Mozilla Firefox vulnerabilities

CVE-2026-109753 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109753 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109753 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109736 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109736 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109736 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109754 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109754 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109754 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2016-9905 [HIGH] CWE-284 CVE-2016-9905: A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. T A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.

CVE-2026-109722 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109722 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109722 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109716 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109716 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109716 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109715 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109715 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109715 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2011-2982 [CRITICAL] CVE-2011-2982: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunder Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2012-3983 [CRITICAL] CWE-119 CVE-2012-3983: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbi Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2016-2790 [HIGH] CWE-19 CVE-2016-2790: The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.

CVE-2016-2795 [HIGH] CWE-19 CVE-2016-2795: The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefo The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.

CVE-2009-3075 [CRITICAL] CVE-2009-3075: Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3 Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.2, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to use of mutable strings in the j

CVE-2009-3072 [CRITICAL] CVE-2009-3072: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the BinHex decoder in netwerk/stre

CVE-2018-5100 [HIGH] CWE-416 CVE-2018-5100: A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" func A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scripts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 58.

CVE-2018-12375 [HIGH] CWE-119 CVE-2018-12375: Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption an Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62.

CVE-2020-12426 [HIGH] CWE-787 CVE-2020-12426: Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 78.

CVE-2016-1949 [HIGH] CWE-264 CVE-2016-1949: Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and Mozilla Firefox before 44.0.2 does not properly restrict the interaction between Service Workers and plugins, which allows remote attackers to bypass the Same Origin Policy via a crafted web site that triggers spoofed responses to requests that use NPAPI, as demonstrated by a request for a crossdomain.xml file.

CVE-2011-2996 [CRITICAL] CVE-2011-2996: Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote att Unspecified vulnerability in the plugin API in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2012-4217 [CRITICAL] CWE-416 CVE-2012-4217: Use-after-free vulnerability in the nsViewManager::ProcessPendingUpdates function in Mozilla Firefox Use-after-free vulnerability in the nsViewManager::ProcessPendingUpdates function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVE-2012-4213 [CRITICAL] CWE-416 CVE-2012-4213: Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17 Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.