firefox-esr

14 results · Clear filters · Feed

• High 8.1
  CVE-2026-109722 Public exploit

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.1
  CVE-2026-109715 Public exploit

  Incorrect boundary conditions in the JavaScript Engine component

  Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Oct 13, 2026
• High 8.8
  CVE-2026-74939 Public exploit

  Privilege escalation in the DOM: Navigation component

  Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  Aug 18, 2026
• High 7.3
  CVE-2025-14325 Public exploit

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2023-5217 Exploited Public exploit EPSS 49%

  Electron affected by libvpx's heap buffer overflow in vp8 encoding

  Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

  Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
  Sep 28, 2023

  KEV Oct 2, 2023
• High 8.8
  CVE-2023-4863 Exploited Public exploit EPSS 100%

  libwebp: OOB write in BuildHuffmanTable

  Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

  Google Chrome libwebp chromium Browsers Debian Ubuntu Azure Linux Alpine Wolfi npm PyPI Go crates.io NuGet
  Sep 12, 2023

  KEV Sep 13, 2023
• High 8.8
  CVE-2022-28281 Public exploit

  If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-1802 Public exploit EPSS 28%

  If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022
• High 8.8
  CVE-2022-26485 Exploited Public exploit EPSS 14%

  Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

  Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine
  Dec 22, 2022

  KEV Mar 7, 2022
• High 7.5
  CVE-2022-24713 Public exploit EPSS 14%

  Regular expression denial of service in Rust's regex crate

  regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…

  rust-lang regex thunderbird firefox Debian Ubuntu Azure Linux Alpine crates.io
  Mar 8, 2022
• High 8.8
  CVE-2019-17026 Exploited Public exploit EPSS 46%

  Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Mar 2, 2020

  KEV Nov 3, 2021
• High 8.8
  CVE-2019-11707 Exploited Public exploit EPSS 38%

  A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

  KEV May 23, 2022
• High 8.8
  CVE-2018-5158 Public exploit EPSS 10%

  Malicious PDF can inject JavaScript into PDF Viewer

  The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…

  Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu npm
  Jun 11, 2018
• High 7.5
  CVE-2016-9079 Exploited Public exploit EPSS 87%

  A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018

  KEV Jun 22, 2023