Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-84127 CVE record

CVSS 4.3 Medium

Information disclosure in the WebExtensions component in Firefox for Android
- Mozilla Firefox
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84126 CVE record

CVSS 4.3 Medium

Incorrect boundary conditions in the Layout: Grid component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84125 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84124 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84123 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84122 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84118 CVE record

CVSS 5.4 Medium

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84117 CVE record

CVSS 8.8 High

Privilege escalation in Firefox for Android
- Mozilla Firefox
- Broken access control
Not analysed yet 1 Sept 2026
CVE-2026-84145 CVE record

CVSS 7.5 High

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84131 CVE record

CVSS 8.8 High

Privilege escalation due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84121 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84120 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84119 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-74989 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74988 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74986 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Site isolation issue in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74985 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Privilege escalation in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74984 CVE record

CVSS 6.8 Medium

Race condition in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 18 Aug 2026
CVE-2026-74982 CVE record

CVSS 7.5 High

Denial-of-service in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 18 Aug 2026
CVE-2026-74981 CVE record

CVSS 8.1 High

Site isolation issue in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74980 CVE record

CVSS 6.5 Medium

Clickjacking issue in the Downloads component in Firefox for Android
- Mozilla Firefox
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74979 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the Add-ons Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-74978 CVE record

CVSS 8.1 High

Clickjacking issue in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74977 CVE record

CVSS 7.5 High

Integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74975 CVE record

CVSS 5.4 Medium

Spoofing issue in the Downloads component in Firefox for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 18 Aug 2026
CVE-2026-74970 CVE record

CVSS 5.4 Medium

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74968 CVE record

CVSS 5.4 Medium

Site isolation issue in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74966 CVE record

CVSS 7.5 High

Information disclosure in the Form Autofill component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74961 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Side-channel in the Web Audio component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74958 CVE record

CVSS 7.5 High

Information disclosure in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74956 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Same-origin policy bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74955 CVE record

CVSS 8.8 High

Privilege escalation in the Request Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74954 CVE record

CVSS 7.5 High

Information disclosure due to side-channel in the Storage: Cache API component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74952 CVE record

CVSS 8.8 High

Privilege escalation in the Application Update component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74951 CVE record

CVSS 6.5 Medium

Clickjacking issue in Firefox for Android
- Mozilla Firefox
- CWE-1021
Not analysed yet 18 Aug 2026
CVE-2026-74950 CVE record

CVSS 8.8 High

Privilege escalation in the Downloads API component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74947 CVE record

CVSS 8.8 High

Privilege escalation due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74938 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74937 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-75874 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Sandbox escape in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74990 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74987 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74983 CVE record

CVSS 8.1 High

Mitigation bypass in the Data Loss Prevention component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74976 CVE record

CVSS 6.5 Medium

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74974 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74973 CVE record

CVSS 4.2 Medium

Race condition, use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74972 CVE record

CVSS 4.3 Medium

Information disclosure in the DOM: Push Subscriptions component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74971 CVE record

CVSS 4.3 Medium

Information disclosure in the DOM: UI Events & Focus Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026
CVE-2026-74969 CVE record

CVSS 8.8 High

Race condition, use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74967 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74965 CVE record

CVSS 8.8 High

Privilege escalation in the Shell Integration component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74964 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74963 CVE record

CVSS 5.4 Medium

Same-origin policy bypass in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74962 CVE record

CVSS 8.1 High

Site isolation issue in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74960 CVE record

CVSS 8.1 High

Site isolation issue in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CWE-346
Not analysed yet 18 Aug 2026
CVE-2026-74959 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Storage: Cache API component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74957 CVE record

CVSS 8.1 High

Mitigation bypass in the Safe Browsing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 18 Aug 2026
CVE-2026-74953 CVE record

CVSS 8.8 High

Privilege escalation in the Networking: Cookies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 18 Aug 2026
CVE-2026-74949 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 18 Aug 2026
CVE-2026-74948 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 18 Aug 2026