE-754 CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in F Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2006-0748 [CRITICAL] CWE-399 CVE-2006-0748: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7. Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1 allows remote attackers to execute arbitrary code via "an invalid and non-sensical ordering of table-related tags" that results in a negative array index.

CVE-2026-74958 [HIGH] CWE-1021 CVE-2026-74958: Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-84130 [HIGH] CWE-200 CVE-2026-84130: Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15 Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVE-2026-16374 [HIGH] CWE-200 CVE-2026-16374: Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firef Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16391 [HIGH] CWE-200 CVE-2026-16391: Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVE-2026-16384 [HIGH] CWE-908 CVE-2026-16384: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16400 [HIGH] CWE-200 CVE-2026-16400: Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 a Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16386 [HIGH] CWE-908 CVE-2026-16386: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16385 [HIGH] CWE-908 CVE-2026-16385: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2013-5616 [CRITICAL] CWE-416 CVE-2013-5616: Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla F Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listen

CVE-2026-4712 [HIGH] CWE-200 CVE-2026-4712: Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-6754 [HIGH] CWE-416 CVE-2026-6754: Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Fire Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2025-14327 [HIGH] CWE-290 CVE-2025-14327: Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunde Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

CVE-2026-12305 [HIGH] CWE-119 CVE-2026-12305: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.