Skip to content
OpenAdvisories

Vendor

Mozilla

2,559 known vulnerabilities.

Products

Firefox 2,316 Thunderbird 1,814 Firefox ESR 712 Firefox for iOS 63 Firefox for Android 33 Focus for Android 17 Thunderbird ESR 13 Focus for iOS 13 NSS 6 Focus 3 WebThings Gateway 2 Mozilla Bleach 2 Hubs Cloud 2 Mozilla VPN 2 Node-convict 1 Network Security Services (NSS) 1 thin-vec 1 Mozilla VPN 2.28.0 1 hawk 1 rhino 1 Firefox for 1 geckodriver 1 common-voice 1 Convict 1 Bugzilla 1 Persona 1 Network Security Services 1 Nunjucks 1 Klar for iOS 1 neqo 1 Mozilla VPN iOS 1.0.7 1 Mozilla VPN Windows 1 Mozilla VPN Android 1.1.0 1 sccache 1 Mozilla VPN 2.16.1 1 PollBot 1 Thunderbird < 102.8 0 Thunderbird < 102.9 0 Thunderbird < 102.9.1 0 Firefox < 110.1.0 Android 0
All Critical High Medium Low Exploited only Public exploit

507 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-92031

    Information disclosure in the Graphics: ImageLib component

    Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2026-92030

    Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

    Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.3
    CVE-2026-92005

    Use-after-free in the Audio/Video: Web Codecs component

    Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-86853

    Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS

    A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1.

    Mozilla Firefox for iOS iOS Browsers
  • Medium 4.3
    CVE-2026-84127

    Information disclosure in the WebExtensions component in Firefox for Android

    Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu
  • Medium 4.3
    CVE-2026-84126

    Incorrect boundary conditions in the Layout: Grid component

    Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-84125

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-84124

    Use-after-free in the DOM: Core & HTML component

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-84122

    Use-after-free in the Audio/Video component

    Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-84118 Public exploit

    Use-after-free in the JavaScript: GC component

    Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-84120

    Use-after-free in the Audio/Video component

    Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-81267

    Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS

    A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0.

    Mozilla Firefox for iOS iOS Browsers
  • Medium 6.8
    CVE-2026-74984

    Race condition in the JavaScript Engine component

    Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 6.5
    CVE-2026-74980

    Clickjacking issue in the Downloads component in Firefox for Android

    Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu
  • Medium 5.4
    CVE-2026-74975

    Spoofing issue in the Downloads component in Firefox for Android

    Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu
  • Medium 5.4
    CVE-2026-74968

    Site isolation issue in the Graphics: WebRender component

    Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-74970 Public exploit

    Site isolation issue in the Graphics component

    Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu
  • Medium 6.5
    CVE-2026-74951

    Clickjacking issue in Firefox for Android

    Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu
  • Medium 6.5
    CVE-2026-74976

    JIT miscompilation in the JavaScript Engine: JIT component

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2026-74974

    Same-origin policy bypass in the Graphics: ImageLib component

    Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-74971

    Information disclosure in the DOM: UI Events & Focus Handling component

    Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-74972

    Information disclosure in the DOM: Push Subscriptions component

    Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.2
    CVE-2026-74973

    Race condition, use-after-free in the Graphics component

    Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2026-74963

    Same-origin policy bypass in the Networking: Cookies component

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-74967

    Same-origin policy bypass in the Audio/Video: Playback component

    Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-74948

    Information disclosure in the Graphics component

    Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-74945 Public exploit

    Information disclosure in the Graphics: Text component

    Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-18809

    Information disclosure in Firefox for Android and Firefox Focus for Android

    Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 6.5
    CVE-2026-16403

    Spoofing issue in the Address Bar component

    Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 6.5
    CVE-2026-16397

    Clickjacking issue in the WebExtensions component in Firefox for Android

    Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

    Mozilla Firefox thunderbird mozjs38 Browsers Ubuntu Wolfi
  • Medium 5.4
    CVE-2026-15719

    Site isolation issue in the DOM: Navigation component

    We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-15718 Public exploit

    Invalid pointer in the JavaScript: WebAssembly component

    We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.3
    CVE-2026-14906

    Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS

    Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

    Mozilla Firefox for iOS iOS Browsers
  • Medium 6.3
    CVE-2026-13356

    Interrupted navigation could allow address bar origin spoofing in Firefox for iOS

    A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was f…

    Mozilla Firefox for iOS iOS Browsers
  • Medium 6.5
    CVE-2026-57963

    Chat UI manipulation by injection

    An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 5.3
    CVE-2026-57962

    Denial-of-service via malicious LDAP address-book server

    A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerabilit…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 4.3
    CVE-2026-53900

    Cookie injection was possible when opening a PDF link

    Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefo…

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Medium 6.5
    CVE-2026-53899

    Cross-origin cookies could be leaked when opening a PDF link

    Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Medium 5.4
    CVE-2026-12330

    Incorrect boundary conditions in the Internationalization component

    Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.3
    CVE-2026-12329

    Memory safety bug fixed in Thunderbird ESR 140.12

    Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi