Mozilla known exploited vulnerabilities
Every Mozilla CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 13 in all, 0 added in the last 12 months.
- CVE-2010-3765Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x bef
- CVE-2024-9680An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.Mozilla Firefox · Mozilla Thunderbird
- CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered.Mozilla Firefox · Mozilla Thunderbird
- CVE-2015-4495The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass
- CVE-2019-11708Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxeMozilla Firefox ESR · Mozilla Firefox +1
- CVE-2019-11707A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.Mozilla Firefox ESR · Mozilla Firefox +1
- CVE-2020-6820Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2020-6819Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free.Mozilla Thunderbird · Mozilla Firefox
- CVE-2019-17026Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2013-1690Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not proper
- CVE-2013-1675Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not proper
- CVE-2022-26486An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.Mozilla Firefox · Mozilla Thunderbird +1
- CVE-2022-26485Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.Mozilla Firefox · Mozilla Thunderbird +1
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many Mozilla vulnerabilities are in CISA KEV?
13 Mozilla vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2010-3765 (Mozilla Multiple Products Remote Code Execution Vulnerability), added 2025-10-06.
Which Mozilla products are in CISA KEV?
4 products, including Multiple Products, Firefox, Firefox, Firefox ESR, and Thunderbird. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Mozilla KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 1 of the 13 Mozilla entries.