Mozilla has 722 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 438 in the last 90 days against 62 in the 90 before. The busiest recent month was October 2026 with 265. The median CVSS is 8.1 (high), with 141 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (108) and CWE-119 (56). Most affected products: Firefox (665), firefox_mobile (30), Thunderbird (19).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 8.1
Publish → KEV: —(1)
Last 90 days: 438 prev 62

Weakness classes

Products

Firefox 665
firefox_mobile 30
Thunderbird 19
Firefox for iOS 4
firefox_focus 2
Node-convict 1

Follow Mozilla:RSS feed Save a search →Embed badge ↗

722

Total CVEs

141

Critical

CISA KEV

Exploited

Worst active — by depth score

Mozilla vulnerabilities

CVEs affecting Mozilla, newest first. Open any entry for full detail, references, and exploit status.

722 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Mozilla vulnerabilities

On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack

Memory safety bugs present in Firefox 139 and Thunderbird 139

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete

When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `&lt;embed&gt;` or `&lt;object&gt;` tag, potentially making a website vulnerable to a cross-site scrip…

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android

An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments

The executable file warning did not warn users before opening files with the `terminal` extension

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles

A use-after-free in FontFaceSet resulted in a potentially exploitable crash

Certain canvas operations could have lead to memory corruption

An integer overflow was present in `OrderedHashTable` used by the JavaScript engine

Memory safety bugs present in Firefox 138 and Thunderbird 138

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks

In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled

Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks

Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firef…

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks

Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes

An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scrip…