Firefox vulnerabilities

870 known vulnerabilities in Firefox from Mozilla. 869 are rated high or critical, and 15 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

870vulnerabilities

253critical

616high

15exploited

8.7average CVSS score

Latest first

9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-84142Sep 1, 2026Mozilla
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefo
9.8 Critical severity
Firefox: Integer Overflow or Wraparound
CVE-2026-84141Sep 1, 2026Mozilla
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
9.8 Critical severity
Firefox: Origin Validation Error
CVE-2026-84140Sep 1, 2026Mozilla
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
9.8 Critical severity
Firefox: Origin Validation Error
CVE-2026-84133Sep 1, 2026Mozilla
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
7.5 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2026-84132Sep 1, 2026Mozilla
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
8.8 High severity
Firefox: Release of Invalid Pointer or Reference
CVE-2026-84131Sep 1, 2026Mozilla
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
7.5 High severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2026-84130Sep 1, 2026Mozilla
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
9.8 Critical severity
Firefox: Origin Validation Error
CVE-2026-84129Sep 1, 2026Mozilla
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
8.8 High severity
Firefox: Use After Free
CVE-2026-84123Sep 1, 2026Mozilla
Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-84121Sep 1, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
9.6 Critical severity
Firefox: Use After Free
CVE-2026-84119Sep 1, 2026Mozilla
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
10.0 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-75874Aug 18, 2026Mozilla
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2.
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-74990Aug 18, 2026Mozilla
Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could h
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-74989Aug 18, 2026Mozilla
Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 15
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-74988Aug 18, 2026Mozilla
Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability w
9.8 Critical severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-74987Aug 18, 2026Mozilla
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.
9.1 Critical severity
Firefox: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2026-74986Aug 18, 2026Mozilla
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
9.8 Critical severity
Firefox: Improper Privilege Management
CVE-2026-74985Aug 18, 2026Mozilla
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.1 High severity
Firefox: Protection Mechanism Failure
CVE-2026-74983Aug 18, 2026Mozilla
Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-74981Aug 18, 2026Mozilla
Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
9.8 Critical severity
Firefox: Improper Access Control
CVE-2026-74979Aug 18, 2026Mozilla
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Use After Free
CVE-2026-74969Aug 18, 2026Mozilla
Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
7.5 High severity
Firefox: Exposure of Private Personal Information to an Unauthorized Actor
CVE-2026-74966Aug 18, 2026Mozilla
Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-74965Aug 18, 2026Mozilla
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
9.8 Critical severity
Firefox: Integer Overflow or Wraparound
CVE-2026-74964Aug 18, 2026Mozilla
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
8.1 High severity
Firefox: Origin Validation Error
CVE-2026-74962Aug 18, 2026Mozilla
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
8.1 High severity
Firefox: Improper Access Control
CVE-2026-74960Aug 18, 2026Mozilla
Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
9.1 Critical severity
Firefox: Protection Mechanism Failure
CVE-2026-74959Aug 18, 2026Mozilla
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
7.5 High severity
Firefox: Improper Restriction of Rendered UI Layers or Frames
CVE-2026-74958Aug 18, 2026Mozilla
Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.1 High severity
Firefox: Protection Mechanism Failure
CVE-2026-74957Aug 18, 2026Mozilla
Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
9.1 Critical severity
Firefox: Access of Resource Using Incompatible Type
CVE-2026-74956Aug 18, 2026Mozilla
Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-74955Aug 18, 2026Mozilla
Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
7.5 High severity
Firefox: Observable Discrepancy
CVE-2026-74954Aug 18, 2026Mozilla
Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-74953Aug 18, 2026Mozilla
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-74952Aug 18, 2026Mozilla
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
8.8 High severity
Firefox: Improper Privilege Management
CVE-2026-74950Aug 18, 2026Mozilla
Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Use After Free
CVE-2026-74949Aug 18, 2026Mozilla
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
8.8 High severity
Firefox: Release of Invalid Pointer or Reference
CVE-2026-74947Aug 18, 2026Mozilla
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
8.8 High severity
Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2026-74946Aug 18, 2026Mozilla
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153
9.8 Critical severity
Firefox: Use After Free
CVE-2026-74944Aug 18, 2026Mozilla
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.