Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-100784 CVE record

CVSS 8.8 High

Use-after-free in the Layout: Text and Fonts component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100783 CVE record

CVSS 4.3 Medium

Uninitialized memory in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100782 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100781 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100780 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100779 CVE record

CVSS 8.8 High

Use-after-free in the XSLT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100778 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100777 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100776 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100775 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100774 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100773 CVE record

CVSS 8.8 High

Use-after-free in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100772 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100771 CVE record

CVSS 8.1 High

Undefined behavior in the DOM: Streams component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-758
Not analysed yet 29 Sept 2026
CVE-2026-100770 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100769 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100768 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100767 CVE record

CVSS 8.8 High

Use-after-free in the Networking: Cache component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100766 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking: JAR component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 29 Sept 2026
CVE-2026-100765 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100764 CVE record

CVSS 8.8 High

Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100763 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100762 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Content Processes component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100761 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100760 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100759 CVE record

CVSS 8.1 High

Uninitialized memory in the Storage: Quota Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100758 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100757 CVE record

CVSS 8.8 High

Use-after-free in the Widget component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100756 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the Audio/Video: Playback component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-92079 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92078 CVE record

CVSS 6.5 Medium

Denial-of-service in the Security component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92077 CVE record

CVSS 6.5 Medium

Denial-of-service in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92076 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92075 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92074 CVE record

CVSS 8.8 High

Mitigation bypass in the Popup Blocker component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92073 CVE record

CVSS 8.8 High

Privilege escalation in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92072 CVE record

CVSS 8.0 High

Incorrect boundary conditions in the Safe Browsing component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92071 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92070 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 15 Sept 2026
CVE-2026-92069 CVE record

CVSS 5.4 Medium

Spoofing issue in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 15 Sept 2026
CVE-2026-92068 CVE record

CVSS 5.4 Medium

Site isolation issue in the Reader Mode component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 15 Sept 2026
CVE-2026-92067 CVE record

CVSS 8.8 High

Use-after-free in the Widget: Gtk component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92066 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape in the Profile Backup component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92065 CVE record

CVSS 8.8 High

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92064 CVE record

CVSS 8.8 High

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92063 CVE record

CVSS 6.5 Medium

Denial-of-service in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 15 Sept 2026
CVE-2026-92062 CVE record

CVSS 8.8 High

Privilege escalation in the Session Restore component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92061 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the Security: Process Sandboxing component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92060 CVE record

CVSS 8.8 High

Use-after-free in the Internationalization component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92059 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Incorrect boundary conditions in the DOM: Editor component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92058 CVE record

CVSS 8.8 High

Use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92057 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mitigation bypass in the Enterprise Policies component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 15 Sept 2026
CVE-2026-92056 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92055 CVE record

CVSS 8.8 High

Privilege escalation in the DevTools component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92054 CVE record

CVSS 8.8 High

Privilege escalation in the Memory component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92053 CVE record

CVSS 8.8 High

Privilege escalation in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 15 Sept 2026
CVE-2026-92052 CVE record

CVSS 8.8 High

Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92051 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Spoofing issue due to invalid pointer in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-92050 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Sandbox escape due to race condition in the XPConnect component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 15 Sept 2026
CVE-2026-92049 CVE record

CVSS 8.8 High

Use-after-free in the Widget: Win32 component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 15 Sept 2026