Firefox vulnerabilities

230 known CVE vulnerabilities in Firefox, translated and rated.

CVE-2026-74972Medium
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74971Medium
Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74970Medium
Vulnerability in the Graphics component causes a site isolation issue. It was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74969High
Use-after-free in the Layout: Text and Fonts component. Fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74968Medium
Vulnerability in the Graphics: WebRender component causes a site isolation issue. It was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74967Medium
Vulnerability in the Audio/Video: Playback component allows bypassing the same-origin policy. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74966High
Information disclosure in the Form Autofill component. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74963Medium
Vulnerability in the Networking: Cookies component allows bypassing the same-origin policy. It was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74962High
Site isolation issue in the Networking: Cookies component. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74954High
Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74953High
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74952High
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
CVE-2026-74951Medium
Clickjacking vulnerability in Firefox for Android. This flaw was fixed in Firefox 154.
CVE-2026-74950High
Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74949High
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74947High
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74946High
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74942High
Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74941High
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74939High
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74937High
Use-after-free vulnerability in the JavaScript: GC component. It was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74935High
Privilege escalation vulnerability in the DOM: Networking component. It was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74934High
Site isolation issue in the Graphics: CanvasWebGL component of Firefox and Thunderbird. Fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-16409High
Invalid pointer vulnerability in the Security: PSM component of Firefox and Thunderbird. Fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16405High
Information disclosure vulnerability in the Networking: WebSockets component in Firefox and Thunderbird. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16404High
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
CVE-2026-16403Medium
Spoofing vulnerability in the Address Bar component. This issue was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16401High
Privilege escalation vulnerability in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16400High
Information disclosure vulnerability in the DOM: Security component in Firefox and Thunderbird. Fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16399High
Site isolation issue in the DOM: Navigation component in Firefox and Thunderbird. Fixed in version 153.
CVE-2026-16398High
Site isolation issue in the Graphics component in Firefox and Thunderbird. Fixed in version 153.
CVE-2026-16396High
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16391High
Information disclosure vulnerability in the Storage: IndexedDB component. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16386High
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16385High
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16384High
Information disclosure vulnerability due to uninitialized memory in the Graphics: WebGPU component. This flaw was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16379High
Vulnerability in Firefox and Thunderbird (DOM: Content Processes component) allows privilege escalation. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16378High
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16376High
Denial-of-service vulnerability in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16374High
Information disclosure vulnerability in the Framework component in DevTools. This flaw was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16372High
Vulnerability in the DOM: Content Processes component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
CVE-2026-16371High
Vulnerability in Firefox and Thunderbird (DOM: Navigation component) allows privilege escalation. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16366High
Vulnerability in the DOM: Navigation component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
CVE-2026-16365High
Vulnerability in the DOM: Workers component in Firefox and Thunderbird allows privilege escalation. Fixed in version 153.
CVE-2026-16362High
Use-after-free vulnerability in the WebRTC: Audio/Video component of Firefox and Thunderbird. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16354High
Information disclosure vulnerability in the Graphics: ImageLib component. This flaw was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-15719Medium
A vulnerability in Firefox and Thunderbird with public exploit code but no known active attacks. Fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
CVE-2026-15718Medium
This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. Exploit code is publicly available, but no attacks in the wild are known.
CVE-2026-12328High
Memory safety bugs were found in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code.
CVE-2026-12299Medium
A JIT miscompilation vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.