Firefox at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 99 | 7 |
| Oct 2026 | 251 | 29 |
| Sep 2026 | 181 | 52 |
| Aug 2026 | 59 | 17 |
| Jul 2026 | 66 | 39 |
| Jun 2026 | 45 | 8 |
| May 2026 | 41 | 8 |
| Apr 2026 | 51 | 6 |
| Mar 2026 | 48 | 22 |
| Feb 2026 | 52 | 28 |
| Jan 2026 | 18 | 4 |
| Dec 2025 | 15 | 5 |
| Nov 2025 | 16 | 5 |
| Oct 2025 | 15 | 7 |
| Sep 2025 | 13 | 0 |
| Aug 2025 | 12 | 3 |
| Jul 2025 | 16 | 6 |
| Jun 2025 | 15 | 5 |
| May 2025 | 12 | 1 |
| Apr 2025 | 22 | 1 |
| Mar 2025 | 15 | 3 |
| Feb 2025 | 12 | 7 |
| Jan 2025 | 11 | 1 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Latest advisories
-
High max 9.8
Mozilla Firefox, Firefox ESR, und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren u…
first Oct 27, 2026 -
High max 8.8WID-SEC-2026-4436 3 CVEs
Mozilla Firefox für iOS: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox für iOS ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen oder seine Privilegien zu erhöhen.
-
High max 9.8
Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox ESR, Mozilla Firefox und Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen D…
first Sep 29, 2026 -
High max 9.8
Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipul…
first Oct 20, 2026 -
High max 9.8
Mozilla Firefox und Thunderbrid: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbrid ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Spoofing-Angriffe durchzuführen, Daten offenzulegen oder zu manipulieren, Denial-of-Service-Zustä…
first Oct 13, 2026
2,316 results · Feed
-
High 8.8
Use-after-free in the Audio/Video component
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
-
Unscored —
Same-origin policy bypass in the CSS Parsing and Computation component
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Other issue in the SVG component
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Invalid pointer in the Layout: Text and Fonts component
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Invalid pointer in the JavaScript Engine: JIT component
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout component
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Marionette component
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Mitigation bypass in the SVG component
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Spoofing issue in the Address Bar component
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Sandbox escape in the Agent component
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Layout component
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Uninitialized memory in the Graphics: WebGPU component
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Sandbox escape in the Graphics: WebGPU component
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the CSS Parsing and Computation component
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout: Positioned component
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Critical 9.6
Sandbox escape due to use-after-free in the DOM: Service Workers component
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: Editor component
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions in the Graphics: CanvasWebGL component
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions, use-after-free in the Graphics component
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Privilege escalation in the Nimbus Desktop Client component
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Security: RLBox component
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Invalid pointer in the DOM: Streams component
Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Undefined behavior in the WebRTC: Networking component
Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Mitigation bypass in the Add-ons Manager component
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Spoofing issue in the Security component
Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Use-after-free in the Graphics component
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Sandbox escape in the Console component
Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Same-origin policy bypass in the DOM: Core & HTML component
Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Layout: Form Controls component
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Address Bar component
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Incorrect boundary conditions in the WebRTC component
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Site isolation issue in the Graphics: WebRender component
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Incorrect boundary conditions in the Graphics: WebRender component
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Use-after-free in the CSS Transitions and Animations component
Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.