CVE Daily – Firefox https://cvedaily.com/pages/tags/firefox.html CVE Daily – Firefox en Wed, 03 Jun 2026 21:26:33 +0000 [Medium] CVE-2026-10702 – JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w... https://nvd.nist.gov/vuln/detail/CVE-2026-10702 https://nvd.nist.gov/vuln/detail/CVE-2026-10702 Tue, 02 Jun 2026 20:16:33 +0000 Medium CVE-2026-10702

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

CVSS: 4.3 · CWE: CWE-843

View on NVD

]]> [High] CVE-2026-10701 – Incorrect boundary conditions in the Graphics: Text component. This vulnerabilit... https://nvd.nist.gov/vuln/detail/CVE-2026-10701 https://nvd.nist.gov/vuln/detail/CVE-2026-10701 Tue, 02 Jun 2026 20:16:33 +0000 High CVE-2026-10701

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-9309 – Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadat... https://nvd.nist.gov/vuln/detail/CVE-2026-9309 https://nvd.nist.gov/vuln/detail/CVE-2026-9309 Mon, 01 Jun 2026 13:16:33 +0000 Medium CVE-2026-9309

Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-9308 – Firefox for iOS Reader View replaced page content in its HTML template before re... https://nvd.nist.gov/vuln/detail/CVE-2026-9308 https://nvd.nist.gov/vuln/detail/CVE-2026-9308 Mon, 01 Jun 2026 13:16:33 +0000 Medium CVE-2026-9308

Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2.

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2026-9078 – Firefox for iOS displayed specially crafted right-to-left (RTL) and internationa... https://nvd.nist.gov/vuln/detail/CVE-2026-9078 https://nvd.nist.gov/vuln/detail/CVE-2026-9078 Mon, 25 May 2026 15:16:22 +0000 Medium CVE-2026-9078

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

CVSS: 5.4 · CWE: CWE-451

View on NVD

]]> [Medium] CVE-2026-8706 – Firefox for iOS hosted Reader mode on an unauthenticated local web server, allow... https://nvd.nist.gov/vuln/detail/CVE-2026-8706 https://nvd.nist.gov/vuln/detail/CVE-2026-8706 Tue, 19 May 2026 16:16:22 +0000 Medium CVE-2026-8706

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-8975 – Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox... https://nvd.nist.gov/vuln/detail/CVE-2026-8975 https://nvd.nist.gov/vuln/detail/CVE-2026-8975 Tue, 19 May 2026 14:16:54 +0000 High CVE-2026-8975

Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-8974 – Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these ... https://nvd.nist.gov/vuln/detail/CVE-2026-8974 https://nvd.nist.gov/vuln/detail/CVE-2026-8974 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8974

Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-8973 – Memory safety bugs present in Firefox 150. Some of these bugs showed evidence of... https://nvd.nist.gov/vuln/detail/CVE-2026-8973 https://nvd.nist.gov/vuln/detail/CVE-2026-8973 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8973

Memory safety bugs present in Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-8972 – Privilege escalation in the WebRTC: Audio/Video component. This vulnerability wa... https://nvd.nist.gov/vuln/detail/CVE-2026-8972 https://nvd.nist.gov/vuln/detail/CVE-2026-8972 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8972

Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2026-8971 – Same-origin policy bypass in the Networking: JAR component. This vulnerability w... https://nvd.nist.gov/vuln/detail/CVE-2026-8971 https://nvd.nist.gov/vuln/detail/CVE-2026-8971 Tue, 19 May 2026 14:16:53 +0000 Medium CVE-2026-8971

Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 6.5 · CWE: CWE-346

View on NVD

]]> [High] CVE-2026-8970 – Privilege escalation in the Security component. This vulnerability was fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-8970 https://nvd.nist.gov/vuln/detail/CVE-2026-8970 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8970

Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [High] CVE-2026-8969 – Mitigation bypass in the DOM: Security component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-8969 https://nvd.nist.gov/vuln/detail/CVE-2026-8969 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8969

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 8.1 · CWE: CWE-693

View on NVD

]]> [High] CVE-2026-8968 – Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs componen... https://nvd.nist.gov/vuln/detail/CVE-2026-8968 https://nvd.nist.gov/vuln/detail/CVE-2026-8968 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8968

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-8967 – Information disclosure in the Graphics: WebGPU component. This vulnerability was... https://nvd.nist.gov/vuln/detail/CVE-2026-8967 https://nvd.nist.gov/vuln/detail/CVE-2026-8967 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8967

Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-8966 – Information disclosure in the IP Protection component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-8966 https://nvd.nist.gov/vuln/detail/CVE-2026-8966 Tue, 19 May 2026 14:16:53 +0000 High CVE-2026-8966

Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-8965 – Information disclosure in the DOM: Security component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-8965 https://nvd.nist.gov/vuln/detail/CVE-2026-8965 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8965

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-8964 – Spoofing issue in the Popup Blocker component. This vulnerability was fixed in F... https://nvd.nist.gov/vuln/detail/CVE-2026-8964 https://nvd.nist.gov/vuln/detail/CVE-2026-8964 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8964

Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-451

View on NVD

]]> [High] CVE-2026-8963 – Spoofing issue in the Web Speech component. This vulnerability was fixed in Fire... https://nvd.nist.gov/vuln/detail/CVE-2026-8963 https://nvd.nist.gov/vuln/detail/CVE-2026-8963 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8963

Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-8962 – Mitigation bypass in the DOM: Security component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-8962 https://nvd.nist.gov/vuln/detail/CVE-2026-8962 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8962

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.1 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-8961 – Spoofing issue in the Form Autofill component. This vulnerability was fixed in F... https://nvd.nist.gov/vuln/detail/CVE-2026-8961 https://nvd.nist.gov/vuln/detail/CVE-2026-8961 Tue, 19 May 2026 14:16:52 +0000 Medium CVE-2026-8961

Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 6.5 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-8960 – Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and... https://nvd.nist.gov/vuln/detail/CVE-2026-8960 https://nvd.nist.gov/vuln/detail/CVE-2026-8960 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8960

Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 7.5 · CWE: CWE-290

View on NVD

]]> [Critical] CVE-2026-8959 – Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... https://nvd.nist.gov/vuln/detail/CVE-2026-8959 https://nvd.nist.gov/vuln/detail/CVE-2026-8959 Tue, 19 May 2026 14:16:52 +0000 Critical CVE-2026-8959

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 9.6 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-8958 – Information disclosure, sandbox escape in the Security: Process Sandboxing compo... https://nvd.nist.gov/vuln/detail/CVE-2026-8958 https://nvd.nist.gov/vuln/detail/CVE-2026-8958 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8958

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.6 · CWE: CWE-668

View on NVD

]]> [High] CVE-2026-8957 – Privilege escalation in the Enterprise Policies component. This vulnerability wa... https://nvd.nist.gov/vuln/detail/CVE-2026-8957 https://nvd.nist.gov/vuln/detail/CVE-2026-8957 Tue, 19 May 2026 14:16:52 +0000 High CVE-2026-8957

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Critical] CVE-2026-8956 – Integer overflow in the Networking: JAR component. This vulnerability was fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-8956 https://nvd.nist.gov/vuln/detail/CVE-2026-8956 Tue, 19 May 2026 14:16:51 +0000 Critical CVE-2026-8956

Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 9.8 · CWE: CWE-190

View on NVD

]]> [High] CVE-2026-8955 – Privilege escalation in the DOM: Workers component. This vulnerability was fixed... https://nvd.nist.gov/vuln/detail/CVE-2026-8955 https://nvd.nist.gov/vuln/detail/CVE-2026-8955 Tue, 19 May 2026 14:16:51 +0000 High CVE-2026-8955

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [High] CVE-2026-8954 – Incorrect boundary conditions, integer overflow in the Audio/Video component. Th... https://nvd.nist.gov/vuln/detail/CVE-2026-8954 https://nvd.nist.gov/vuln/detail/CVE-2026-8954 Tue, 19 May 2026 14:16:51 +0000 High CVE-2026-8954

Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [Critical] CVE-2026-8953 – Sandbox escape due to use-after-free in the Disability Access APIs component. Th... https://nvd.nist.gov/vuln/detail/CVE-2026-8953 https://nvd.nist.gov/vuln/detail/CVE-2026-8953 Tue, 19 May 2026 14:16:51 +0000 Critical CVE-2026-8953

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 9.6 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-8952 – Privilege escalation in the Application Update component. This vulnerability was... https://nvd.nist.gov/vuln/detail/CVE-2026-8952 https://nvd.nist.gov/vuln/detail/CVE-2026-8952 Tue, 19 May 2026 14:16:51 +0000 High CVE-2026-8952

Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Medium] CVE-2026-8951 – Spoofing issue in the Toolbar component in Firefox for Android. This vulnerabili... https://nvd.nist.gov/vuln/detail/CVE-2026-8951 https://nvd.nist.gov/vuln/detail/CVE-2026-8951 Tue, 19 May 2026 14:16:51 +0000 Medium CVE-2026-8951

Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

CVSS: 6.5 · CWE: CWE-290

View on NVD

]]> [Critical] CVE-2026-8950 – Same-origin policy bypass in the Networking: HTTP component. This vulnerability ... https://nvd.nist.gov/vuln/detail/CVE-2026-8950 https://nvd.nist.gov/vuln/detail/CVE-2026-8950 Tue, 19 May 2026 14:16:51 +0000 Critical CVE-2026-8950

Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 9.3 · CWE: CWE-346

View on NVD

]]> [High] CVE-2026-8949 – Integer overflow in the Widget: Win32 component. This vulnerability was fixed in... https://nvd.nist.gov/vuln/detail/CVE-2026-8949 https://nvd.nist.gov/vuln/detail/CVE-2026-8949 Tue, 19 May 2026 14:16:51 +0000 High CVE-2026-8949

Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 7.5 · CWE: CWE-190

View on NVD

]]> [Critical] CVE-2026-8948 – Same-origin policy bypass in the DOM: Networking component. This vulnerability w... https://nvd.nist.gov/vuln/detail/CVE-2026-8948 https://nvd.nist.gov/vuln/detail/CVE-2026-8948 Tue, 19 May 2026 14:16:51 +0000 Critical CVE-2026-8948

Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVSS: 9.1 · CWE: CWE-942

View on NVD

]]> [High] CVE-2026-8947 – Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was f... https://nvd.nist.gov/vuln/detail/CVE-2026-8947 https://nvd.nist.gov/vuln/detail/CVE-2026-8947 Tue, 19 May 2026 14:16:50 +0000 High CVE-2026-8947

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 7.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-8946 – Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vul... https://nvd.nist.gov/vuln/detail/CVE-2026-8946 https://nvd.nist.gov/vuln/detail/CVE-2026-8946 Tue, 19 May 2026 14:16:50 +0000 High CVE-2026-8946

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-8945 – Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was ... https://nvd.nist.gov/vuln/detail/CVE-2026-8945 https://nvd.nist.gov/vuln/detail/CVE-2026-8945 Tue, 19 May 2026 14:16:50 +0000 High CVE-2026-8945

Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.

CVSS: 7.5 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-42177 – linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prio... https://nvd.nist.gov/vuln/detail/CVE-2026-42177 https://nvd.nist.gov/vuln/detail/CVE-2026-42177 Tue, 12 May 2026 18:17:24 +0000 Medium CVE-2026-42177

linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter is Platform.SSO_URL + "/*", i.e. "https://login.microsoftonline.com/*". Chrome's urlFilter without a | or || anchor is substring-matched against the full request URL. The same applied rule action is mo…

CVSS: 5.3 · CWE: CWE-284

View on NVD

]]> [Critical] CVE-2026-8401 – Sandbox escape in the Profile Backup component. This vulnerability was fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-8401 https://nvd.nist.gov/vuln/detail/CVE-2026-8401 Tue, 12 May 2026 15:16:20 +0000 Critical CVE-2026-8401

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

CVSS: 9.8 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-8391 – Other issue in the JavaScript Engine component. This vulnerability was fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-8391 https://nvd.nist.gov/vuln/detail/CVE-2026-8391 Tue, 12 May 2026 14:17:12 +0000 Medium CVE-2026-8391

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

CVSS: 5.3 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-8390 – Use-after-free in the JavaScript: WebAssembly component. This vulnerability was ... https://nvd.nist.gov/vuln/detail/CVE-2026-8390 https://nvd.nist.gov/vuln/detail/CVE-2026-8390 Tue, 12 May 2026 14:17:12 +0000 High CVE-2026-8390

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

CVSS: 7.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-8389 – JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability w... https://nvd.nist.gov/vuln/detail/CVE-2026-8389 https://nvd.nist.gov/vuln/detail/CVE-2026-8389 Tue, 12 May 2026 14:17:11 +0000 High CVE-2026-8389

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-8388 – Incorrect boundary conditions in the JavaScript Engine: JIT component. This vuln... https://nvd.nist.gov/vuln/detail/CVE-2026-8388 https://nvd.nist.gov/vuln/detail/CVE-2026-8388 Tue, 12 May 2026 14:17:11 +0000 Medium CVE-2026-8388

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-44659 – Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly t... https://nvd.nist.gov/vuln/detail/CVE-2026-44659 https://nvd.nist.gov/vuln/detail/CVE-2026-44659 Mon, 11 May 2026 18:16:38 +0000 Medium CVE-2026-44659

Zen is a firefox-based browser. Prior to 1.19.12b, the ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, mi…

CVSS: 4.7 · CWE: CWE-451

View on NVD

]]> [Low] CVE-2026-44658 – Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the ... https://nvd.nist.gov/vuln/detail/CVE-2026-44658 https://nvd.nist.gov/vuln/detail/CVE-2026-44658 Mon, 11 May 2026 18:16:38 +0000 Low CVE-2026-44658

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these va…

CVSS: 2.4 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-41431 – Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Ap... https://nvd.nist.gov/vuln/detail/CVE-2026-41431 https://nvd.nist.gov/vuln/detail/CVE-2026-41431 Mon, 11 May 2026 18:16:34 +0000 High CVE-2026-41431

Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files served to users contain zero cryptographic signatures, and the updater binary contains zero cryptographic verification code. This eliminates the defens…

CVSS: 8.0 · CWE: CWE-347

View on NVD

]]> [Critical] CVE-2026-8094 – Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR... https://nvd.nist.gov/vuln/detail/CVE-2026-8094 https://nvd.nist.gov/vuln/detail/CVE-2026-8094 Thu, 07 May 2026 13:16:14 +0000 Critical CVE-2026-8094

Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

CVSS: 9.8 · CWE: CWE-94

View on NVD

]]> [High] CVE-2026-8093 – Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidenc... https://nvd.nist.gov/vuln/detail/CVE-2026-8093 https://nvd.nist.gov/vuln/detail/CVE-2026-8093 Thu, 07 May 2026 13:16:14 +0000 High CVE-2026-8093

Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.

CVSS: 8.1 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-8092 – Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Fir... https://nvd.nist.gov/vuln/detail/CVE-2026-8092 https://nvd.nist.gov/vuln/detail/CVE-2026-8092 Thu, 07 May 2026 13:16:14 +0000 High CVE-2026-8092

Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

CVSS: 8.1 · CWE: CWE-125

View on NVD

]]> [Critical] CVE-2026-8091 – Incorrect boundary conditions in the Audio/Video: Playback component. This vulne... https://nvd.nist.gov/vuln/detail/CVE-2026-8091 https://nvd.nist.gov/vuln/detail/CVE-2026-8091 Thu, 07 May 2026 13:16:14 +0000 Critical CVE-2026-8091

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

CVSS: 9.8 · CWE: CWE-754

View on NVD

]]> [High] CVE-2026-8090 – Use-after-free in the DOM: Networking component. This vulnerability was fixed in... https://nvd.nist.gov/vuln/detail/CVE-2026-8090 https://nvd.nist.gov/vuln/detail/CVE-2026-8090 Thu, 07 May 2026 13:16:13 +0000 High CVE-2026-8090

Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

CVSS: 7.3 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-7324 – Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evi... https://nvd.nist.gov/vuln/detail/CVE-2026-7324 https://nvd.nist.gov/vuln/detail/CVE-2026-7324 Tue, 28 Apr 2026 15:16:37 +0000 High CVE-2026-7324

Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-7323 – Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. ... https://nvd.nist.gov/vuln/detail/CVE-2026-7323 https://nvd.nist.gov/vuln/detail/CVE-2026-7323 Tue, 28 Apr 2026 15:16:37 +0000 High CVE-2026-7323

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-7322 – Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. ... https://nvd.nist.gov/vuln/detail/CVE-2026-7322 https://nvd.nist.gov/vuln/detail/CVE-2026-7322 Tue, 28 Apr 2026 15:16:37 +0000 High CVE-2026-7322

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [Critical] CVE-2026-7321 – Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking co... https://nvd.nist.gov/vuln/detail/CVE-2026-7321 https://nvd.nist.gov/vuln/detail/CVE-2026-7321 Tue, 28 Apr 2026 15:16:37 +0000 Critical CVE-2026-7321

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.

CVSS: 9.6 · CWE: CWE-120

View on NVD

]]> [High] CVE-2026-7320 – Information disclosure due to incorrect boundary conditions in the Audio/Video c... https://nvd.nist.gov/vuln/detail/CVE-2026-7320 https://nvd.nist.gov/vuln/detail/CVE-2026-7320 Tue, 28 Apr 2026 15:16:37 +0000 High CVE-2026-7320

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

CVSS: 7.5 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-6786 – Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox ... https://nvd.nist.gov/vuln/detail/CVE-2026-6786 https://nvd.nist.gov/vuln/detail/CVE-2026-6786 Sun, 26 Apr 2026 19:53:39 +0000 High CVE-2026-6786

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-6785 – Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird... https://nvd.nist.gov/vuln/detail/CVE-2026-6785 https://nvd.nist.gov/vuln/detail/CVE-2026-6785 Sun, 26 Apr 2026 19:53:39 +0000 High CVE-2026-6785

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbir…

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [High] CVE-2026-6784 – Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bug... https://nvd.nist.gov/vuln/detail/CVE-2026-6784 https://nvd.nist.gov/vuln/detail/CVE-2026-6784 Tue, 21 Apr 2026 13:16:24 +0000 High CVE-2026-6784

Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-125

View on NVD

]]> [Medium] CVE-2026-6783 – Incorrect boundary conditions, integer overflow in the Audio/Video: Playback com... https://nvd.nist.gov/vuln/detail/CVE-2026-6783 https://nvd.nist.gov/vuln/detail/CVE-2026-6783 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6783

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.3 · CWE: CWE-190

View on NVD

]]> [High] CVE-2026-6782 – Information disclosure in the IP Protection component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6782 https://nvd.nist.gov/vuln/detail/CVE-2026-6782 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6782

Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-6781 – Denial-of-service in the Audio/Video: Playback component. This vulnerability was... https://nvd.nist.gov/vuln/detail/CVE-2026-6781 https://nvd.nist.gov/vuln/detail/CVE-2026-6781 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6781

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [High] CVE-2026-6780 – Denial-of-service in the Audio/Video: Playback component. This vulnerability was... https://nvd.nist.gov/vuln/detail/CVE-2026-6780 https://nvd.nist.gov/vuln/detail/CVE-2026-6780 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6780

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-400

View on NVD

]]> [Medium] CVE-2026-6779 – Other issue in the JavaScript Engine component. This vulnerability was fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-6779 https://nvd.nist.gov/vuln/detail/CVE-2026-6779 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6779

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.3 · CWE: CWE-20

View on NVD

]]> [Medium] CVE-2026-6778 – Invalid pointer in the Audio/Video: Playback component. This vulnerability was f... https://nvd.nist.gov/vuln/detail/CVE-2026-6778 https://nvd.nist.gov/vuln/detail/CVE-2026-6778 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6778

Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.3 · CWE: CWE-476

View on NVD

]]> [Medium] CVE-2026-6777 – Other issue in the Networking: DNS component. This vulnerability was fixed in Fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6777 https://nvd.nist.gov/vuln/detail/CVE-2026-6777 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6777

Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.3 · CWE: CWE-20

View on NVD

]]> [High] CVE-2026-6776 – Incorrect boundary conditions in the WebRTC: Networking component. This vulnerab... https://nvd.nist.gov/vuln/detail/CVE-2026-6776 https://nvd.nist.gov/vuln/detail/CVE-2026-6776 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6776

Incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.8 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-6775 – Incorrect boundary conditions in the WebRTC component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6775 https://nvd.nist.gov/vuln/detail/CVE-2026-6775 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6775

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.3 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-6774 – Mitigation bypass in the DOM: Security component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6774 https://nvd.nist.gov/vuln/detail/CVE-2026-6774 Tue, 21 Apr 2026 13:16:23 +0000 Medium CVE-2026-6774

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 5.4 · CWE: CWE-693

View on NVD

]]> [High] CVE-2026-6773 – Denial-of-service due to integer overflow in the Graphics: WebGPU component. Thi... https://nvd.nist.gov/vuln/detail/CVE-2026-6773 https://nvd.nist.gov/vuln/detail/CVE-2026-6773 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6773

Denial-of-service due to integer overflow in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-190

View on NVD

]]> [High] CVE-2026-6772 – Incorrect boundary conditions in the Libraries component in NSS. This vulnerabil... https://nvd.nist.gov/vuln/detail/CVE-2026-6772 https://nvd.nist.gov/vuln/detail/CVE-2026-6772 Tue, 21 Apr 2026 13:16:23 +0000 High CVE-2026-6772

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-754

View on NVD

]]> [Critical] CVE-2026-6771 – Mitigation bypass in the DOM: Security component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6771 https://nvd.nist.gov/vuln/detail/CVE-2026-6771 Tue, 21 Apr 2026 13:16:22 +0000 Critical CVE-2026-6771

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 9.8 · CWE: CWE-288

View on NVD

]]> [Medium] CVE-2026-6770 – Other issue in the Storage: IndexedDB component. This vulnerability was fixed in... https://nvd.nist.gov/vuln/detail/CVE-2026-6770 https://nvd.nist.gov/vuln/detail/CVE-2026-6770 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6770

Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 6.5 · CWE: CWE-200

View on NVD

]]> [High] CVE-2026-6769 – Privilege escalation in the Debugger component. This vulnerability was fixed in ... https://nvd.nist.gov/vuln/detail/CVE-2026-6769 https://nvd.nist.gov/vuln/detail/CVE-2026-6769 Tue, 21 Apr 2026 13:16:22 +0000 High CVE-2026-6769

Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Critical] CVE-2026-6768 – Mitigation bypass in the Networking: Cookies component. This vulnerability was f... https://nvd.nist.gov/vuln/detail/CVE-2026-6768 https://nvd.nist.gov/vuln/detail/CVE-2026-6768 Tue, 21 Apr 2026 13:16:22 +0000 Critical CVE-2026-6768

Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 9.8 · CWE: CWE-288

View on NVD

]]> [Medium] CVE-2026-6767 – Other issue in the Libraries component in NSS. This vulnerability was fixed in F... https://nvd.nist.gov/vuln/detail/CVE-2026-6767 https://nvd.nist.gov/vuln/detail/CVE-2026-6767 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6767

Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 5.3 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-6766 – Incorrect boundary conditions in the Libraries component in NSS. This vulnerabil... https://nvd.nist.gov/vuln/detail/CVE-2026-6766 https://nvd.nist.gov/vuln/detail/CVE-2026-6766 Tue, 21 Apr 2026 13:16:22 +0000 High CVE-2026-6766

Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-754

View on NVD

]]> [Medium] CVE-2026-6765 – Information disclosure in the Form Autofill component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6765 https://nvd.nist.gov/vuln/detail/CVE-2026-6765 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6765

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 5.3 · CWE: CWE-359

View on NVD

]]> [Medium] CVE-2026-6764 – Incorrect boundary conditions in the DOM: Device Interfaces component. This vuln... https://nvd.nist.gov/vuln/detail/CVE-2026-6764 https://nvd.nist.gov/vuln/detail/CVE-2026-6764 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6764

Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 6.5 · CWE: CWE-119

View on NVD

]]> [Medium] CVE-2026-6763 – Mitigation bypass in the File Handling component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6763 https://nvd.nist.gov/vuln/detail/CVE-2026-6763 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6763

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 6.5 · CWE: CWE-693

View on NVD

]]> [Medium] CVE-2026-6762 – Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6762 https://nvd.nist.gov/vuln/detail/CVE-2026-6762 Tue, 21 Apr 2026 13:16:22 +0000 Medium CVE-2026-6762

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 6.3 · CWE: CWE-290

View on NVD

]]> [High] CVE-2026-6761 – Privilege escalation in the Networking component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6761 https://nvd.nist.gov/vuln/detail/CVE-2026-6761 Tue, 21 Apr 2026 13:16:22 +0000 High CVE-2026-6761

Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [Critical] CVE-2026-6760 – Mitigation bypass in the Networking: Cookies component. This vulnerability was f... https://nvd.nist.gov/vuln/detail/CVE-2026-6760 https://nvd.nist.gov/vuln/detail/CVE-2026-6760 Tue, 21 Apr 2026 13:16:21 +0000 Critical CVE-2026-6760

Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 9.8 · CWE: CWE-288

View on NVD

]]> [High] CVE-2026-6759 – Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in F... https://nvd.nist.gov/vuln/detail/CVE-2026-6759 https://nvd.nist.gov/vuln/detail/CVE-2026-6759 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6759

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-6758 – Use-after-free in the JavaScript: WebAssembly component. This vulnerability was ... https://nvd.nist.gov/vuln/detail/CVE-2026-6758 https://nvd.nist.gov/vuln/detail/CVE-2026-6758 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6758

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Medium] CVE-2026-6757 – Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was... https://nvd.nist.gov/vuln/detail/CVE-2026-6757 https://nvd.nist.gov/vuln/detail/CVE-2026-6757 Tue, 21 Apr 2026 13:16:21 +0000 Medium CVE-2026-6757

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 6.3 · CWE: CWE-824

View on NVD

]]> [High] CVE-2026-6756 – Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefo... https://nvd.nist.gov/vuln/detail/CVE-2026-6756 https://nvd.nist.gov/vuln/detail/CVE-2026-6756 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6756

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.

CVSS: 7.5 · CWE: CWE-200

View on NVD

]]> [Medium] CVE-2026-6755 – Mitigation bypass in the DOM: postMessage component. This vulnerability was fixe... https://nvd.nist.gov/vuln/detail/CVE-2026-6755 https://nvd.nist.gov/vuln/detail/CVE-2026-6755 Tue, 21 Apr 2026 13:16:21 +0000 Medium CVE-2026-6755

Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVSS: 6.5 · CWE: CWE-352

View on NVD

]]> [High] CVE-2026-6754 – Use-after-free in the JavaScript Engine component. This vulnerability was fixed ... https://nvd.nist.gov/vuln/detail/CVE-2026-6754 https://nvd.nist.gov/vuln/detail/CVE-2026-6754 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6754

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-6753 – Incorrect boundary conditions in the WebRTC component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6753 https://nvd.nist.gov/vuln/detail/CVE-2026-6753 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6753

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-6752 – Incorrect boundary conditions in the WebRTC component. This vulnerability was fi... https://nvd.nist.gov/vuln/detail/CVE-2026-6752 https://nvd.nist.gov/vuln/detail/CVE-2026-6752 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6752

Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.3 · CWE: CWE-119

View on NVD

]]> [High] CVE-2026-6751 – Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerabilit... https://nvd.nist.gov/vuln/detail/CVE-2026-6751 https://nvd.nist.gov/vuln/detail/CVE-2026-6751 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6751

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.3 · CWE: CWE-457

View on NVD

]]> [High] CVE-2026-6750 – Privilege escalation in the Graphics: WebRender component. This vulnerability wa... https://nvd.nist.gov/vuln/detail/CVE-2026-6750 https://nvd.nist.gov/vuln/detail/CVE-2026-6750 Tue, 21 Apr 2026 13:16:21 +0000 High CVE-2026-6750

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 8.8 · CWE: CWE-269

View on NVD

]]> [High] CVE-2026-6749 – Information disclosure due to uninitialized memory in the Graphics: Canvas2D com... https://nvd.nist.gov/vuln/detail/CVE-2026-6749 https://nvd.nist.gov/vuln/detail/CVE-2026-6749 Tue, 21 Apr 2026 13:16:20 +0000 High CVE-2026-6749

Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-908

View on NVD

]]> [Critical] CVE-2026-6748 – Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerabilit... https://nvd.nist.gov/vuln/detail/CVE-2026-6748 https://nvd.nist.gov/vuln/detail/CVE-2026-6748 Tue, 21 Apr 2026 13:16:20 +0000 Critical CVE-2026-6748

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 9.8 · CWE: CWE-457

View on NVD

]]> [High] CVE-2026-6747 – Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox ... https://nvd.nist.gov/vuln/detail/CVE-2026-6747 https://nvd.nist.gov/vuln/detail/CVE-2026-6747 Tue, 21 Apr 2026 13:16:20 +0000 High CVE-2026-6747

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [High] CVE-2026-6746 – Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed i... https://nvd.nist.gov/vuln/detail/CVE-2026-6746 https://nvd.nist.gov/vuln/detail/CVE-2026-6746 Tue, 21 Apr 2026 13:16:20 +0000 High CVE-2026-6746

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

CVSS: 7.5 · CWE: CWE-416

View on NVD

]]> [Critical] CVE-2026-5735 – Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t... https://nvd.nist.gov/vuln/detail/CVE-2026-5735 https://nvd.nist.gov/vuln/detail/CVE-2026-5735 Tue, 07 Apr 2026 13:16:47 +0000 Critical CVE-2026-5735

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

CVSS: 9.8 · CWE: CWE-787

View on NVD

]]> [Critical] CVE-2026-5734 – Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire... https://nvd.nist.gov/vuln/detail/CVE-2026-5734 https://nvd.nist.gov/vuln/detail/CVE-2026-5734 Tue, 07 Apr 2026 13:16:47 +0000 Critical CVE-2026-5734

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

CVSS: 9.8 · CWE: CWE-787

View on NVD

]]> [High] CVE-2026-5733 – Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerabil... https://nvd.nist.gov/vuln/detail/CVE-2026-5733 https://nvd.nist.gov/vuln/detail/CVE-2026-5733 Tue, 07 Apr 2026 13:16:47 +0000 High CVE-2026-5733

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

CVSS: 8.8 · CWE: CWE-119

View on NVD

]]>