Mozilla has 722 CVEs on record between 2016 and 2026. Disclosure cadence is accelerating: 438 in the last 90 days against 62 in the 90 before. The busiest recent month was October 2026 with 265. The median CVSS is 8.1 (high), with 141 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (108) and CWE-119 (56). Most affected products: Firefox (665), firefox_mobile (30), Thunderbird (19).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —(1)
- Last 90 days
- 438 prev 62
Weakness classes
Products
- Firefox 665
- firefox_mobile 30
- Thunderbird 19
- Firefox for iOS 4
- firefox_focus 2
- Node-convict 1
Worst active — by depth score
CVE-2024-9680Critical· 9.8An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines89CVE-2022-26486Critical· 9.6An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape78CVE-2022-26485High· 8.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free76CVE-2026-74943Critical· 9.8Use-after-free in the Graphics: ImageLib component66CVE-2026-74936Critical· 9.8Use-after-free in the JavaScript: WebAssembly component66
Mozilla vulnerabilities
CVEs affecting Mozilla, newest first. Open any entry for full detail, references, and exploit status.
722 CVEsRSS
CVE-2025-1933High· 7.6On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory
On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a different type. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21,…
CVE-2025-1932High· 8.1An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access
An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, an…
CVE-2025-1931High· 7.5It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash
It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbi…
CVE-2025-1930High· 8.8On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process
On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 1…
CVE-2025-27425Medium· 4.3Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first
Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.
CVE-2025-1940High· 7.1A select option could partially obscure the confirmation prompt shown before launching external apps
A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.…
CVE-2025-1938Medium· 6.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited …
CVE-2025-1937High· 7.5Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could …
CVE-2025-1414Medium· 6.5Memory safety bugs present in Firefox 135
Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Fire…
CVE-2025-1020Critical· 9.8Memory safety bugs present in Firefox 134 and Thunderbird 134
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabili…
CVE-2025-1019Medium· 4.3The z-order of the browser windows could be manipulated to hide the fullscreen notification
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVE-2025-1018Medium· 5.3The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVE-2025-1017Critical· 9.8Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited …
CVE-2025-1016Critical· 9.8Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort …
CVE-2025-1014High· 8.8Certificate length was not properly checked when added to a certificate store
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVE-2025-1013Medium· 6.5A race condition could have led to private browsing tabs being opened in normal browsing windows
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, an…
CVE-2025-1012High· 7.5A race during concurrent delazification could have led to a use-after-free
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVE-2025-1011High· 8.8A bug in WebAssembly code generation could have lead to a crash
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and…
CVE-2025-1010High· 8.8An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbi…
CVE-2025-1009Critical· 9.8An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVE-2025-23109Medium· 6.5Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address
Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.
CVE-2025-23108Medium· 4.3Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab
Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134.
CVE-2025-0247Critical· 9.8Memory safety bugs present in Firefox 133 and Thunderbird 133
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabili…
CVE-2025-0246Medium· 6.5When using an invalid protocol scheme, an attacker could spoof the address bar
When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-024…
CVE-2025-0245Low· 3.3Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixed in Firefox 134.
CVE-2025-0244Medium· 5.3When redirecting to an invalid protocol scheme, an attacker could spoof the address bar
When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.
CVE-2025-0243Medium· 5.1Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited …
CVE-2025-0242Medium· 6.5Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort …
CVE-2025-0241High· 7.7When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash
When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
CVE-2025-0240Medium· 4.0Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 1…