Firefox vulnerabilities
667 known CVE vulnerabilities in Firefox, translated and rated.
- CVE-2026-117950Low risk· EPSS 8%
Incorrect boundary conditions in the DOM: Core & HTML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117949Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117948Low risk· EPSS 8%
Use-after-free vulnerability in the SVG component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117947Low risk· EPSS 8%
Use-after-free vulnerability in the XML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117946Low risk· EPSS 8%
Incorrect boundary conditions in the JavaScript Engine component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117945Low risk· EPSS 8%
Incorrect boundary conditions exist in the XML component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117944Low risk· EPSS 8%
A use-after-free vulnerability exists in the Layout component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117943Low risk· EPSS 8%
A use-after-free vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117942Low risk· EPSS 8%
Incorrect boundary conditions exist in the JavaScript Engine: JIT component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117941Low risk· EPSS 8%
A use-after-free vulnerability exists in the DOM: CSS Object Model component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117940Low risk· EPSS 8%
A use-after-free vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117939Low risk· EPSS 8%
A use-after-free vulnerability exists in the XML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117938Low risk· EPSS 8%
A use-after-free vulnerability exists in the Layout component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117937Low risk· EPSS 8%
An invalid pointer vulnerability exists in the JavaScript Engine component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117936Low risk· EPSS 8%
A use-after-free vulnerability exists in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117935Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Bindings (WebIDL) component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117934Low risk· EPSS 8%
Use-after-free vulnerability in the Layout component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117933Low risk· EPSS 8%
Frame poisoning vulnerability in the CSS Parsing and Computation component of Firefox and Thunderbird. It may lead to data integrity issues or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117932Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117931Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Events component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117930Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Bindings (WebIDL) component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117929Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117928Low risk· EPSS 9%
Same-origin policy bypass vulnerability in the CSS Parsing and Computation component of Firefox and Thunderbird. It may allow unauthorized access to data from other origins. The vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117927Low risk· EPSS 8%
Use-after-free vulnerability in the SVG component of Firefox and Thunderbird. It may lead to arbitrary code execution or application crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117926Low risk· EPSS 8%
Incorrect boundary conditions vulnerability in the SVG component of Firefox and Thunderbird. It may lead to unexpected application behavior or crash. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117925Low risk· EPSS 9%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117924Low risk· EPSS 8%
Use-after-free vulnerability in the XSLT component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117923Low risk· EPSS 8%
Use-after-free vulnerability in the Audio/Video component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117922Low risk· EPSS 8%
Use-after-free vulnerability in the Networking: WebSockets component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117921Low risk· EPSS 8%
Use-after-free vulnerability in the CSS Parsing and Computation component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117920Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: HTML Parser component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117919Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117918Low risk· EPSS 8%
Use-after-free vulnerability in the Graphics: Canvas2D component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117917Low risk· EPSS 8%
Invalid pointer vulnerability in the Graphics: WebRender component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117916Low risk· EPSS 8%
Use-after-free vulnerability in the XSLT component of Firefox and Thunderbird. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117905Low risk· EPSS 8%
Use-after-free vulnerability in the Audio/Video: Playback component of Firefox and Thunderbird. It may lead to undefined memory behavior during media playback. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117904Low risk· EPSS 8%
Use-after-free vulnerability in the JavaScript: GC component of Firefox and Thunderbird. It may cause memory errors during JavaScript garbage collection. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117903Low risk· EPSS 10%
Use-after-free vulnerability in the Audio/Video component of Firefox and Thunderbird. It may lead to memory errors while processing audio and video content. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117902Low risk· EPSS 8%
Use-after-free vulnerability in the Layout: Text and Fonts component of Firefox and Thunderbird. It may cause memory errors while rendering text and fonts. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117901Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to memory errors while processing HTML documents and DOM manipulation. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117900Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Editor component of Firefox and Thunderbird. It may cause memory errors while editing content in the browser. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117899Low risk· EPSS 8%
Use-after-free vulnerability in the Networking: HTTP component of Firefox and Thunderbird. It may lead to memory errors while handling HTTP connections. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117898Low risk· EPSS 8%
Use-after-free vulnerability in the JavaScript Engine: JIT component of Firefox and Thunderbird. It may cause memory errors during JIT compilation of JavaScript code. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117897Low risk· EPSS 8%
Incorrect boundary conditions vulnerability in the Layout: Tables component of Firefox and Thunderbird. It may lead to errors while rendering tables. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117896Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to memory errors while processing HTML documents and DOM manipulation. The issue was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117895Low risk· EPSS 8%
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to undefined behavior or potential code execution. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117894Low risk· EPSS 8%
Incorrect boundary conditions in the WebRTC: Signaling component of Firefox and Thunderbird. It may cause errors or potential security impacts when processing WebRTC signaling. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117893Low risk· EPSS 8%
Incorrect boundary conditions in the Security: PSM component of Firefox and Thunderbird. It may lead to errors in connection security handling. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117892Low risk· EPSS 8%
Use-after-free vulnerability in the WebRTC: Networking component of Firefox and Thunderbird enabling privilege escalation. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117891Low risk· EPSS 8%
Use-after-free vulnerability in the JavaScript Engine: JIT component of Firefox and Thunderbird. It may lead to code execution or application crashes. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

