Product · Mozilla

Firefox

2,316 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

Medium 5.4

CVE-2026-109721 Public exploit

Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Oct 13, 2026
Medium 5.4

CVE-2026-84118 Public exploit

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Sep 1, 2026
Medium 5.4

CVE-2026-74970 Public exploit

Site isolation issue in the Graphics component

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu

Aug 18, 2026
Medium 6.5

CVE-2026-74945 Public exploit

Information disclosure in the Graphics: Text component

Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Aug 18, 2026
Medium 4.3

CVE-2026-15718 Public exploit

Invalid pointer in the JavaScript: WebAssembly component

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Jul 14, 2026
Medium 4.3

CVE-2026-10702 Public exploit

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu

Jun 2, 2026
Medium 6.5

CVE-2026-8388 Public exploit

Incorrect boundary conditions in the JavaScript Engine: JIT component

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

May 12, 2026
Medium 6.5

CVE-2026-6770 Public exploit

Other issue in the Storage: IndexedDB component

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Apr 21, 2026
Medium 5.3

CVE-2026-6765 Public exploit

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Apr 21, 2026
Medium 5.6

CVE-2024-4367 Public exploit EPSS 71%

PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm

May 14, 2024
Medium 6.5

CVE-2024-0741 Public exploit

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jan 23, 2024