Mozilla Firefox Esr vulnerabilities

CVE-2026-6754 [HIGH] Mozilla Foundation Security Advisory 2026-31: CVE-2026-6754 Mozilla Foundation Security Advisory 2026-31 CVE: CVE-2026-6754 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.35

CVE-2026-12305 [HIGH] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12305 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12305 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2024-6603 [HIGH] CWE-823 CVE-2024-6603: In an out-of-memory scenario an allocation could fail but free would have been called on the pointer In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

CVE-2019-9812 [CRITICAL] CVE-2019-9812: Given a compromised sandboxed content process due to a separate vulnerability, it is possible to esc Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart withou

CVE-2026-8947 [HIGH] Mozilla Foundation Security Advisory 2026-47: CVE-2026-8947 Mozilla Foundation Security Advisory 2026-47 CVE: CVE-2026-8947 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.36

CVE-2014-1562 [CRITICAL] CWE-119 CVE-2014-1562: Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x bef Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2026-8090 [HIGH] Mozilla Foundation Security Advisory 2026-42: CVE-2026-8090 Mozilla Foundation Security Advisory 2026-42 CVE: CVE-2026-8090 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.35.2

CVE-2026-6752 [HIGH] Mozilla Foundation Security Advisory 2026-31: CVE-2026-6752 Mozilla Foundation Security Advisory 2026-31 CVE: CVE-2026-6752 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.35

CVE-2026-12292 Mozilla Foundation Security Advisory 2026-58: CVE-2026-12292 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12292 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2019-17024 [HIGH] CWE-787 CVE-2019-17024: Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of t Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVE-2026-7323 Mozilla Foundation Security Advisory 2026-36: CVE-2026-7323 Mozilla Foundation Security Advisory 2026-36 CVE: CVE-2026-7323 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10.1

CVE-2018-12389 [HIGH] CWE-119 CVE-2018-12389: Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. So Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.

CVE-2026-109766 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109766 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109766 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109760 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109760 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109760 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109737 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109737 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109737 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109744 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109744 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109744 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2020-12419 [HIGH] CWE-416 CVE-2020-12419: When processing callbacks that occurred during window flushing in the parent process, the associated When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVE-2026-7322 Mozilla Foundation Security Advisory 2026-37: CVE-2026-7322 Mozilla Foundation Security Advisory 2026-37 CVE: CVE-2026-7322 Product: Firefox ESR Impact: critical Fixed in: Firefox ESR 115.35.1

CVE-2018-5130 [HIGH] CWE-20 CVE-2018-5130: When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstance When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.

CVE-2026-92019 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92019 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92019 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3