| CVE-2026-5731 |
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and…
|
9.8
Critical
|
Apr 7, 2026 |
| CVE-2026-0884 |
Use-after-free in the JavaScript Engine component
|
9.8
Critical
|
Jan 13, 2026 |
| CVE-2026-0879 |
Sandbox escape due to incorrect boundary conditions in the Graphics component
|
9.8
Critical
|
Jan 13, 2026 |
| CVE-2025-14330 |
JIT miscompilation in the JavaScript Engine: JIT component
|
9.8
Critical
|
Dec 9, 2025 |
| CVE-2025-14324 |
JIT miscompilation in the JavaScript Engine: JIT component
|
9.8
Critical
|
Dec 9, 2025 |
| CVE-2025-14321 |
Use-after-free in the WebRTC: Signaling component
|
9.8
Critical
|
Dec 9, 2025 |
| CVE-2025-11708 |
Use-after-free in MediaTrackGraphImpl::GetInstance()
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-11710 |
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks…
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-11709 |
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using…
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-9179 |
An attacker was able to perform memory corruption in the GMP process which processes encrypted media
|
9.8
Critical
|
Aug 19, 2025 |
| CVE-2025-8031 |
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic…
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8038 |
Thunderbird ignored paths when checking the validity of navigations in a frame
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8037 |
Setting a nameless cookie with an equals sign in the value shadowed other cookies
|
9.1
Critical
|
Jul 22, 2025 |
| CVE-2025-8028 |
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction…
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-6424 |
A use-after-free in FontFaceSet resulted in a potentially exploitable crash
|
9.8
Critical
|
Jun 24, 2025 |
| CVE-2025-4918 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object
|
9.8
Critical
|
May 17, 2025 |
| CVE-2025-4083 |
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow…
|
9.1
Critical
|
Apr 29, 2025 |
| CVE-2025-2857 |
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in…
|
10.0
Critical
|
Mar 27, 2025 |
| CVE-2025-1017 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1016 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,…
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1012 |
A race during concurrent delazification could have led to a use-after-free
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1011 |
A bug in WebAssembly code generation could have lead to a crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1010 |
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1009 |
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2024-11698 |
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen…
|
9.8
Critical
|
Nov 26, 2024 |