Mozilla Firefox Esr vulnerabilities

CVE-2026-109705 [CRITICAL] Mozilla Foundation Security Advisory 2026-108: CVE-2026-109705 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109705 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-100818 [CRITICAL] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100818 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100818 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-92057 Mozilla Foundation Security Advisory 2026-93: CVE-2026-92057 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92057 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2014-1568 [HIGH] CWE-310 CVE-2014-1568: Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.1 Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X

CVE-2022-22756 [HIGH] CWE-94 CVE-2022-22756: If a user was convinced to drag and drop an image to their desktop or other folder, the resulting ob If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

CVE-2026-84123 [HIGH] Mozilla Foundation Security Advisory 2026-85: CVE-2026-84123 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84123 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-12289 [HIGH] Mozilla Foundation Security Advisory 2026-59: CVE-2026-12289 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12289 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2016-9900 [HIGH] CWE-254 CVE-2016-9900: External resources that should be blocked when loaded by SVG images can bypass security restrictions External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

CVE-2026-109709 [HIGH] Mozilla Foundation Security Advisory 2026-108: CVE-2026-109709 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109709 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2017-5390 [CRITICAL] CVE-2017-5390: The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for c The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

CVE-2026-100765 [HIGH] Mozilla Foundation Security Advisory 2026-100: CVE-2026-100765 Mozilla Foundation Security Advisory 2026-100 CVE: CVE-2026-100765 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.4

CVE-2026-100797 [HIGH] Mozilla Foundation Security Advisory 2026-98: CVE-2026-100797 Mozilla Foundation Security Advisory 2026-98 CVE: CVE-2026-100797 Product: Firefox ESR Impact: moderate Fixed in: Firefox ESR 115.42

CVE-2026-92073 [HIGH] Mozilla Foundation Security Advisory 2026-93: CVE-2026-92073 Mozilla Foundation Security Advisory 2026-93 CVE: CVE-2026-92073 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.3

CVE-2018-18492 [CRITICAL] CWE-416 CVE-2018-18492: A use-after-free vulnerability can occur after deleting a selection element due to a weak reference A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

CVE-2024-2607 [HIGH] CWE-123 CVE-2024-2607: Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *N Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

CVE-2016-9901 [CRITICAL] CWE-20 CVE-2016-9901: HTML tags received from the Pocket server will be processed without sanitization and any JavaScript HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.

CVE-2023-5730 [CRITICAL] CWE-787 CVE-2023-5730: Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these b Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVE-2017-7828 [CRITICAL] CWE-416 CVE-2017-7828: A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.

CVE-2024-9394 [HIGH] CWE-79 CVE-2024-9394: An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under th An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This

CVE-2024-9401 [CRITICAL] CWE-119 CVE-2024-9401: Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 12 Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thu