# cve.now: Mozilla The newest entries naming Mozilla as an affected vendor (up to 200), of 2,561 in all, 9 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-126136](https://cve.now/CVE-2026-126136.md): OAuth2 access token could be sent over an unencrypted connection with Exchange accounts (no CVSS) - [CVE-2026-126135](https://cve.now/CVE-2026-126135.md): SMTP and POP3 response injection when using STARTTLS (no CVSS) - [CVE-2026-126134](https://cve.now/CVE-2026-126134.md): Feed subscriptions could leak NTLM credentials on Windows (no CVSS) - [CVE-2026-126133](https://cve.now/CVE-2026-126133.md): Calendar server credentials could be sent to an HTTP proxy (no CVSS) - [CVE-2026-126132](https://cve.now/CVE-2026-126132.md): Attachments could be replaced with local file content when forwarding (no CVSS) - [CVE-2026-124952](https://cve.now/CVE-2026-124952.md): Use-after-free in the Audio/Video component (CVSS 8.8) - [CVE-2026-124950](https://cve.now/CVE-2026-124950.md): Same-origin policy bypass in the CSS Parsing and Computation component (no CVSS) - [CVE-2026-124949](https://cve.now/CVE-2026-124949.md): Other issue in the SVG component (no CVSS) - [CVE-2026-124947](https://cve.now/CVE-2026-124947.md): Incorrect boundary conditions in the Graphics component (CVSS 8.8) - [CVE-2026-124946](https://cve.now/CVE-2026-124946.md): Invalid pointer in the JavaScript Engine: JIT component (no CVSS) - [CVE-2026-124945](https://cve.now/CVE-2026-124945.md): Invalid pointer in the Layout: Text and Fonts component (no CVSS) - [CVE-2026-124944](https://cve.now/CVE-2026-124944.md): Information disclosure in the Marionette component (CVSS 4.3) - [CVE-2026-124943](https://cve.now/CVE-2026-124943.md): Use-after-free in the Layout component (CVSS 8.8) - [CVE-2026-124937](https://cve.now/CVE-2026-124937.md): Other issue in the Media component in Firefox for Android (no CVSS) - [CVE-2026-124936](https://cve.now/CVE-2026-124936.md): Spoofing issue in the Address Bar component (no CVSS) - [CVE-2026-124928](https://cve.now/CVE-2026-124928.md): Mitigation bypass in the SVG component (no CVSS) - [CVE-2026-124925](https://cve.now/CVE-2026-124925.md): Information disclosure in the Layout component (CVSS 4.3) - [CVE-2026-124923](https://cve.now/CVE-2026-124923.md): Sandbox escape in the Agent component (no CVSS) - [CVE-2026-124921](https://cve.now/CVE-2026-124921.md): Sandbox escape in the Graphics: WebGPU component (no CVSS) - [CVE-2026-124920](https://cve.now/CVE-2026-124920.md): Uninitialized memory in the Graphics: WebGPU component (no CVSS) - [CVE-2026-124911](https://cve.now/CVE-2026-124911.md): Clickjacking issue in the Autofill component in Firefox for Android (no CVSS) - [CVE-2026-124908](https://cve.now/CVE-2026-124908.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-124904](https://cve.now/CVE-2026-124904.md): Use-after-free in the SVG component (CVSS 8.8) - [CVE-2026-124900](https://cve.now/CVE-2026-124900.md): Sandbox escape due to use-after-free in the DOM: Service Workers component (CVSS 9.6) - [CVE-2026-124878](https://cve.now/CVE-2026-124878.md): Use-after-free in the Layout: Positioned component (CVSS 8.8) - [CVE-2026-124871](https://cve.now/CVE-2026-124871.md): Use-after-free in the DOM: HTML Parser component (CVSS 8.8) - [CVE-2026-124867](https://cve.now/CVE-2026-124867.md): Use-after-free in the DOM: Editor component (CVSS 8.8) - [CVE-2026-124852](https://cve.now/CVE-2026-124852.md): Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8) - [CVE-2026-124951](https://cve.now/CVE-2026-124951.md): Privilege escalation in the Nimbus Desktop Client component (no CVSS) - [CVE-2026-124948](https://cve.now/CVE-2026-124948.md): Incorrect boundary conditions, use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-124942](https://cve.now/CVE-2026-124942.md): Invalid pointer in the DOM: Streams component (no CVSS) - [CVE-2026-124941](https://cve.now/CVE-2026-124941.md): Information disclosure in the Security: RLBox component (CVSS 4.3) - [CVE-2026-124940](https://cve.now/CVE-2026-124940.md): Mitigation bypass in the File Handling component (no CVSS) - [CVE-2026-124939](https://cve.now/CVE-2026-124939.md): JIT miscompilation in the JavaScript Engine: JIT component (no CVSS) - [CVE-2026-124938](https://cve.now/CVE-2026-124938.md): Mitigation bypass in the Add-ons Manager component (no CVSS) - [CVE-2026-124935](https://cve.now/CVE-2026-124935.md): Undefined behavior in the WebRTC: Networking component (no CVSS) - [CVE-2026-124934](https://cve.now/CVE-2026-124934.md): Spoofing issue in the Security component (no CVSS) - [CVE-2026-124933](https://cve.now/CVE-2026-124933.md): Sandbox escape in the Console component (no CVSS) - [CVE-2026-124932](https://cve.now/CVE-2026-124932.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-124931](https://cve.now/CVE-2026-124931.md): Same-origin policy bypass in the DOM: Core & HTML component (no CVSS) - [CVE-2026-124930](https://cve.now/CVE-2026-124930.md): Information disclosure in the Address Bar component (CVSS 4.3) - [CVE-2026-124929](https://cve.now/CVE-2026-124929.md): Information disclosure in the Layout: Form Controls component (CVSS 4.3) - [CVE-2026-124927](https://cve.now/CVE-2026-124927.md): Site isolation issue in the Graphics: WebRender component (no CVSS) - [CVE-2026-124926](https://cve.now/CVE-2026-124926.md): Incorrect boundary conditions in the WebRTC component (CVSS 8.8) - [CVE-2026-124924](https://cve.now/CVE-2026-124924.md): Incorrect boundary conditions in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-124922](https://cve.now/CVE-2026-124922.md): Use-after-free in the CSS Transitions and Animations component (CVSS 8.8) - [CVE-2026-124919](https://cve.now/CVE-2026-124919.md): Privilege escalation due to use-after-free in the WebRTC: Networking component (CVSS 8.8) - [CVE-2026-124918](https://cve.now/CVE-2026-124918.md): Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-124917](https://cve.now/CVE-2026-124917.md): Sandbox escape due to use-after-free in the Widget: Gtk component (CVSS 9.6) - [CVE-2026-124915](https://cve.now/CVE-2026-124915.md): Incorrect boundary conditions in the Graphics: WebGPU component (CVSS 8.8) - [CVE-2026-124914](https://cve.now/CVE-2026-124914.md): Site isolation issue in the DOM: Navigation component (no CVSS) - [CVE-2026-124913](https://cve.now/CVE-2026-124913.md): Site isolation issue in the Networking component (no CVSS) - [CVE-2026-124912](https://cve.now/CVE-2026-124912.md): Spoofing issue in the DOM: Security component (no CVSS) - [CVE-2026-124910](https://cve.now/CVE-2026-124910.md): Mitigation bypass in the WebExtensions component (no CVSS) - [CVE-2026-124909](https://cve.now/CVE-2026-124909.md): Information disclosure in the Private Browsing component (CVSS 4.3) - [CVE-2026-124907](https://cve.now/CVE-2026-124907.md): Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component (CVSS 8.8) - [CVE-2026-124906](https://cve.now/CVE-2026-124906.md): Use-after-free in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-124905](https://cve.now/CVE-2026-124905.md): Sandbox escape in the DOM: Navigation component (no CVSS) - [CVE-2026-124903](https://cve.now/CVE-2026-124903.md): Sandbox escape due to use-after-free in the IPC component (CVSS 9.6) - [CVE-2026-124902](https://cve.now/CVE-2026-124902.md): Same-origin policy bypass due to race condition in the Audio/Video component (no CVSS) - [CVE-2026-124901](https://cve.now/CVE-2026-124901.md): Other issue in the Networking: JAR component (no CVSS) - [CVE-2026-124899](https://cve.now/CVE-2026-124899.md): Use-after-free in the Layout: Text and Fonts component (CVSS 8.8) - [CVE-2026-124898](https://cve.now/CVE-2026-124898.md): Use-after-free in the DOM: Editor component (CVSS 8.8) - [CVE-2026-124897](https://cve.now/CVE-2026-124897.md): Use-after-free in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-124896](https://cve.now/CVE-2026-124896.md): Invalid pointer in the Layout: Text and Fonts component (no CVSS) - [CVE-2026-124895](https://cve.now/CVE-2026-124895.md): Use-after-free in the Storage: localStorage & sessionStorage component (CVSS 8.8) - [CVE-2026-124894](https://cve.now/CVE-2026-124894.md): Use-after-free in the Networking: Cookies component (CVSS 8.8) - [CVE-2026-124893](https://cve.now/CVE-2026-124893.md): Use-after-free in the DOM: Workers component (CVSS 8.8) - [CVE-2026-124892](https://cve.now/CVE-2026-124892.md): Use-after-free in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-124891](https://cve.now/CVE-2026-124891.md): Incorrect boundary conditions in the DOM: Selection component (CVSS 8.8) - [CVE-2026-124890](https://cve.now/CVE-2026-124890.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124889](https://cve.now/CVE-2026-124889.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-124888](https://cve.now/CVE-2026-124888.md): Incorrect boundary conditions in the Layout: Text and Fonts component (CVSS 8.8) - [CVE-2026-124887](https://cve.now/CVE-2026-124887.md): Incorrect boundary conditions in the Layout: Text and Fonts component (CVSS 8.8) - [CVE-2026-124886](https://cve.now/CVE-2026-124886.md): Invalid pointer in the Layout: Text and Fonts component (no CVSS) - [CVE-2026-124885](https://cve.now/CVE-2026-124885.md): Use-after-free in the Graphics: Text component (CVSS 8.8) - [CVE-2026-124884](https://cve.now/CVE-2026-124884.md): Use-after-free in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-124883](https://cve.now/CVE-2026-124883.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124882](https://cve.now/CVE-2026-124882.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-124881](https://cve.now/CVE-2026-124881.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-124880](https://cve.now/CVE-2026-124880.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124879](https://cve.now/CVE-2026-124879.md): Invalid pointer in the Networking: Cache component (no CVSS) - [CVE-2026-124877](https://cve.now/CVE-2026-124877.md): Use-after-free in the Layout: Positioned component (CVSS 8.8) - [CVE-2026-124876](https://cve.now/CVE-2026-124876.md): Use-after-free in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-124875](https://cve.now/CVE-2026-124875.md): Incorrect boundary conditions in the DOM: CSS Object Model component (CVSS 8.8) - [CVE-2026-124874](https://cve.now/CVE-2026-124874.md): Same-origin policy bypass in the Networking: HTTP component (no CVSS) - [CVE-2026-124873](https://cve.now/CVE-2026-124873.md): Invalid pointer in the DOM: Editor component (no CVSS) - [CVE-2026-124872](https://cve.now/CVE-2026-124872.md): Use-after-free in the Cycle Collector component (CVSS 8.8) - [CVE-2026-124870](https://cve.now/CVE-2026-124870.md): Incorrect boundary conditions in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-124869](https://cve.now/CVE-2026-124869.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124868](https://cve.now/CVE-2026-124868.md): Incorrect boundary conditions in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124866](https://cve.now/CVE-2026-124866.md): Use-after-free in the Layout component (CVSS 8.8) - [CVE-2026-124865](https://cve.now/CVE-2026-124865.md): Use-after-free in the Audio/Video component (CVSS 8.8) - [CVE-2026-124864](https://cve.now/CVE-2026-124864.md): Sandbox escape due to use-after-free in the DOM: Service Workers component (CVSS 9.6) - [CVE-2026-124863](https://cve.now/CVE-2026-124863.md): Use-after-free in the DOM: HTML Parser component (CVSS 8.8) - [CVE-2026-124862](https://cve.now/CVE-2026-124862.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-124861](https://cve.now/CVE-2026-124861.md): Sandbox escape due to use-after-free in the Audio/Video: cubeb component (CVSS 9.6) - [CVE-2026-124860](https://cve.now/CVE-2026-124860.md): Use-after-free in the Audio/Video component (CVSS 8.8) - [CVE-2026-124859](https://cve.now/CVE-2026-124859.md): Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component (CVSS 9.6) - [CVE-2026-124858](https://cve.now/CVE-2026-124858.md): Use-after-free in the DOM: HTML Parser component (CVSS 8.8) - [CVE-2026-124857](https://cve.now/CVE-2026-124857.md): Use-after-free in the Graphics: Canvas2D component (CVSS 8.8) - [CVE-2026-124856](https://cve.now/CVE-2026-124856.md): Incorrect boundary conditions in the Networking: HTTP component (CVSS 8.8) - [CVE-2026-124855](https://cve.now/CVE-2026-124855.md): Sandbox escape in the DOM: Navigation component (no CVSS) - [CVE-2026-124854](https://cve.now/CVE-2026-124854.md): Privilege escalation in the DOM: Navigation component (no CVSS) - [CVE-2026-124853](https://cve.now/CVE-2026-124853.md): Sandbox escape due to incorrect boundary conditions in the Graphics: Text component (CVSS 9.6) - [CVE-2026-121841](https://cve.now/CVE-2026-121841.md): Other issue in Firefox for iOS (no CVSS) - [CVE-2026-121843](https://cve.now/CVE-2026-121843.md): Privilege escalation in Firefox for iOS (CVSS 8.8) - [CVE-2026-121842](https://cve.now/CVE-2026-121842.md): Privilege escalation in the Reader View component in Firefox for iOS (CVSS 8.8) - [CVE-2026-120572](https://cve.now/CVE-2026-120572.md): Incorrect boundary conditions in the Layout: Block and Inline component (CVSS 8.8) - [CVE-2026-118180](https://cve.now/CVE-2026-118180.md): Matrix homeserver could redirect the chat session to a local file or network share (CVSS 7.5) - [CVE-2026-118179](https://cve.now/CVE-2026-118179.md): Request forgery via news: links (CVSS 8.8) - [CVE-2026-118178](https://cve.now/CVE-2026-118178.md): RSS feed could redirect its subscription to a local file or network share (CVSS 5.7) - [CVE-2026-118177](https://cve.now/CVE-2026-118177.md): Calendar discovery accepted local file and remote network share locations (CVSS 9.1) - [CVE-2026-118176](https://cve.now/CVE-2026-118176.md): Bypass of remote UNC path restriction in mailbox: URLs (CVSS 8.1) - [CVE-2026-118175](https://cve.now/CVE-2026-118175.md): Content of other messages could be included when replying to a crafted message (CVSS 7.5) - [CVE-2026-118174](https://cve.now/CVE-2026-118174.md): Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment (CVSS 6.5) - [CVE-2026-118027](https://cve.now/CVE-2026-118027.md): Frame poisoning in the Layout component (CVSS 9.1) - [CVE-2026-118026](https://cve.now/CVE-2026-118026.md): Invalid pointer in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-118025](https://cve.now/CVE-2026-118025.md): Other issue in the SVG component (CVSS 8.8) - [CVE-2026-118024](https://cve.now/CVE-2026-118024.md): Use-after-free in the Graphics: Text component (CVSS 8.8) - [CVE-2026-118023](https://cve.now/CVE-2026-118023.md): Sandbox escape due to use-after-free in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-118022](https://cve.now/CVE-2026-118022.md): Sandbox escape due to use-after-free in the Disability Access APIs component (CVSS 8.8) - [CVE-2026-118021](https://cve.now/CVE-2026-118021.md): Sandbox escape due to use-after-free in the XPCOM component (CVSS 8.8) - [CVE-2026-118020](https://cve.now/CVE-2026-118020.md): Use-after-free in the Layout component (CVSS 8.8) - [CVE-2026-118019](https://cve.now/CVE-2026-118019.md): Race condition, use-after-free in the DOM: File component (CVSS 8.8) - [CVE-2026-118018](https://cve.now/CVE-2026-118018.md): Spoofing issue in the Downloads component in Firefox for Android (CVSS 8.8) - [CVE-2026-118017](https://cve.now/CVE-2026-118017.md): Use-after-free in the SVG component (CVSS 8.8) - [CVE-2026-118016](https://cve.now/CVE-2026-118016.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-118015](https://cve.now/CVE-2026-118015.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-118014](https://cve.now/CVE-2026-118014.md): Use-after-free in the JavaScript Engine: JIT component (CVSS 8.8) - [CVE-2026-118013](https://cve.now/CVE-2026-118013.md): Use-after-free in the Layout: Images, Video, and HTML Frames component (CVSS 8.8) - [CVE-2026-118012](https://cve.now/CVE-2026-118012.md): Use-after-free in the DOM: Animation component (CVSS 8.8) - [CVE-2026-118011](https://cve.now/CVE-2026-118011.md): Frame poisoning in the CSS Parsing and Computation component (CVSS 8.8) - [CVE-2026-118010](https://cve.now/CVE-2026-118010.md): Use-after-free in the Disability Access APIs component (CVSS 8.8) - [CVE-2026-118009](https://cve.now/CVE-2026-118009.md): Integer overflow, use-after-free in the Graphics: Text component (CVSS 8.8) - [CVE-2026-118008](https://cve.now/CVE-2026-118008.md): Privilege escalation in the DOM: Navigation component (CVSS 8.8) - [CVE-2026-118007](https://cve.now/CVE-2026-118007.md): Use-after-free in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-118006](https://cve.now/CVE-2026-118006.md): Privilege escalation due to use-after-free in the WebRTC: Signaling component (CVSS 8.8) - [CVE-2026-118005](https://cve.now/CVE-2026-118005.md): Use-after-free in the WebRTC: Signaling component (CVSS 8.8) - [CVE-2026-118004](https://cve.now/CVE-2026-118004.md): Incorrect boundary conditions in the CSS Transitions and Animations component (CVSS 8.1) - [CVE-2026-118003](https://cve.now/CVE-2026-118003.md): Information disclosure in the Networking: DNS component (CVSS 8.1) - [CVE-2026-118002](https://cve.now/CVE-2026-118002.md): Information disclosure due to race condition in the Networking component (CVSS 8.1) - [CVE-2026-118000](https://cve.now/CVE-2026-118000.md): Information disclosure in the Networking: HTTP component (CVSS 8.1) - [CVE-2026-117999](https://cve.now/CVE-2026-117999.md): Race condition in the IPC component (CVSS 8.8) - [CVE-2026-117998](https://cve.now/CVE-2026-117998.md): Mitigation bypass in the DOM: Push Subscriptions component (CVSS 8.8) - [CVE-2026-117997](https://cve.now/CVE-2026-117997.md): Sandbox escape due to use-after-free in the Widget component (CVSS 9.6) - [CVE-2026-117996](https://cve.now/CVE-2026-117996.md): Incorrect boundary conditions in the WebRTC component (CVSS 8.1) - [CVE-2026-117995](https://cve.now/CVE-2026-117995.md): Privilege escalation in the DOM: UI Events & Focus Handling component (CVSS 8.8) - [CVE-2026-117994](https://cve.now/CVE-2026-117994.md): Use-after-free in the JavaScript: GC component (CVSS 8.8) - [CVE-2026-117993](https://cve.now/CVE-2026-117993.md): Integer overflow in the Graphics: Text component (CVSS 8.8) - [CVE-2026-117992](https://cve.now/CVE-2026-117992.md): Information disclosure in the CSS Parsing and Computation component (CVSS 6.5) - [CVE-2026-117991](https://cve.now/CVE-2026-117991.md): Incorrect boundary conditions in the Layout: Text and Fonts component (CVSS 8.8) - [CVE-2026-117990](https://cve.now/CVE-2026-117990.md): Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 9.6) - [CVE-2026-117989](https://cve.now/CVE-2026-117989.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-117988](https://cve.now/CVE-2026-117988.md): Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 9.6) - [CVE-2026-117987](https://cve.now/CVE-2026-117987.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-117986](https://cve.now/CVE-2026-117986.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-117985](https://cve.now/CVE-2026-117985.md): Sandbox escape due to use-after-free in the Graphics component (CVSS 9.6) - [CVE-2026-117984](https://cve.now/CVE-2026-117984.md): Incorrect boundary conditions in the Layout: Scrolling and Overflow component (CVSS 8.8) - [CVE-2026-117983](https://cve.now/CVE-2026-117983.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-117982](https://cve.now/CVE-2026-117982.md): Invalid pointer in the JavaScript Engine: JIT component (CVSS 9.8) - [CVE-2026-117981](https://cve.now/CVE-2026-117981.md): Privilege escalation in the Toolkit component (CVSS 9.8) - [CVE-2026-117980](https://cve.now/CVE-2026-117980.md): Use-after-free in the Graphics component (CVSS 9.8) - [CVE-2026-117979](https://cve.now/CVE-2026-117979.md): Incorrect boundary conditions in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-117978](https://cve.now/CVE-2026-117978.md): Incorrect boundary conditions in the Graphics component (CVSS 8.1) - [CVE-2026-117977](https://cve.now/CVE-2026-117977.md): Other issue in the Console component (CVSS 8.1) - [CVE-2026-117976](https://cve.now/CVE-2026-117976.md): Site isolation issue in the DOM: Navigation component (CVSS 8.1) - [CVE-2026-117975](https://cve.now/CVE-2026-117975.md): Sandbox escape due to invalid pointer in the Graphics: WebRender component (CVSS 8.8) - [CVE-2026-117974](https://cve.now/CVE-2026-117974.md): Use-after-free in the XML component (CVSS 8.8) - [CVE-2026-117973](https://cve.now/CVE-2026-117973.md): Use-after-free in the Networking: DNS component (CVSS 8.8) - [CVE-2026-117972](https://cve.now/CVE-2026-117972.md): Use-after-free in the Graphics component (CVSS 8.8) - [CVE-2026-117971](https://cve.now/CVE-2026-117971.md): Sandbox escape due to use-after-free in the Print Preview component (CVSS 9.6) - [CVE-2026-117970](https://cve.now/CVE-2026-117970.md): Race condition in the Disability Access APIs component (CVSS 8.8) - [CVE-2026-117969](https://cve.now/CVE-2026-117969.md): Invalid pointer in the JavaScript Engine: JIT component (CVSS 8.8) - [CVE-2026-117968](https://cve.now/CVE-2026-117968.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-117967](https://cve.now/CVE-2026-117967.md): Mitigation bypass in the DOM: Security component (CVSS 8.8) - [CVE-2026-117966](https://cve.now/CVE-2026-117966.md): Site isolation issue in the Networking: HTTP component (CVSS 8.1) - [CVE-2026-117965](https://cve.now/CVE-2026-117965.md): Same-origin policy bypass in the Address Bar component (CVSS 8.1) - [CVE-2026-117964](https://cve.now/CVE-2026-117964.md): Use-after-free in the Panning and Zooming component (CVSS 8.8) - [CVE-2026-117963](https://cve.now/CVE-2026-117963.md): Incorrect boundary conditions in the DOM: Service Workers component (CVSS 8.1) - [CVE-2026-117962](https://cve.now/CVE-2026-117962.md): Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component (CVSS 9.6) - [CVE-2026-117961](https://cve.now/CVE-2026-117961.md): Incorrect boundary conditions in the Layout: Text and Fonts component (CVSS 8.1) - [CVE-2026-117960](https://cve.now/CVE-2026-117960.md): Spoofing issue in the DOM: Core & HTML component (CVSS 4.7) - [CVE-2026-117959](https://cve.now/CVE-2026-117959.md): Site isolation issue in the DOM: Service Workers component (CVSS 8.1) - [CVE-2026-117958](https://cve.now/CVE-2026-117958.md): Site isolation issue in the Networking: HTTP component (CVSS 8.1) - [CVE-2026-117957](https://cve.now/CVE-2026-117957.md): Cryptographic issue in the WebRTC: Networking component (CVSS 8.1) - [CVE-2026-117956](https://cve.now/CVE-2026-117956.md): Invalid pointer in the Nimbus Desktop Client component (CVSS 8.8) - [CVE-2026-117955](https://cve.now/CVE-2026-117955.md): JIT miscompilation in the JavaScript: WebAssembly component (CVSS 8.1) - [CVE-2026-117954](https://cve.now/CVE-2026-117954.md): Use-after-free in the Layout: Positioned component (CVSS 8.8) - [CVE-2026-117953](https://cve.now/CVE-2026-117953.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-117952](https://cve.now/CVE-2026-117952.md): Uninitialized memory in the Networking component (CVSS 8.1) - [CVE-2026-117951](https://cve.now/CVE-2026-117951.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-117950](https://cve.now/CVE-2026-117950.md): Incorrect boundary conditions in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-117949](https://cve.now/CVE-2026-117949.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) - [CVE-2026-117948](https://cve.now/CVE-2026-117948.md): Use-after-free in the SVG component (CVSS 6.3) - [CVE-2026-117947](https://cve.now/CVE-2026-117947.md): Use-after-free in the XML component (CVSS 6.3) - [CVE-2026-117946](https://cve.now/CVE-2026-117946.md): Incorrect boundary conditions in the JavaScript Engine component (CVSS 9.8) - [CVE-2026-117945](https://cve.now/CVE-2026-117945.md): Incorrect boundary conditions in the XML component (CVSS 9.8) - [CVE-2026-117944](https://cve.now/CVE-2026-117944.md): Use-after-free in the Layout component (CVSS 6.3) - [CVE-2026-117943](https://cve.now/CVE-2026-117943.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/mozilla Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.