Mozilla Firefox Esr vulnerabilities

CVE-2026-117939 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117939 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117939 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117866 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117866 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117866 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117892 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117892 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117892 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117974 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117974 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117974 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117870 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117870 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117870 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44

CVE-2026-109770 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109770 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109770 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-117890 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117890 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117890 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117970 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117970 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117970 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117961 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117961 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117961 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117959 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117959 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117959 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117864 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117864 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117864 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117947 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117947 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117947 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117976 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117976 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117976 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117898 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117898 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117898 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117984 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117984 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117984 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117991 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117991 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117991 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2016-9895 [MEDIUM] CWE-254 CVE-2016-9895: Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) th Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVE-2017-5466 [MEDIUM] CWE-79 CVE-2017-5466: If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:tex If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

CVE-2019-11744 [MEDIUM] CWE-79 CVE-2019-11744: Some HTML elements, such as &lt;title&gt; and &lt;textarea&gt;, can contain literal angle brackets w Some HTML elements, such as and , can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as

CVE-2020-26956 [MEDIUM] CWE-79 CVE-2020-26956: In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.