Mozilla vulnerabilities
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-126136OAuth2 access token could be sent over an unencrypted connection with Exchange accounts
- CVE-2026-126135SMTP and POP3 response injection when using STARTTLS
- CVE-2026-126134Feed subscriptions could leak NTLM credentials on Windows
- CVE-2026-126133Calendar server credentials could be sent to an HTTP proxy
- CVE-2026-126132Attachments could be replaced with local file content when forwarding
- CVE-2026-124952Use-after-free in the Audio/Video component
- CVE-2026-124950Same-origin policy bypass in the CSS Parsing and Computation component
- CVE-2026-124949Other issue in the SVG component
- CVE-2026-124947Incorrect boundary conditions in the Graphics component
- CVE-2026-124946Invalid pointer in the JavaScript Engine: JIT component
- CVE-2026-124945Invalid pointer in the Layout: Text and Fonts component
- CVE-2026-124944Information disclosure in the Marionette component
- CVE-2026-124943Use-after-free in the Layout component
- CVE-2026-124937Other issue in the Media component in Firefox for Android
- CVE-2026-124936Spoofing issue in the Address Bar component
- CVE-2026-124928Mitigation bypass in the SVG component
- CVE-2026-124925Information disclosure in the Layout component
- CVE-2026-124923Sandbox escape in the Agent component
- CVE-2026-124921Sandbox escape in the Graphics: WebGPU component
- CVE-2026-124920Uninitialized memory in the Graphics: WebGPU component
- CVE-2026-124911Clickjacking issue in the Autofill component in Firefox for Android
- CVE-2026-124908Use-after-free in the CSS Parsing and Computation component
- CVE-2026-124904Use-after-free in the SVG component
- CVE-2026-124900Sandbox escape due to use-after-free in the DOM: Service Workers component
- CVE-2026-124878Use-after-free in the Layout: Positioned component
- CVE-2026-124871Use-after-free in the DOM: HTML Parser component
- CVE-2026-124867Use-after-free in the DOM: Editor component
- CVE-2026-124852Incorrect boundary conditions in the Graphics: CanvasWebGL component
- CVE-2026-124951Privilege escalation in the Nimbus Desktop Client component
- CVE-2026-124948Incorrect boundary conditions, use-after-free in the Graphics component