Mozilla Firefox Esr vulnerabilities

CVE-2026-16350 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16350 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-16350 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2026-16352 Mozilla Foundation Security Advisory 2026-69: CVE-2026-16352 Mozilla Foundation Security Advisory 2026-69 CVE: CVE-2026-16352 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.38

CVE-2026-16351 Mozilla Foundation Security Advisory 2026-69: CVE-2026-16351 Mozilla Foundation Security Advisory 2026-69 CVE: CVE-2026-16351 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.38

CVE-2026-16356 Mozilla Foundation Security Advisory 2026-70: CVE-2026-16356 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-16356 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2026-8953 [CRITICAL] Mozilla Foundation Security Advisory 2026-47: CVE-2026-8953 Mozilla Foundation Security Advisory 2026-47 CVE: CVE-2026-8953 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.36

CVE-2026-74985 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74985 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74985 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2026-109743 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109743 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109743 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-109707 [CRITICAL] Mozilla Foundation Security Advisory 2026-108: CVE-2026-109707 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109707 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2022-22744 [HIGH] CWE-116 CVE-2022-22744: The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped fo The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.*This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunder

CVE-2017-5461 [CRITICAL] CWE-787 CVE-2017-5461: Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x b Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.

CVE-2024-11697 [HIGH] CWE-94 CVE-2024-11697: When handling keypress events, an attacker may have been able to trick a user into bypassing the "Op When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

CVE-2026-12328 [HIGH] Mozilla Foundation Security Advisory 2026-59: CVE-2026-12328 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12328 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2018-12387 [CRITICAL] CWE-20 CVE-2018-12387: A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple argumen A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2

CVE-2023-5174 [CRITICAL] CWE-416 CVE-2023-5174: If Windows failed to duplicate a handle during process creation, the sandbox code may have inadverte If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. *This bug only affects Firefox on Windows when run in non-standard configurations (such as using `runas`). Other operating systems are unaffected.* This vul

CVE-2023-5168 [CRITICAL] CWE-787 CVE-2023-5168: A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbir

CVE-2024-11698 [CRITICAL] CVE-2024-11698: A flaw in handling fullscreen transitions may have inadvertently caused the application to become st A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing "Esc" or accessing right-click menus, resulting in a disrupted browsing experience until t

CVE-2018-18500 [CRITICAL] CWE-416 CVE-2018-18500: A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML e A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

CVE-2026-8975 [CRITICAL] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8975 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8975 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-8974 [CRITICAL] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8974 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8974 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11

CVE-2026-8401 [CRITICAL] Mozilla Foundation Security Advisory 2026-48: CVE-2026-8401 Mozilla Foundation Security Advisory 2026-48 CVE: CVE-2026-8401 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.11