Firefox vulnerabilities

870 known vulnerabilities in Firefox from Mozilla. 869 are rated high or critical, and 15 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-92055Sep 15, 2026Mozilla

  Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-92053Sep 15, 2026Mozilla

  Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use of Uninitialized Variable

  CVE-2026-92052Sep 15, 2026Mozilla

  Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92049Sep 15, 2026Mozilla

  Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 9.0 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-92048Sep 15, 2026Mozilla

  Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-92047Sep 15, 2026Mozilla

  Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 9.6 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-92045Sep 15, 2026Mozilla

  Sandbox escape due to incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 7.5 High severity

  Firefox: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-92044Sep 15, 2026Mozilla

  Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92043Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 7.5 High severity

  Firefox: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-92042Sep 15, 2026Mozilla

  Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 9.1 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-92041Sep 15, 2026Mozilla

  Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 9.1 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-92038Sep 15, 2026Mozilla

  Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

• 9.6 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-92035Sep 15, 2026Mozilla

  Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Thunderbird 140.17, Firefox 156, Firefox ESR 153.3, Thunderbird 156, Thunderbird 153.3, Firefox ESR 115.42, and Firefox ESR 140.17.

• 9.6 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-92032Sep 15, 2026Mozilla

  Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92029Sep 15, 2026Mozilla

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92028Sep 15, 2026Mozilla

  Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92027Sep 15, 2026Mozilla

  Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92026Sep 15, 2026Mozilla

  Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92025Sep 15, 2026Mozilla

  Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92024Sep 15, 2026Mozilla

  Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92023Sep 15, 2026Mozilla

  Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92022Sep 15, 2026Mozilla

  Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92020Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.1 High severity

  Firefox: Protection Mechanism Failure

  CVE-2026-92019Sep 15, 2026Mozilla

  Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 9.6 Critical severity

  Firefox: Protection Mechanism Failure

  CVE-2026-92018Sep 15, 2026Mozilla

  Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-92017Sep 15, 2026Mozilla

  Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Use After Free

  CVE-2026-92016Sep 15, 2026Mozilla

  Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Improper Privilege Management

  CVE-2026-92015Sep 15, 2026Mozilla

  Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92014Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92013Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92012Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92011Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92010Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92009Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92008Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92007Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 8.8 High severity

  Firefox: Buffer Copy without Checking Size of Input

  CVE-2026-92006Sep 15, 2026Mozilla

  Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3

• 7.5 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-84145Sep 1, 2026Mozilla

  Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been

• 7.5 High severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-84144Sep 1, 2026Mozilla

  Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnera

• 9.8 Critical severity

  Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-84143Sep 1, 2026Mozilla

  Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been