55 results · Clear filters · Feed
-
Medium 5.4CVE-2026-109721 Public exploit
Incorrect boundary conditions in the JavaScript Engine: JIT component
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1CVE-2026-109722 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
High 8.1CVE-2026-109715 Public exploit
Incorrect boundary conditions in the JavaScript Engine component
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
-
Medium 5.4CVE-2026-84118 Public exploit
Use-after-free in the JavaScript: GC component
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
-
Medium 5.4CVE-2026-74970 Public exploit
Site isolation issue in the Graphics component
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
-
Medium 6.5CVE-2026-74945 Public exploit
Information disclosure in the Graphics: Text component
Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Critical 9.8CVE-2026-74943 Public exploit
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
High 8.8CVE-2026-74939 Public exploit
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Critical 9.8CVE-2026-74936 Public exploit
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
-
Medium 4.3CVE-2026-15718 Public exploit
Invalid pointer in the JavaScript: WebAssembly component
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.
-
Critical 9.6CVE-2026-12295 Public exploit
Sandbox escape in the DOM: Navigation component
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
-
Medium 4.3CVE-2026-10702 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.
-
High 8.8CVE-2026-8389 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
-
Medium 6.5CVE-2026-8388 Public exploit
Incorrect boundary conditions in the JavaScript Engine: JIT component
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
-
Medium 6.5CVE-2026-6770 Public exploit
Other issue in the Storage: IndexedDB component
Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
Medium 5.3CVE-2026-6765 Public exploit
Information disclosure in the Form Autofill component
Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
-
Critical 9.6CVE-2026-4692 Public exploit
Sandbox escape in the Responsive Design Mode component
Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
-
Critical 9.8CVE-2026-2796 Public exploit
JIT miscompilation in the JavaScript: WebAssembly component
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
-
Critical 9.8CVE-2026-2766 Public exploit
Use-after-free in the JavaScript Engine: JIT component
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
-
Critical 9.8CVE-2026-2764 Public exploit
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
-
Critical 9.8CVE-2026-2763 Public exploit
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
-
High 7.3CVE-2025-14325 Public exploit
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
-
Critical 9.8CVE-2025-14321 Public exploit
Use-after-free in the WebRTC: Signaling component
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
-
Critical 9.8
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…
KEV Oct 15, 2024 -
Critical 9.8CVE-2024-8381 Public exploit
A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …
-
Medium 5.6
PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
-
Critical 9.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds che…
-
Medium 6.5CVE-2024-0741 Public exploit
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…
-
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
Unscored —CVE-2021-43530 Public exploit
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a…
-
Unscored —
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable…
-
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021 -
Unscored —CVE-2019-9816 Public exploit
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…
-
High 8.8
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…
KEV May 23, 2022 -
Critical 10.0
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…
KEV May 23, 2022 -
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…