Mozilla Firefox Esr vulnerabilities

CVE-2026-12290 Mozilla Foundation Security Advisory 2026-58: CVE-2026-12290 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12290 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2026-74978 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74978 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74978 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-8962 Mozilla Foundation Security Advisory 2026-48: CVE-2026-8962 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8962 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-109753 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109753 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109753 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109736 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109736 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109736 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109754 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109754 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109754 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-7320 Mozilla Foundation Security Advisory 2026-37: CVE-2026-7320 Mozilla Foundation Security Advisory 2026-37 CVE: CVE-2026-7320 Product: Firefox ESR Impact: critical Fixed in: Firefox ESR 115.35.1

CVE-2016-9905 [HIGH] CWE-284 CVE-2016-9905: A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. T A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.

CVE-2026-109716 Mozilla Foundation Security Advisory 2026-107: CVE-2026-109716 Mozilla Foundation Security Advisory 2026-107 CVE: CVE-2026-109716 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 115.43

CVE-2026-109722 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109722 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109722 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109715 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109715 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109715 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-100759 Mozilla Foundation Security Advisory 2026-99: CVE-2026-100759 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100759 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-92072 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92072 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92072 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-100798 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100798 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100798 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2019-11760 [HIGH] CWE-787 CVE-2019-11760: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some instances. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

CVE-2017-5031 [HIGH] CWE-416 CVE-2017-5031: A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attack A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVE-2021-29946 [HIGH] CWE-190 CVE-2021-29946: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypas Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVE-2021-23954 [HIGH] CWE-843 CVE-2021-23954: Using the new logical assignment operators in a JavaScript switch statement could have caused a type Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

CVE-2019-11735 [HIGH] CWE-787 CVE-2019-11735: Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firef Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

CVE-2021-43535 [HIGH] CWE-416 CVE-2021-43535: A use-after-free could have occured when an HTTP2 session object was released on a different thread, A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3.