Mozilla vulnerabilities
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-12313Information disclosure, sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12312Memory safety bug fixed in Thunderbird 152
- CVE-2026-12311Information disclosure, sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12310Memory safety bug fixed in Thunderbird 152
- CVE-2026-12309Memory safety bug fixed in Thunderbird 152
- CVE-2026-12308Memory safety bug fixed in Thunderbird 152
- CVE-2026-12307Memory safety bug fixed in Thunderbird 152
- CVE-2026-12306Memory safety bug fixed in Thunderbird 152
- CVE-2026-12305Memory safety bug fixed in Thunderbird 152
- CVE-2026-12304Same-origin policy bypass in the Networking: Cookies component
- CVE-2026-12303Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2026-12302Mitigation bypass in the DOM: Security component
- CVE-2026-12301Memory safety bug fixed in Thunderbird 152
- CVE-2026-12300Memory safety bug fixed in Thunderbird 152
- CVE-2026-12299JIT miscompilation in the DOM: Core & HTML component
- CVE-2026-12298Memory safety bug fixed in Thunderbird 152
- CVE-2026-12297Sandbox escape due to incorrect boundary conditions in the Networking component
- CVE-2026-12296Sandbox escape in the Security: Process Sandboxing component
- CVE-2026-12295Sandbox escape in the DOM: Navigation component
- CVE-2026-12294Sandbox escape in the DOM: Workers component
- CVE-2026-12293Use-after-free in the Graphics: WebGPU component
- CVE-2026-12292Incorrect boundary conditions in the Web Audio component
- CVE-2026-12291Use-after-free in the Networking: HTTP component
- CVE-2026-12290Memory safety bug fixed in Thunderbird 152
- CVE-2026-12289Privilege escalation in the Graphics: WebRender component
- CVE-2026-11799UXSS in Focus for iOS / Klar Webkit navigation
- CVE-2026-10702JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-10701Incorrect boundary conditions in the Graphics: Text component
- CVE-2026-9309Arbitrary JavaScript execution in internal pages via Reader View JSON-LD injection
- CVE-2026-9308Arbitrary JavaScript execution in Reader View due to wrong HTML replacement order