CyberSecBulletin

Mozilla vulnerabilities

We track 912 vulnerabilities in Mozilla products across 22 products. 911 are rated high or critical, and 15 have been exploited in real attacks. The most recent was published on November 10, 2026.

912vulnerabilities
260critical
651high
15exploited
8.7average CVSS score

Latest Mozilla vulnerabilities

  • 9.6 Critical severity

    Firefox: Use After Free

    CVE-2026-117971Mozilla

    Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Concurrent Execution using Shared Resource with Improper Synchronization

    CVE-2026-117970Mozilla

    Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Access of Uninitialized Pointer

    CVE-2026-117969Mozilla

    Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117968Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Protection Mechanism Failure

    CVE-2026-117967Mozilla

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Origin Validation Error

    CVE-2026-117966Mozilla

    Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Origin Validation Error

    CVE-2026-117965Mozilla

    Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117964Mozilla

    Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117963Mozilla

    Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 9.6 Critical severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117962Mozilla

    Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117961Mozilla

    Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Improper Access Control

    CVE-2026-117959Mozilla

    Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Origin Validation Error

    CVE-2026-117958Mozilla

    Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Missing Cryptographic Step

    CVE-2026-117957Mozilla

    Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Access of Uninitialized Pointer

    CVE-2026-117956Mozilla

    Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Access of Resource Using Incompatible Type

    CVE-2026-117955Mozilla

    JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117954Mozilla

    Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117953Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Use of Uninitialized Variable

    CVE-2026-117952Mozilla

    Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117951Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117950Mozilla

    Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117949Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 9.8 Critical severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117946Mozilla

    Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 9.8 Critical severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117945Mozilla

    Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Double Free

    CVE-2026-117943Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 7.3 High severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117942Mozilla

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117941Mozilla

    Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117940Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 7.3 High severity

    Firefox: Access of Uninitialized Pointer

    CVE-2026-117937Mozilla

    Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117936Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117932Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117931Mozilla

    Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117930Mozilla

    Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117929Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Origin Validation Error

    CVE-2026-117928Mozilla

    Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.1 High severity

    Firefox: Improper Restriction of Operations within the Bounds of a Memory Buffer

    CVE-2026-117926Mozilla

    Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117925Mozilla

    Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117922Mozilla

    Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 8.8 High severity

    Firefox: Use After Free

    CVE-2026-117921Mozilla

    Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

  • 9.6 Critical severity

    Firefox: Use After Free

    CVE-2026-117920Mozilla

    Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.