Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-74946 CVE record

CVSS 8.8 High

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74945 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74944 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74943 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74942 CVE record

CVSS 8.8 High

Privilege escalation in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74941 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74940 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74939 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74936 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74935 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74934 CVE record

CVSS 7.5 High

Site isolation issue in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-18809 CVE record

CVSS 6.5 Medium

Information disclosure in Firefox for Android and Firefox Focus for Android
- Mozilla Firefox
- Information disclosure
Not analysed yet 4 Aug 2026
CVE-2026-16361 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16360 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16412 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16411 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Thunderbird 153
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16410 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16409 CVE record

CVSS 7.5 High

Invalid pointer in the Security: PSM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16408 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16407 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16406 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16405 CVE record

CVSS 7.5 High

Information disclosure in the Networking: WebSockets component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16404 CVE record

CVSS 7.4 High

Spoofing issue in Firefox for Android
- Mozilla Firefox
- Authentication bypass
Not analysed yet 21 Jul 2026
CVE-2026-16403 CVE record

CVSS 6.5 Medium

Spoofing issue in the Address Bar component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 21 Jul 2026
CVE-2026-16402 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16401 CVE record

CVSS 8.8 High

Privilege escalation in the Data Loss Prevention component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16400 CVE record

CVSS 7.5 High

Information disclosure in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16399 CVE record

CVSS 7.5 High

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16398 CVE record

CVSS 7.5 High

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16397 CVE record

CVSS 6.5 Medium

Clickjacking issue in the WebExtensions component in Firefox for Android
- Mozilla Firefox
- CWE-1021
Not analysed yet 21 Jul 2026
CVE-2026-16396 CVE record

CVSS 8.8 High

Privilege escalation in WebExtensions
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16395 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16394 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16359 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16393 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16392 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
- CWE-670
Not analysed yet 21 Jul 2026
CVE-2026-16391 CVE record

CVSS 7.5 High

Information disclosure in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16390 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16389 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions, integer overflow in the Libraries component in NSS
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16388 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16387 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-16386 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16385 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16384 CVE record

CVSS 7.5 High

Information disclosure due to uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026
CVE-2026-16383 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16382 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16381 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the Networking: DNS component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16380 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16358 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16379 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16378 CVE record

CVSS 7.5 High

Other issue in the DOM: Copy & Paste and Drag & Drop component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 21 Jul 2026
CVE-2026-16377 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16376 CVE record

CVSS 7.5 High

Denial-of-service in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 21 Jul 2026
CVE-2026-16375 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 21 Jul 2026
CVE-2026-16374 CVE record

CVSS 7.5 High

Information disclosure in the Framework component in DevTools
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16373 CVE record

CVSS 7.5 High

Information disclosure in the Privacy component in Firefox for Android
- Mozilla Firefox
- Information disclosure
Not analysed yet 21 Jul 2026
CVE-2026-16372 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16371 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 21 Jul 2026
CVE-2026-16370 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 21 Jul 2026
CVE-2026-16357 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 21 Jul 2026