Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-120572 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Layout: Block and Inline component
- Mozilla Firefox
- Memory corruption
Not analysed yet 3 Nov 2026
CVE-2026-118027 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Frame poisoning in the Layout component
- Mozilla Firefox
- CWE-451
Not analysed yet 27 Oct 2026
CVE-2026-118026 CVE record

CVSS 8.8 High

Invalid pointer in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118025 CVE record

CVSS 8.8 High

Other issue in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 27 Oct 2026
CVE-2026-118024 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118023 CVE record

CVSS 8.8 High

Sandbox escape due to use-after-free in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118022 CVE record

CVSS 8.8 High

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118021 CVE record

CVSS 8.8 High

Sandbox escape due to use-after-free in the XPCOM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118020 CVE record

CVSS 8.8 High

Use-after-free in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118019 CVE record

CVSS 8.8 High

Race condition, use-after-free in the DOM: File component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 27 Oct 2026
CVE-2026-118018 CVE record

CVSS 8.8 High

Spoofing issue in the Downloads component in Firefox for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 27 Oct 2026
CVE-2026-118017 CVE record

CVSS 8.8 High

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118016 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118015 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118014 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118013 CVE record

CVSS 8.8 High

Use-after-free in the Layout: Images, Video, and HTML Frames component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118012 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Animation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118011 CVE record

CVSS 8.8 High

Frame poisoning in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 27 Oct 2026
CVE-2026-118010 CVE record

CVSS 8.8 High

Use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118009 CVE record

CVSS 8.8 High

Integer overflow, use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118008 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 27 Oct 2026
CVE-2026-118007 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118006 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118005 CVE record

CVSS 8.8 High

Use-after-free in the WebRTC: Signaling component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118004 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the CSS Transitions and Animations component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-118003 CVE record

CVSS 8.1 High

Information disclosure in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 27 Oct 2026
CVE-2026-118002 CVE record

CVSS 8.1 High

Information disclosure due to race condition in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 27 Oct 2026
CVE-2026-118000 CVE record

CVSS 8.1 High

Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 27 Oct 2026
CVE-2026-117999 CVE record

CVSS 8.8 High

Race condition in the IPC component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 27 Oct 2026
CVE-2026-117998 CVE record

CVSS 8.8 High

Mitigation bypass in the DOM: Push Subscriptions component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 27 Oct 2026
CVE-2026-117997 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117996 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117995 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: UI Events & Focus Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 27 Oct 2026
CVE-2026-117994 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117993 CVE record

CVSS 8.8 High

Integer overflow in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117992 CVE record

CVSS 6.5 Medium

Information disclosure in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 27 Oct 2026
CVE-2026-117991 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117990 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117989 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117988 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117987 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117986 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117985 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117984 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Layout: Scrolling and Overflow component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117983 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117982 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117981 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation in the Toolkit component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 27 Oct 2026
CVE-2026-117980 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117979 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117978 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117977 CVE record

CVSS 8.1 High

Other issue in the Console component
- Mozilla Firefox
- Mozilla Thunderbird
- Other injection
Not analysed yet 27 Oct 2026
CVE-2026-117976 CVE record

CVSS 8.1 High

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 27 Oct 2026
CVE-2026-117975 CVE record

CVSS 8.8 High

Sandbox escape due to invalid pointer in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117974 CVE record

CVSS 8.8 High

Use-after-free in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117973 CVE record

CVSS 8.8 High

Use-after-free in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117972 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117971 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Print Preview component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117970 CVE record

CVSS 8.8 High

Race condition in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 27 Oct 2026
CVE-2026-117969 CVE record

CVSS 8.8 High

Invalid pointer in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026
CVE-2026-117968 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 27 Oct 2026