Mozilla Firefox Esr vulnerabilities

CVE-2026-84144 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84144 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84144 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-92044 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92044 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92044 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2026-100771 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100771 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100771 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100756 Mozilla Foundation Security Advisory 2026-98: CVE-2026-100756 Mozilla Foundation Security Advisory 2026-98 CVE: CVE-2026-100756 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 115.42

CVE-2026-6753 Mozilla Foundation Security Advisory 2026-32: CVE-2026-6753 Mozilla Foundation Security Advisory 2026-32 CVE: CVE-2026-6753 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.10

CVE-2026-74960 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74960 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74960 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-109759 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109759 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109759 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-100803 Mozilla Foundation Security Advisory 2026-99: CVE-2026-100803 Mozilla Foundation Security Advisory 2026-99 CVE: CVE-2026-100803 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 140.17

CVE-2026-100816 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100816 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100816 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100830 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100830 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100830 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2014-1538 [CRITICAL] CVE-2014-1538: Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

CVE-2018-12364 [HIGH] CWE-352 CVE-2018-12364: NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by mak NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR

CVE-2018-12371 [HIGH] CWE-190 CVE-2018-12371: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on so An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.

CVE-2020-6796 [HIGH] CWE-787 CVE-2020-6796: A content process could have modified shared memory relating to crash reporting information, crash i A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.

CVE-2019-9811 [HIGH] CWE-74 CVE-2019-9811: As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malic As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVE-2015-2728 [HIGH] CVE-2015-2728: The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, r

CVE-2023-4052 [MEDIUM] CWE-59 CVE-2023-4052: The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that directory would be recursively deleted with the permissions of the uninstalling user account. This could be combined with creation of a junction (a form of symbolic link) to allow arbitrary file deletion controlled by the non-privilege

CVE-2017-7805 [HIGH] CWE-416 CVE-2017-7805: During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-fr

CVE-2015-0801 [HIGH] CWE-264 CVE-2015-0801: Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

CVE-2016-9904 [HIGH] CWE-200 CVE-2016-9904: An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by ano An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.