Firefox vulnerabilities
668 known CVE vulnerabilities in Firefox, translated and rated.
- CVE-2026-92078Medium
Denial-of-service vulnerability in the Security component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92077Medium
Denial-of-service vulnerability in the SVG component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92076High
Incorrect boundary conditions vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92073High
A privilege escalation vulnerability in the Enterprise Policies component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92072High
Incorrect boundary conditions vulnerability in the Safe Browsing component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92070Medium
Information disclosure vulnerability in the Networking component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92069Medium
Spoofing vulnerability in the DOM: Navigation component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92068Medium
Site isolation vulnerability in the Reader Mode component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92067High
Use-after-free vulnerability in the Widget: Gtk component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92063Medium
Denial-of-service vulnerability in the Audio/Video component. Fixed in Firefox 156 and Thunderbird 156.
- CVE-2026-92062High
A privilege escalation vulnerability in the Session Restore component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92055High
A privilege escalation vulnerability in the DevTools component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92054High
A privilege escalation vulnerability exists in the Memory component of Firefox and Thunderbird. It has been fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92053High
A privilege escalation vulnerability in the Graphics: CanvasWebGL component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92052High
A privilege escalation vulnerability due to uninitialized memory in the Graphics: CanvasWebGL component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92047High
A privilege escalation vulnerability in the Crash Reporting component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92046High
Use-after-free vulnerability in the Graphics component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92044High
Information disclosure vulnerability in the Networking: HTTP component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92043High
A privilege escalation vulnerability caused by incorrect boundary conditions in the Audio/Video component of Firefox and Thunderbird. Fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92042High
Race condition vulnerability in the DOM: Content Processes component. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- CVE-2026-92030Medium
Mitigation bypass vulnerability in the DOM: Copy & Paste and Drag & Drop component. The flaw was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92029High
Use-after-free vulnerability in the SVG component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92028High
Use-after-free vulnerability in the DOM: Core & HTML component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92027High
Use-after-free vulnerability in the DOM: Streams component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92026High
Use-after-free vulnerability in the Networking component. The flaw was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92025High
Use-after-free vulnerability in the DOM: Navigation component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92024High
Use-after-free vulnerability in the SVG component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92023High
Use-after-free vulnerability in the XML component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92022High
Use-after-free vulnerability in the DOM: HTML Parser component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92021High
Use-after-free vulnerability in the JavaScript Engine: JIT component. Fixed in Firefox ESR 140.16 and Thunderbird 140.16.
- CVE-2026-92020High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: WebRender component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92019High
Mitigation bypass vulnerability in the Remote Settings Client component. The flaw was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92017High
A privilege escalation vulnerability in the DOM: Service Workers component of Firefox and Thunderbird. It affects multiple ESR branches and is patched in Firefox 156, Firefox ESR 115.41, 140.16, 153.3, Thunderbird 156, 140.16, and 153.3.
- CVE-2026-92016High
Use-after-free vulnerability in the Disability Access APIs component. It was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92015High
Privilege escalation vulnerability in the WebExtensions component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92014High
A vulnerability in the Graphics component of Firefox and Thunderbird allows privilege escalation due to incorrect boundary conditions. It was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.
- CVE-2026-92013High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92012High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92011High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92010High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92009High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92008High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92007High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92006High
Privilege escalation vulnerability due to incorrect boundary conditions in the Graphics: CanvasWebGL component. It was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-92005Medium
Use-after-free vulnerability in the Audio/Video: Web Codecs component. It was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-84139Medium
Clickjacking issue in the DOM: Events component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84138Medium
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
- CVE-2026-84137Medium
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84136Medium
Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
- CVE-2026-84132High
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS