Mozilla Firefox Esr vulnerabilities

CVE-2026-84141 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84141 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84141 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-92024 Mozilla Foundation Security Advisory 2026-92: CVE-2026-92024 Mozilla Foundation Security Advisory 2026-92 CVE: CVE-2026-92024 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.16

CVE-2026-92027 Mozilla Foundation Security Advisory 2026-91: CVE-2026-92027 Mozilla Foundation Security Advisory 2026-91 CVE: CVE-2026-92027 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.41

CVE-2026-92025 Mozilla Foundation Security Advisory 2026-92: CVE-2026-92025 Mozilla Foundation Security Advisory 2026-92 CVE: CVE-2026-92025 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.16

CVE-2026-92023 Mozilla Foundation Security Advisory 2026-91: CVE-2026-92023 Mozilla Foundation Security Advisory 2026-91 CVE: CVE-2026-92023 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.41

CVE-2026-92029 Mozilla Foundation Security Advisory 2026-91: CVE-2026-92029 Mozilla Foundation Security Advisory 2026-91 CVE: CVE-2026-92029 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.41

CVE-2026-100760 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100760 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100760 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100787 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100787 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100787 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100808 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100808 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100808 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-92046 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92046 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92046 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-7321 Mozilla Foundation Security Advisory 2026-36: CVE-2026-7321 Mozilla Foundation Security Advisory 2026-36 CVE: CVE-2026-7321 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10.1

CVE-2020-26971 [HIGH] CWE-787 CVE-2020-26971: Certain blit values provided by the user were not properly constrained leading to a heap buffer over Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVE-2020-15678 [HIGH] CWE-416 CVE-2020-15678: When recursing through graphical layers while scrolling, an iterator may have become invalid, result When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

CVE-2021-23994 [HIGH] CWE-909 CVE-2021-23994: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of b A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVE-2020-26973 [HIGH] CVE-2020-26973: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. Thi Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVE-2020-35113 [HIGH] CWE-787 CVE-2020-35113: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of t Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVE-2020-26960 [HIGH] CWE-416 CVE-2020-26960: If the Compact() method was called on an nsTArray, the array could have been reallocated without upd If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

CVE-2020-26974 [HIGH] CWE-787 CVE-2020-26974: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrec When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVE-2020-6799 [HIGH] CWE-88 CVE-2020-6799: Command line arguments could have been injected during Firefox invocation as a shell handler for cer Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link

CVE-2021-23978 [HIGH] CWE-787 CVE-2021-23978: Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of t Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.