VulnSea

firefox vulnerabilities

CVEs whose affected-version data names the firefox package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

671 CVEsRSS

CVE-2026-117872None
1w ago

Use-after-free in the JavaScript: Standard Library component

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117879None
1w ago

Incorrect boundary conditions in the Layout: Tables component

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117876None
1w ago

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117878None
1w ago

Other issue, use-after-free in the Storage: IndexedDB component

Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117868None
1w ago

Sandbox escape in the DOM: Networking component

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117863None
1w ago

Information disclosure due to uninitialized memory in the Audio/Video component

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117873None
1w ago

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117862None
1w ago

Privilege escalation due to incorrect boundary conditions in the Networking component

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117871None
1w ago

Invalid pointer in the Graphics component

Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117870None
1w ago

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117869None
1w ago

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117867None
1w ago

Use-after-free in the Layout component

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117866None
1w ago

Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117861None
1w ago

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117865None
1w ago

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117864None
1w ago

Sandbox escape in the Form Manager component

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-117860None
1w ago

Same-origin policy bypass in the DOM: Navigation component

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

▾ SunlitMozilla · Firefoxvia CVEORG
CVE-2026-113399Critical· 9.8
2w ago

Incorrect boundary conditions in the SVG component

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

▾ MidnightMozilla · FirefoxEPSS 0.49%via CVEORG
CVE-2026-113470Medium· 5.4
2w ago

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 15…

▾ SunlitMozilla · FirefoxEPSS 0.46%via CVEORG
CVE-2026-113400Medium· 5.4
2w ago

Uninitialized memory in the Audio/Video: cubeb component

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

▾ SunlitMozilla · FirefoxEPSS 0.26%via CVEORG
CVE-2026-113401Medium· 6.5
2w ago

Denial-of-service in the PDF Viewer component

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

▾ SunlitMozilla · FirefoxEPSS 0.35%via CVEORG
CVE-2026-109783High· 8.3
3w ago

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.

▾ TwilightMozilla · FirefoxEPSS 0.27%via NVD
CVE-2026-109782High· 8.3
3w ago

Mitigation bypass in the File Handling component

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5.

▾ TwilightMozilla · FirefoxEPSS 0.27%via NVD
CVE-2026-109781Medium· 6.5
3w ago

Denial-of-service in the Printing: Output component

Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

▾ SunlitMozilla · FirefoxEPSS 0.25%via NVD
CVE-2026-109780Critical· 9.8
3w ago

Mitigation bypass in the DOM: Core & HTML component

Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

▾ MidnightMozilla · FirefoxEPSS 0.36%via NVD
CVE-2026-109779Medium· 4.2
3w ago

Race condition in the Networking: DNS component

Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

▾ SunlitMozilla · FirefoxEPSS 0.14%via NVD
CVE-2026-109778High· 8.8
3w ago

Privilege escalation in the WebExtensions component

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

▾ TwilightMozilla · FirefoxEPSS 0.28%via NVD
CVE-2026-109777Medium· 4.3
3w ago

Information disclosure in the Storage: IndexedDB component

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

▾ SunlitMozilla · FirefoxEPSS 0.21%via NVD
CVE-2026-109776Medium· 4.2
3w ago

Race condition in the XPCOM component

Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

▾ SunlitMozilla · FirefoxEPSS 0.14%via NVD
CVE-2026-109775Medium· 6.5
3w ago

Denial-of-service in the WebRTC component

Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

▾ SunlitMozilla · FirefoxEPSS 0.25%via NVD
firefox vulnerabilities (CVEs) — page 6 · VulnSea