Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-109727 CVE record

CVSS 5.4 Medium

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109726 CVE record

CVSS 5.4 Medium

Use-after-free in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109725 CVE record

CVSS 5.4 Medium

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109722 CVE record

CVSS 8.1 High

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-670
Not analysed yet 13 Oct 2026
CVE-2026-109719 CVE record

CVSS 4.2 Medium

Race condition, use-after-free in the Graphics: CanvasWebGL component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109718 CVE record

CVSS 5.4 Medium

Use-after-free in the XML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109716 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109715 CVE record

CVSS 8.1 High

Incorrect boundary conditions in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109712 CVE record

CVSS 7.1 High

Sandbox escape due to uninitialized memory in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109710 CVE record

CVSS 5.4 Medium

Use-after-free in the Graphics: Text component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-109706 CVE record

CVSS 5.4 Medium

Use-after-free in the Storage: IndexedDB component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-106016 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Mitigation bypass in the File Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 6 Oct 2026
CVE-2026-100832 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100831 CVE record

CVSS 8.8 High

Use-after-free in the DOM: UI Events & Focus Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100830 CVE record

CVSS 8.1 High

Mitigation bypass in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 29 Sept 2026
CVE-2026-100829 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Mitigation bypass in the DOM: Security component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100828 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Mitigation bypass in the Bookmarks & History component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100826 CVE record

CVSS 6.5 Medium

Denial-of-service in the Storage: StorageManager component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-100825 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100824 CVE record

CVSS 8.8 High

Privilege escalation in the Places component
- Mozilla Firefox
- Mozilla Thunderbird
- Privilege escalation
Not analysed yet 29 Sept 2026
CVE-2026-100823 CVE record

CVSS 5.4 Medium

Spoofing issue in the Downloads component in Firefox for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 29 Sept 2026
CVE-2026-100822 CVE record

CVSS 5.4 Medium

Spoofing issue in the Networking: HTTP component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-451
Not analysed yet 29 Sept 2026
CVE-2026-100821 CVE record

CVSS 4.7 Medium

Site isolation issue in the Panning and Zooming component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 29 Sept 2026
CVE-2026-100820 CVE record

CVSS 8.8 High

Privilege escalation in the Address Bar component
- Mozilla Thunderbird
- Mozilla Firefox
- Privilege escalation
Not analysed yet 29 Sept 2026
CVE-2026-100819 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the XPCOM component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100818 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Widget: Gtk component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100817 CVE record

CVSS 5.4 Medium

Other issue in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
Not analysed yet 29 Sept 2026
CVE-2026-100816 CVE record

CVSS 8.1 High

Site isolation issue in the DOM: Networking component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 29 Sept 2026
CVE-2026-100815 CVE record

CVSS 8.8 High

Use-after-free in the CSS Parsing and Computation component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100814 CVE record

CVSS 8.8 High

Incorrect boundary conditions in the JavaScript Engine: JIT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100813 CVE record

CVSS 8.8 High

Invalid pointer in the JavaScript Engine: JIT component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100812 CVE record

CVSS 6.5 Medium

Denial-of-service in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-100811 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the DOM: Core & HTML component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100810 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Other issue in the DevTools component
- Mozilla Thunderbird
- Mozilla Firefox
- Information disclosure
Not analysed yet 29 Sept 2026
CVE-2026-100809 CVE record

CVSS 8.1 High

Same-origin policy bypass in the DevTools component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 29 Sept 2026
CVE-2026-100808 CVE record

CVSS 8.8 High

Mitigation bypass in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 29 Sept 2026
CVE-2026-100807 CVE record

CVSS 8.8 High

Privilege escalation in the DOM: Service Workers component
- Mozilla Thunderbird
- Mozilla Firefox
- Privilege escalation
Not analysed yet 29 Sept 2026
CVE-2026-100806 CVE record

CVSS 4.3 Medium

Uninitialized memory in the Graphics: WebGPU component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100805 CVE record

CVSS 7.5 High

Race condition, use-after-free in the Audio/Video component
- Mozilla Thunderbird
- Mozilla Firefox
- Race condition
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100804 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Preferences: Backend component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100803 CVE record

CVSS 8.1 High

Same-origin policy bypass in the WebExtensions component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 29 Sept 2026
CVE-2026-100802 CVE record

CVSS 4.3 Medium

Uninitialized memory in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100801 CVE record

CVSS 8.8 High

Privilege escalation in the DLL Services component
- Mozilla Thunderbird
- Mozilla Firefox
- Privilege escalation
Not analysed yet 29 Sept 2026
CVE-2026-100800 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Disability Access APIs component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100799 CVE record

CVSS 4.3 Medium

Uninitialized memory in the Graphics: WebGPU component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100798 CVE record

CVSS 8.1 High

Cryptography misuse in Storage: Quota Manager component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-325
Not analysed yet 29 Sept 2026
CVE-2026-100797 CVE record

CVSS 8.8 High

Privilege escalation due to use-after-free in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100796 CVE record

CVSS 8.8 High

Use-after-free in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100795 CVE record

CVSS 6.5 Medium

Denial-of-service in the Networking component
- Mozilla Thunderbird
- Mozilla Firefox
- Denial of service
Not analysed yet 29 Sept 2026
CVE-2026-96869 CVE record

CVSS 4.3 Medium

Information disclosure in the Networking component
- Mozilla Thunderbird
- Mozilla Firefox
- Information disclosure
Not analysed yet 29 Sept 2026
CVE-2026-100794 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to incorrect boundary conditions in the Internationalization component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100793 CVE record

CVSS 6.5 Medium

JIT miscompilation in the JavaScript Engine component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100792 CVE record

CVSS 7.1 High

JIT miscompilation in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100791 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100790 CVE record

CVSS 8.8 High

Use-after-free in the XSLT component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100789 CVE record

CVSS 8.8 High

Use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100788 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Invalid pointer in the JavaScript: WebAssembly component
- Mozilla Thunderbird
- Mozilla Firefox
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100787 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the XUL component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-20
Not analysed yet 29 Sept 2026
CVE-2026-100786 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape due to use-after-free in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026
CVE-2026-100785 CVE record

CVSS 8.8 High

Use-after-free in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 29 Sept 2026