Mozilla Firefox Esr vulnerabilities

CVE-2024-5696 [HIGH] CWE-787 CVE-2024-5696: By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory lea By manipulating the text in an ` ` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVE-2026-16365 [HIGH] Mozilla Foundation Security Advisory 2026-84: CVE-2026-16365 Mozilla Foundation Security Advisory 2026-84 CVE: CVE-2026-16365 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.15

CVE-2026-92053 [HIGH] Mozilla Foundation Security Advisory 2026-93: CVE-2026-92053 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92053 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-100832 [HIGH] Mozilla Foundation Security Advisory 2026-99: CVE-2026-100832 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100832 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-92014 [HIGH] Mozilla Foundation Security Advisory 2026-91: CVE-2026-92014 Mozilla Foundation Security Advisory 2026-91 CVE: CVE-2026-92014 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.41

CVE-2026-100820 [HIGH] Mozilla Foundation Security Advisory 2026-99: CVE-2026-100820 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100820 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-100831 [HIGH] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100831 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100831 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100801 [HIGH] Mozilla Foundation Security Advisory 2026-99: CVE-2026-100801 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100801 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-100807 [HIGH] Mozilla Foundation Security Advisory 2026-99: CVE-2026-100807 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100807 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-6769 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6769 Mozilla Foundation Security Advisory 2026-32 CVE: CVE-2026-6769 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10

CVE-2026-6761 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6761 Mozilla Foundation Security Advisory 2026-32 CVE: CVE-2026-6761 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10

CVE-2026-92047 [HIGH] Mozilla Foundation Security Advisory 2026-93: CVE-2026-92047 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92047 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2014-1555 [CRITICAL] CVE-2014-1555: Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.

CVE-2017-5428 [CRITICAL] CWE-190 CVE-2017-5428: An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for t An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Fir

CVE-2018-12369 [CRITICAL] CWE-863 CVE-2018-12369: WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions. This vulnerability affects Firefox ESR < 60.1 and Firefox < 61.

CVE-2023-5176 [CRITICAL] CWE-787 CVE-2023-5176: Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these b Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.

CVE-2022-31736 [CRITICAL] CWE-942 CVE-2022-31736: A malicious website could have learned the size of a cross-origin resource that supported Range requ A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

CVE-2018-5104 [CRITICAL] CWE-416 CVE-2018-5104: A use-after-free vulnerability can occur during font face manipulation when a font face is freed whi A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

CVE-2023-29531 [CRITICAL] CWE-787 CVE-2023-29531: An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory cor An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

CVE-2022-31737 [CRITICAL] CWE-787 CVE-2022-31737: A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.