Mozilla has 722 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 438 in the last 90 days against 62 in the 90 before. The busiest recent month was October 2026 with 265. The median CVSS is 8.1 (high), with 141 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (108) and CWE-119 (56). Most affected products: Firefox (665), firefox_mobile (30), Thunderbird (19).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 8.1
Publish → KEV: —(1)
Last 90 days: 438 prev 62

Weakness classes

Products

Firefox 665
firefox_mobile 30
Thunderbird 19
Firefox for iOS 4
firefox_focus 2
Node-convict 1

Follow Mozilla:RSS feed Save a search →Embed badge ↗

722

Total CVEs

141

Critical

CISA KEV

Exploited

Worst active — by depth score

Mozilla vulnerabilities

CVEs affecting Mozilla, newest first. Open any entry for full detail, references, and exploit status.

722 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Mozilla vulnerabilities

Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9

Memory safety bugs present in Firefox 137 and Thunderbird 137

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat

Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system

A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android

An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges

Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefo…

A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox e…

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition

By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt

After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free

Memory safety bugs present in Firefox 136 and Thunderbird 136

Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks

An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function

Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245)

Android apps can load web pages using the Custom Tabs feature

jar: URLs retrieve local file content packaged in a ZIP archive

A web page could trick a user into setting that site as the default handler for a custom URL protocol

It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it