Firefox vulnerabilities

870 known vulnerabilities in Firefox from Mozilla. 869 are rated high or critical, and 15 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

870vulnerabilities

253critical

616high

15exploited

8.7average CVSS score

Latest first

9.6 Critical severity
Firefox: Use After Free
CVE-2026-100786Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100785Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100784Sep 29, 2026Mozilla
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100782Sep 29, 2026Mozilla
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100781Sep 29, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100780Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100779Sep 29, 2026Mozilla
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100778Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100777Sep 29, 2026Mozilla
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100776Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-100775Sep 29, 2026Mozilla
Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100774Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100773Sep 29, 2026Mozilla
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100772Sep 29, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
8.1 High severity
Firefox: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CVE-2026-100771Sep 29, 2026Mozilla
Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100770Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Thunderbird: Use After Free
CVE-2026-100769Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100767Sep 29, 2026Mozilla
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100765Sep 29, 2026Mozilla
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
8.8 High severity
Thunderbird: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100764Sep 29, 2026Mozilla
Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-100762Sep 29, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-100760Sep 29, 2026Mozilla
Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
8.1 High severity
Firefox: Use of Uninitialized Variable
CVE-2026-100759Sep 29, 2026Mozilla
Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.6 Critical severity
Firefox: Improper Access Control
CVE-2026-100758Sep 29, 2026Mozilla
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.8 High severity
Firefox: Use After Free
CVE-2026-100757Sep 29, 2026Mozilla
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
8.1 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-100756Sep 29, 2026Mozilla
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-92079Sep 15, 2026Mozilla
Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92076Sep 15, 2026Mozilla
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-92075Sep 15, 2026Mozilla
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Protection Mechanism Failure
CVE-2026-92074Sep 15, 2026Mozilla
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-92073Sep 15, 2026Mozilla
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.0 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92072Sep 15, 2026Mozilla
Incorrect boundary conditions in the Safe Browsing component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
9.6 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92071Sep 15, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92065Sep 15, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92064Sep 15, 2026Mozilla
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-92062Sep 15, 2026Mozilla
Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Use After Free
CVE-2026-92060Sep 15, 2026Mozilla
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
9.3 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-92059Sep 15, 2026Mozilla
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-92057Sep 15, 2026Mozilla
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
8.8 High severity
Firefox: Use After Free
CVE-2026-92056Sep 15, 2026Mozilla
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.