Mozilla Firefox Esr vulnerabilities

CVE-2017-7818 [CRITICAL] CWE-416 CVE-2017-7818: A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applic A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

CVE-2017-5460 [CRITICAL] CWE-416 CVE-2017-5460: A use-after-free vulnerability in frame selection triggered by a combination of malicious script con A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVE-2024-2612 [HIGH] CWE-416 CVE-2024-2612: If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have tri If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2024-3864 [HIGH] CWE-119 CVE-2024-3864: Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2026-6785 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6785 Mozilla Foundation Security Advisory 2026-32 CVE: CVE-2026-6785 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10

CVE-2026-6786 [HIGH] Mozilla Foundation Security Advisory 2026-32: CVE-2026-6786 Mozilla Foundation Security Advisory 2026-32 CVE: CVE-2026-6786 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10

CVE-2019-9819 [CRITICAL] CWE-843 CVE-2019-9819: A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVE-2019-9820 [CRITICAL] CWE-416 CVE-2019-9820: A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVE-2022-45406 [CRITICAL] CWE-416 CVE-2022-45406: If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

CVE-2023-4056 [CRITICAL] CWE-787 CVE-2023-4056: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and

CVE-2017-7845 [HIGH] CWE-119 CVE-2017-7845: A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graph A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Note: This attack only affects Windows operating systems. Other operating systems are unaf

CVE-2022-26384 [CRITICAL] CWE-693 CVE-2022-26384: If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVE-2018-5129 [HIGH] CWE-787 CVE-2018-5129: A lack of parameter validation on IPC messages results in a potential out-of-bounds write through ma A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

CVE-2026-74969 Mozilla Foundation Security Advisory 2026-75: CVE-2026-74969 Mozilla Foundation Security Advisory 2026-75 CVE: CVE-2026-74969 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.39

CVE-2026-74949 Mozilla Foundation Security Advisory 2026-76: CVE-2026-74949 Mozilla Foundation Security Advisory 2026-76 CVE: CVE-2026-74949 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.14

CVE-2026-74942 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74942 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74942 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-74950 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74950 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74950 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-12295 Mozilla Foundation Security Advisory 2026-59: CVE-2026-12295 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12295 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2026-12294 Mozilla Foundation Security Advisory 2026-59: CVE-2026-12294 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12294 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2026-109740 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109740 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109740 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5