Mozilla
Vulnerability activity for Mozilla: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 37
- Critical (CVSS 9+)
- 6
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 45
- Critical (CVSS 9+)
- 10
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 50
- Critical (CVSS 9+)
- 11
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.8CriticalOct 27, 2010Mozilla Multiple Products Memory corruptionCVE-2010-3765Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.Added to KEV Oct 6, 2025 · 5,457 days after publicationExploited83% likelyExploit codeExploit-DB · Metasploit
- 9.8CriticalOct 9, 2024Mozilla Firefox Memory corruptionCVE-2024-9680Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.Added to KEV Oct 15, 2024 · 5 days after publicationExploited23% likely
- 7.5HighJun 11, 2018Mozilla Firefox, Firefox ESR, and Thunderbird Memory corruptionCVE-2016-9079Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.Added to KEV Jun 22, 2023 · 1,836 days after publicationExploited87% likelyExploit codeExploit-DB · Metasploit
- 8.8HighAug 8, 2015Mozilla Firefox Information disclosureCVE-2015-4495Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.Added to KEV May 25, 2022 · 2,482 days after publicationExploited69% likelyExploit codeExploit-DB · MetasploitDetection
- 10.0CriticalJul 23, 2019Mozilla Firefox and ThunderbirdCVE-2019-11708Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.Added to KEV May 23, 2022 · 1,034 days after publicationExploited56% likelyExploit codeExploit-DB
- 8.8HighJul 23, 2019Mozilla Firefox and Thunderbird Memory corruptionCVE-2019-11707Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.Added to KEV May 23, 2022 · 1,034 days after publicationExploited38% likelyExploit codeExploit-DB
- 8.8HighJun 26, 2013Mozilla Firefox and Thunderbird Memory corruptionCVE-2013-1690Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.Added to KEV Mar 28, 2022 · 3,197 days after publicationExploited69% likelyExploit codeExploit-DB · Metasploit
- 8.8HighDec 22, 2022Mozilla Firefox Memory corruptionCVE-2022-26485Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.Added to KEV Mar 7, 2022 · same day as publicationExploited14% likelyExploit code
- 9.6CriticalDec 22, 2022Mozilla Firefox Memory corruptionCVE-2022-26486Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.Added to KEV Mar 7, 2022 · same day as publicationExploited2.4% likely
- 6.5MediumMay 16, 2013Mozilla Firefox Memory corruptionCVE-2013-1675Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.Added to KEV Mar 3, 2022 · 3,213 days after publicationExploited6.7% likely
- 8.8HighMar 2, 2020Mozilla Firefox and Thunderbird Memory corruptionCVE-2019-17026Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.Added to KEV Nov 3, 2021 · 611 days after publicationExploited46% likelyExploit codeExploit-DB
- 8.1HighApr 24, 2020Mozilla Firefox and Thunderbird Memory corruptionCVE-2020-6820Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.Added to KEV Nov 3, 2021 · 557 days after publicationExploited7.1% likely
- 8.1HighApr 24, 2020Mozilla Firefox and Thunderbird Memory corruptionCVE-2020-6819Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.Added to KEV Nov 3, 2021 · 557 days after publicationExploited3% likely
Recent
- –UnscoredOct 28, 2026MozillaADV-cccs-3bc585fc1a3cSerial number: AV26-1100 Date: October 28, 2026 As of October 27, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox Prior to 159 Firefox ESR Prior to 115.44 Prior to 153.6 Thunderbird Prior to 159 Prior to 153.6 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Mozilla Foundation Security Advisory 2026-118 Mozilla Foundation Security Advisory 2026-119 Mozilla Foundation Sec
- 8.8HighOct 27, 2026Mozilla Firefox Privilege escalationCVE-2026-118008Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117881Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117880Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117879Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117878Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117877Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117876Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117875Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117874Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117873Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117872Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117871Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117870Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117869Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117868Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117867Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117866Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Memory corruptionCVE-2026-117865Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117864Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Information disclosureCVE-2026-117863Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla Firefox Privilege escalationCVE-2026-117862Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117861Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- –UnscoredOct 27, 2026Mozilla FirefoxCVE-2026-117860Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- 5.4MediumOct 26, 2026Mozilla Firefox for iOSCVE-2026-116632A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to display a phishing message inside system UI. This vulnerability was fixed in Firefox for iOS 156.1.
- 5.4MediumOct 26, 2026Mozilla Firefox for iOSCVE-2026-116631A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call prompt to appear as if that site had requested the call. This vulnerability was fixed in Firefox for iOS 156.1.
- 5.4MediumOct 20, 2026Mozilla Thunderbird Memory corruptionCVE-2026-113869When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a potentially exploitable crash. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.6.
- –UnscoredOct 16, 2026MozillaADV-cccs-0b0fe64a4506Serial number: AV26-1057 Date: October 16, 2026 As of October 13, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox ESR Prior to 153.5 Prior to 115.43 Firefox Prior to 158 Thunderbird Prior to 153.5 Prior to 158 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Vulnerabilities fixed in Firefox 158 - Mozilla Mozilla Foundation Security Advisory 2026-107 Security Vul
- 8.4HighOct 13, 2026Mozilla Thunderbird Memory corruptionCVE-2026-110247Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.
- 8.3HighOct 13, 2026Mozilla FirefoxCVE-2026-109783Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
- 8.3HighOct 13, 2026Mozilla FirefoxCVE-2026-109782Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.
- 9.8CriticalOct 13, 2026Mozilla FirefoxCVE-2026-109780Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- 9.8CriticalOct 13, 2026Mozilla FirefoxCVE-2026-109774Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- 9.1CriticalOct 13, 2026Mozilla Firefox Auth bypass / access controlCVE-2026-109772Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.
- 9.6CriticalOct 13, 2026Mozilla Firefox Memory corruptionCVE-2026-109708Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 9.6CriticalOct 13, 2026Mozilla Firefox Memory corruptionCVE-2026-109707Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 9.6CriticalOct 13, 2026Mozilla Firefox Memory corruptionCVE-2026-109705Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, Thunderbird 153.5, and Firefox ESR 115.44.
- 8.8HighSep 29, 2026Mozilla firefox Privilege escalationCVE-2026-100801Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17.
- 9.8CriticalAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74990Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- 9.8CriticalAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74989Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.
- 9.8CriticalAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74988Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- 9.8CriticalAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74987Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- 8.8HighAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74969Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- 8.8HighAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74949Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- 8.8HighAug 18, 2026Mozilla firefox Memory corruptionCVE-2026-74946Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- 4.3MediumJun 2, 2026Mozilla Firefox Memory corruptionCVE-2026-10702JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.
- 7.3HighApr 28, 2026Mozilla firefox Memory corruptionCVE-2026-7324Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1.
- 7.3HighApr 28, 2026Mozilla firefox Memory corruptionCVE-2026-7322Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
- 9.6CriticalApr 28, 2026Mozilla firefox Memory corruptionCVE-2026-7321Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
- 7.5HighApr 28, 2026Mozilla firefox Memory corruptionCVE-2026-7320Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
Top products
- Firefox44 CVEs in the last year, 11 critical
- Thunderbird2 CVEs in the last year
- Firefox for iOS2 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 28, 2026Mozilla security advisory (AV26-1100)ADV-cccs-3bc585fc1a3c
- CCCS (Canada) · Oct 16, 2026Mozilla security advisory (AV26-1057)ADV-cccs-0b0fe64a4506
- Atlassian · Mar 18, 2025Atlassian Security Bulletin March 18, 2025CVE-2024-4367
- Atlassian · Oct 15, 2024Atlassian Security Bulletin October 15, 2024CVE-2024-4367
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.