mozilla security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect mozilla products.
Vulnios monitors mozilla CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent mozilla security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2024-3863 — mozilla — firefox, thunderbird
The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability a
criticalCVE-2024-3863Critical Vulnerability: CVE-2026-6771 — mozilla — firefox, thunderbird
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
criticalCVE-2026-6771Critical Vulnerability: CVE-2026-7321 — mozilla — firefox, thunderbird
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
criticalCVE-2026-7321Critical Vulnerability: CVE-2026-41512 — mozilla — 0din_scanner
ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in `BrowserAutomatio
criticalCVE-2026-41512Critical Vulnerability: CVE-2026-12304 — mozilla — firefox, thunderbird
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
criticalCVE-2026-12304Critical Vulnerability: CVE-2026-12316 — mozilla — firefox, thunderbird
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
criticalCVE-2026-12316Critical Vulnerability: CVE-2026-12315 — mozilla — firefox, thunderbird
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
criticalCVE-2026-12315Critical Vulnerability: CVE-2026-6768 — mozilla — firefox, thunderbird
Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
criticalCVE-2026-6768Critical Vulnerability: CVE-2026-6760 — mozilla — firefox, thunderbird
Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
criticalCVE-2026-6760Critical Vulnerability: CVE-2023-29531 — mozilla, apple — firefox, firefox_esr
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for mac
criticalCVE-2023-29531Critical Vulnerability: CVE-2023-34416 — mozilla — firefox, firefox_esr
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these coul
criticalCVE-2023-34416Critical Vulnerability: CVE-2023-29542 — mozilla, microsoft — firefox, firefox_esr
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental exe
criticalCVE-2023-29542Critical Vulnerability: CVE-2025-13021 — mozilla — firefox
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
criticalCVE-2025-13021Critical Vulnerability: CVE-2025-13022 — mozilla — firefox
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
criticalCVE-2025-13022Critical Vulnerability: CVE-2025-13023 — mozilla — firefox
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
criticalCVE-2025-13023Critical Vulnerability: CVE-2025-13024 — mozilla — firefox
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
criticalCVE-2025-13024Critical Vulnerability: CVE-2025-13026 — mozilla — firefox
Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.
criticalCVE-2025-13026Critical Vulnerability: CVE-2026-8950 — mozilla — firefox, thunderbird
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
criticalCVE-2026-8950Critical Vulnerability: CVE-2026-8959 — mozilla — firefox, thunderbird
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
criticalCVE-2026-8959Critical Vulnerability: CVE-2026-8956 — mozilla — firefox, thunderbird
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
criticalCVE-2026-8956Critical Vulnerability: CVE-2026-8953 — mozilla — firefox, thunderbird
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.
criticalCVE-2026-8953Critical Vulnerability: CVE-2025-8031 — mozilla — firefox, thunderbird
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128
criticalCVE-2025-8031Critical Vulnerability: CVE-2025-11717 — mozilla, google — firefox, android
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password
criticalCVE-2025-11717Critical Vulnerability: CVE-2025-14321 — mozilla — firefox, thunderbird
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
criticalCVE-2025-14321Critical Vulnerability: CVE-2025-14324 — mozilla — firefox, thunderbird
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
criticalCVE-2025-14324Critical Vulnerability: CVE-2025-14326 — mozilla — firefox, thunderbird
Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.
criticalCVE-2025-14326Critical Vulnerability: CVE-2025-14330 — mozilla — firefox, thunderbird
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
criticalCVE-2025-14330Critical Vulnerability: CVE-2025-14860 — mozilla — firefox
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.
criticalCVE-2025-14860Critical Vulnerability: CVE-2025-54143 — mozilla — firefox
Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS
criticalCVE-2025-54143Critical Vulnerability: CVE-2025-54145 — mozilla — firefox
The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox f
criticalCVE-2025-54145Critical Vulnerability: CVE-2025-8037 — mozilla — firefox, thunderbird
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerabi
criticalCVE-2025-8037Critical Vulnerability: CVE-2025-8038 — mozilla — firefox, thunderbird
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
criticalCVE-2025-8038Critical Vulnerability: CVE-2025-9179 — mozilla — firefox, thunderbird
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the cont
criticalCVE-2025-9179Critical Vulnerability: CVE-2025-2857 — mozilla — firefox
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to retur
criticalCVE-2025-2857Critical Vulnerability: CVE-2025-49709 — mozilla — firefox
Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.
criticalCVE-2025-49709Critical Vulnerability: CVE-2025-9187 — mozilla — firefox, thunderbird
Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to
criticalCVE-2025-9187Critical Vulnerability: CVE-2026-92240 — mozilla — thunderbird
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachabl
criticalCVE-2026-92240Critical Vulnerability: CVE-2026-92238 — mozilla — thunderbird
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and
criticalCVE-2026-92238Critical Vulnerability: CVE-2026-84639 — mozilla — thunderbird
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
criticalCVE-2026-84639Critical Vulnerability: CVE-2026-84637 — mozilla — thunderbird
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new i
criticalCVE-2026-84637Critical Vulnerability: CVE-2026-84133 — mozilla — firefox, thunderbird
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
criticalCVE-2026-84133Critical Vulnerability: CVE-2026-84143 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we p
criticalCVE-2026-84143Critical Vulnerability: CVE-2026-84129 — mozilla — firefox, thunderbird
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
criticalCVE-2026-84129Critical Vulnerability: CVE-2026-84140 — mozilla — firefox, thunderbird
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
criticalCVE-2026-84140Critical Vulnerability: CVE-2026-84141 — mozilla — firefox, thunderbird
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
criticalCVE-2026-84141Critical Vulnerability: CVE-2026-84142 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could
criticalCVE-2026-84142Critical Vulnerability: CVE-2026-84134 — mozilla — firefox, thunderbird
Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
criticalCVE-2026-84134Critical Vulnerability: CVE-2026-84135 — mozilla — firefox_mobile
Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155.
criticalCVE-2026-84135Critical Vulnerability: CVE-2026-84121 — mozilla — firefox, thunderbird
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbir
criticalCVE-2026-84121Critical Vulnerability: CVE-2026-84119 — mozilla — firefox, thunderbird
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderb
criticalCVE-2026-84119Critical Vulnerability: CVE-2026-74987 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we p
criticalCVE-2026-74987Critical Vulnerability: CVE-2026-74989 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could
criticalCVE-2026-74989Critical Vulnerability: CVE-2026-74988 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough
criticalCVE-2026-74988Critical Vulnerability: CVE-2026-75874 — mozilla — firefox, thunderbird
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and
criticalCVE-2026-75874Critical Vulnerability: CVE-2026-74990 — mozilla — firefox, thunderbird
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we p
criticalCVE-2026-74990Critical Vulnerability: CVE-2026-74986 — mozilla — firefox, thunderbird
Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
criticalCVE-2026-74986Critical Vulnerability: CVE-2026-74985 — mozilla — firefox, thunderbird
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
criticalCVE-2026-74985Critical Vulnerability: CVE-2026-74959 — mozilla — firefox, thunderbird
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
criticalCVE-2026-74959Critical Vulnerability: CVE-2026-74940 — mozilla — firefox, thunderbird
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunder
criticalCVE-2026-74940Critical Vulnerability: CVE-2026-74936 — mozilla — firefox, thunderbird
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
criticalCVE-2026-74936
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track mozilla exposure across your environment
Vulnios automatically cross-references your asset inventory against new mozilla CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan