Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92048 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92047 CVE record

CVSS 8.8 High

Privilege escalation in the Crash Reporting component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92046 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92045 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the WebRTC component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92044 CVE record

CVSS 7.5 High

Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92043 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92042 CVE record

CVSS 7.5 High

Race condition in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 15 Sept 2026
CVE-2026-92041 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92040 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92039 CVE record

CVSS 6.3 Medium

Mitigation bypass in the DOM: Notifications component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92038 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92037 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the DOM: Animation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92036 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92035 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92034 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Site isolation issue in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 15 Sept 2026
CVE-2026-92033 CVE record

CVSS 8.8 High

Privilege escalation in Firefox for Android
- Mozilla Firefox
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92032 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92031 CVE record

CVSS 6.5 Medium

Information disclosure in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92030 CVE record

CVSS 5.4 Medium

Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92029 CVE record

CVSS 8.8 High

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92028 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92027 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Streams component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92026 CVE record

CVSS 8.8 High

Use-after-free in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92025 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92024 CVE record

CVSS 8.8 High

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92023 CVE record

CVSS 8.8 High

Use-after-free in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92022 CVE record

CVSS 8.8 High

Use-after-free in the DOM: HTML Parser component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92021 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92020 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92019 CVE record

CVSS 8.1 High

Mitigation bypass in the Remote Settings Client component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92018 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92017 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92016 CVE record

CVSS 8.8 High

Use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92015 CVE record

CVSS 8.8 High

Privilege escalation in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92014 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92013 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92012 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92011 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92010 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92009 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92008 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92007 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92006 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92005 CVE record

CVSS 5.3 Medium

Use-after-free in the Audio/Video: Web Codecs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-84144 CVE record

CVSS 7.5 High

Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84143 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84142 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Internally found bugs fixed in Thunderbird 155
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84141 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Integer overflow in the Graphics: ImageLib component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 1 Sept 2026
CVE-2026-84140 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84139 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Clickjacking issue in the DOM: Events component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1021
Not analysed yet 1 Sept 2026
CVE-2026-84138 CVE record

CVSS 7.5 High

Denial-of-service in the PDF Viewer component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 1 Sept 2026
CVE-2026-84137 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Spoofing issue in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 1 Sept 2026
CVE-2026-84136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84135 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in Firefox Focus for Android
- Mozilla Firefox
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84134 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84133 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Push Subscriptions component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84132 CVE record

CVSS 7.5 High

Information disclosure in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84130 CVE record

CVSS 7.5 High

Information disclosure in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 1 Sept 2026
CVE-2026-84129 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Site isolation issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 1 Sept 2026
CVE-2026-84128 CVE record

CVSS 8.8 High

Privilege escalation in the WebDriver BiDi component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 1 Sept 2026