Firefox vulnerabilities

667 known CVE vulnerabilities in Firefox, translated and rated.

CVE-2026-118023Low risk· EPSS 4%
Use-after-free vulnerability in the Graphics: WebRender component enabling a sandbox escape in Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118022Low risk· EPSS 4%
Use-after-free vulnerability in the Disability Access APIs component enabling a sandbox escape in Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118021Low risk· EPSS 4%
Use-after-free vulnerability in the XPCOM component enabling a sandbox escape in Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118020Low risk· EPSS 4%
Use-after-free vulnerability in the Layout component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118019Low risk· EPSS 4%
Race condition and use-after-free vulnerability in the DOM: File component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118017Low risk· EPSS 4%
Use-after-free vulnerability in the SVG component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118016Low risk· EPSS 4%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118015Low risk· EPSS 4%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118014Low risk· EPSS 4%
Use-after-free vulnerability in the JavaScript Engine: JIT component of Firefox and Thunderbird. The issue was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118002Low risk· EPSS 8%
A race condition in the Networking component of Firefox and Thunderbird can lead to information disclosure. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118000Low risk· EPSS 8%
An information disclosure vulnerability exists in the Networking: HTTP component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117999Low risk· EPSS 8%
A race condition exists in the IPC component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117998Low risk· EPSS 9%
A mitigation bypass exists in the DOM: Push Subscriptions component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117997Low risk· EPSS 8%
A use-after-free in the Widget component of Firefox and Thunderbird can lead to a sandbox escape. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117996Low risk· EPSS 8%
Incorrect boundary conditions exist in the WebRTC component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117995Low risk· EPSS 8%
A privilege escalation vulnerability exists in the DOM: UI Events & Focus Handling component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117994Low risk· EPSS 8%
A use-after-free exists in the JavaScript: GC component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117993Low risk· EPSS 8%
An integer overflow exists in the Graphics: Text component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117992Low risk· EPSS 8%
An information disclosure vulnerability exists in the CSS Parsing and Computation component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117981Low risk· EPSS 8%
Privilege escalation vulnerability in the Toolkit component of Firefox and Thunderbird. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117980Low risk· EPSS 8%
Use-after-free vulnerability in the Graphics component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117979Low risk· EPSS 8%
Incorrect boundary conditions in the Graphics: WebRender component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117978Low risk· EPSS 8%
Incorrect boundary conditions in the Graphics component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117977Low risk· EPSS 8%
Other issue in the Console component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117976Low risk· EPSS 8%
Site isolation issue in the DOM: Navigation component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117975Low risk· EPSS 8%
Sandbox escape due to an invalid pointer in the Graphics: WebRender component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117974Low risk· EPSS 8%
Use-after-free vulnerability in the XML component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117973Low risk· EPSS 8%
Use-after-free vulnerability in the Networking: DNS component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117972Low risk· EPSS 8%
Use-after-free vulnerability in the Graphics component of Firefox and Thunderbird. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117971Low risk· EPSS 8%
A use-after-free vulnerability in the Print Preview component of Firefox and Thunderbird allows a sandbox escape. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117970Low risk· EPSS 8%
A race condition exists in the Disability Access APIs component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117969Low risk· EPSS 8%
An invalid pointer exists in the JavaScript Engine: JIT component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117968Low risk· EPSS 8%
A use-after-free vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117967Low risk· EPSS 9%
A mitigation bypass exists in the DOM: Security component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117966Low risk· EPSS 8%
A site isolation issue exists in the Networking: HTTP component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117965Low risk· EPSS 9%
A same-origin policy bypass exists in the Address Bar component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117964Low risk· EPSS 8%
A use-after-free vulnerability exists in the Panning and Zooming component of Firefox and Thunderbird. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117963Low risk· EPSS 8%
Incorrect boundary conditions exist in the DOM: Service Workers component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117962Low risk· EPSS 8%
A sandbox escape caused by incorrect boundary conditions exists in the Storage: Quota Manager component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117961Low risk· EPSS 8%
Incorrect boundary conditions in the Layout: Text and Fonts component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117960Low risk· EPSS 8%
Spoofing issue in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117959Low risk· EPSS 8%
Site isolation issue in the DOM: Service Workers component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117958Low risk· EPSS 8%
Site isolation issue in the Networking: HTTP component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117957Low risk· EPSS 8%
Cryptographic issue in the WebRTC: Networking component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117956Low risk· EPSS 8%
Invalid pointer in the Nimbus Desktop Client component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117955Low risk· EPSS 8%
JIT miscompilation in the JavaScript: WebAssembly component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117954Low risk· EPSS 8%
Use-after-free in the Layout: Positioned component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117953Low risk· EPSS 8%
Use-after-free in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117952Low risk· EPSS 8%
Uninitialized memory in the Networking component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117951Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS