Mozilla Firefox Esr vulnerabilities

CVE-2026-117888 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117888 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117888 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117964 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117964 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117964 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117861 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117861 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117861 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117953 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117953 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117953 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-74974 Mozilla Foundation Security Advisory 2026-75: CVE-2026-74974 Mozilla Foundation Security Advisory 2026-75 CVE: CVE-2026-74974 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.39

CVE-2026-109763 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109763 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109763 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-74963 Mozilla Foundation Security Advisory 2026-77: CVE-2026-74963 Mozilla Foundation Security Advisory 2026-77 CVE: CVE-2026-74963 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.1

CVE-2019-11763 [MEDIUM] CWE-79 CVE-2019-11763: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of e

CVE-2015-2729 [MEDIUM] CWE-119 CVE-2015-2729: The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Fire The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecifi

CVE-2023-4046 [MEDIUM] CWE-770 CVE-2023-4046: In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVE-2018-12383 [MEDIUM] CWE-522 CVE-2018-12383: If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted cop If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the expos

CVE-2017-5409 [MEDIUM] CWE-269 CVE-2017-5409: The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerabil

CVE-2017-7768 [MEDIUM] CWE-200 CVE-2017-7768: The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbit The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. N

CVE-2023-25730 [MEDIUM] CWE-1021 CVE-2023-25730: A background script invoking <code>requestFullscreen</code> and then blocking the main thread could A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

CVE-2017-7767 [MEDIUM] CWE-269 CVE-2017-7767: The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects F

CVE-2022-36318 [MEDIUM] CWE-362 CVE-2022-36318: When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12.

CVE-2021-38509 [MEDIUM] CWE-1021 CVE-2021-38509: Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVE-2026-100822 Mozilla Foundation Security Advisory 2026-100: CVE-2026-100822 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100822 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-117903 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117903 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117903 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117912 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117912 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117912 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44