Firefox vulnerabilities

427 known CVE vulnerabilities in Firefox, translated and rated.

CVE-2026-100816High
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100815High
Use-after-free vulnerability in the CSS Parsing and Computation component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100814High
Incorrect boundary conditions in the JavaScript Engine: JIT component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100813High
Invalid pointer in the JavaScript Engine: JIT component. Fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100812Medium
A denial-of-service vulnerability was found in the Graphics component of Mozilla products. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100809High
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100808High
Vulnerability allows bypassing security mechanisms in the DOM: Service Workers component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100807High
Privilege escalation vulnerability in the DOM: Service Workers component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100806Medium
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100805High
Race condition and use-after-free vulnerability in the Audio/Video component. Fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100803High
Vulnerability allows bypassing the same-origin policy in the WebExtensions component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100802Medium
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100801High
Privilege escalation vulnerability in the DLL Services component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100799Medium
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100798High
Vulnerability related to improper use of cryptography in the Storage: Quota Manager component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100797High
Privilege escalation due to use-after-free in the Graphics: WebRender component. Fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100796High
Use-after-free vulnerability in the JavaScript: WebAssembly component. Fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100795Medium
Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100793Medium
Vulnerability related to JIT miscompilation in the JavaScript Engine component. It was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100792High
Vulnerability related to JIT miscompilation in the JavaScript: WebAssembly component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100791High
Use-after-free vulnerability in the DOM: Core & HTML component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100790High
Use-after-free vulnerability in the XSLT component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100789High
Use-after-free vulnerability in the Graphics: Canvas2D component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100785High
Use-after-free vulnerability in the DOM: Core & HTML component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100784High
Use-after-free vulnerability in the Layout: Text and Fonts component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100783Medium
Uninitialized memory in the Audio/Video component. This vulnerability was fixed in multiple Firefox and Thunderbird versions.
CVE-2026-100782High
Privilege escalation due to incorrect boundary conditions in the Graphics component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100780High
Use-after-free vulnerability in the DOM: Core & HTML component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100779High
Use-after-free vulnerability in the XSLT component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100777High
Use-after-free vulnerability in the Graphics: Canvas2D component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100776High
Use-after-free vulnerability in the JavaScript: WebAssembly component. It was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100774High
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100773High
Use-after-free vulnerability in the Storage: IndexedDB component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100772High
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100769High
Use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100768High
Use-after-free vulnerability in the Graphics: WebGPU component of Firefox and Thunderbird. It was fixed in Firefox 157 and Thunderbird 157.
CVE-2026-100767High
Use-after-free vulnerability in the Networking: Cache component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100766Medium
Information disclosure in the Networking: JAR component. This vulnerability was fixed in multiple Firefox and Thunderbird versions.
CVE-2026-100765High
Use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 153.4, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100764High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: WebGPU component of Firefox and Thunderbird. It was fixed in Firefox 157 and Thunderbird 157.
CVE-2026-100761High
Privilege escalation vulnerability due to use-after-free in the Graphics: WebGPU component of Firefox and Thunderbird. It was fixed in Firefox 157 and Thunderbird 157.
CVE-2026-100757High
Use-after-free vulnerability in the Widget component of Firefox and Thunderbird. It was fixed in Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.
CVE-2026-100756High
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-92078Medium
Denial-of-service vulnerability in the Security component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92077Medium
Denial-of-service vulnerability in the SVG component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92076High
Incorrect boundary conditions vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92073High
A privilege escalation vulnerability in the Enterprise Policies component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92072High
Incorrect boundary conditions vulnerability in the Safe Browsing component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92070Medium
Information disclosure vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92069Medium
Spoofing vulnerability in the DOM: Navigation component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS