Mozilla Firefox vulnerabilities

CVE-2024-10459 [HIGH] CWE-416 CVE-2024-10459: An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentia An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.

CVE-2026-4726 [HIGH] CWE-400 CVE-2026-4726: Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.

CVE-2023-4058 [CRITICAL] CWE-787 CVE-2023-4058: Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption a Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116.

CVE-2023-32216 [CRITICAL] CWE-787 CVE-2023-32216: Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozil Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affe

CVE-2023-34417 [CRITICAL] CWE-787 CVE-2023-34417: Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption a Memory safety bugs present in Firefox 113. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 114.

CVE-2026-16409 [HIGH] CWE-824 CVE-2026-16409: Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thun Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2016-1953 [HIGH] CWE-119 CVE-2016-1953: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remo Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.

CVE-2025-1012 [HIGH] CWE-416 CVE-2025-1012: A race during concurrent delazification could have led to a use-after-free. This vulnerability was f A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

CVE-2026-4719 [HIGH] CWE-754 CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firef Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-4713 [HIGH] CWE-754 CVE-2026-4713: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149 Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-4714 [HIGH] CWE-754 CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2026-4708 [HIGH] CWE-754 CVE-2026-4708: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149 Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVE-2016-5264 [HIGH] CWE-416 CVE-2016-5264: Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

CVE-2026-74966 [HIGH] CWE-359 CVE-2026-74966: Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-6747 [HIGH] CWE-416 CVE-2026-6747: Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140 Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVE-2026-8960 [HIGH] CWE-290 CVE-2026-8960: Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151. Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2024-3853 [HIGH] CWE-416 CVE-2024-3853: A use-after-free could result if a JavaScript realm was in the process of being initialized when a g A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerability affects Firefox < 125.

CVE-2026-2794 [HIGH] CWE-908 CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vu Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 148.

CVE-2026-6756 [HIGH] CWE-200 CVE-2026-6756: Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150. Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.

CVE-2026-6782 [HIGH] CWE-200 CVE-2026-6782: Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 a Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.