Mozilla vulnerabilities
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-124868Incorrect boundary conditions in the DOM: Core & HTML component
- CVE-2026-124866Use-after-free in the Layout component
- CVE-2026-124865Use-after-free in the Audio/Video component
- CVE-2026-124864Sandbox escape due to use-after-free in the DOM: Service Workers component
- CVE-2026-124863Use-after-free in the DOM: HTML Parser component
- CVE-2026-124862Use-after-free in the DOM: Core & HTML component
- CVE-2026-124861Sandbox escape due to use-after-free in the Audio/Video: cubeb component
- CVE-2026-124860Use-after-free in the Audio/Video component
- CVE-2026-124859Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component
- CVE-2026-124858Use-after-free in the DOM: HTML Parser component
- CVE-2026-124857Use-after-free in the Graphics: Canvas2D component
- CVE-2026-124856Incorrect boundary conditions in the Networking: HTTP component
- CVE-2026-124855Sandbox escape in the DOM: Navigation component
- CVE-2026-124854Privilege escalation in the DOM: Navigation component
- CVE-2026-124853Sandbox escape due to incorrect boundary conditions in the Graphics: Text component
- CVE-2026-121841Other issue in Firefox for iOS
- CVE-2026-121843Privilege escalation in Firefox for iOS
- CVE-2026-121842Privilege escalation in the Reader View component in Firefox for iOS
- CVE-2026-120572Incorrect boundary conditions in the Layout: Block and Inline component
- CVE-2026-118180Matrix homeserver could redirect the chat session to a local file or network share
- CVE-2026-118179Request forgery via news: links
- CVE-2026-118178RSS feed could redirect its subscription to a local file or network share
- CVE-2026-118177Calendar discovery accepted local file and remote network share locations
- CVE-2026-118176Bypass of remote UNC path restriction in mailbox: URLs
- CVE-2026-118175Content of other messages could be included when replying to a crafted message
- CVE-2026-118174Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
- CVE-2026-118027Frame poisoning in the Layout component
- CVE-2026-118026Invalid pointer in the JavaScript: GC component
- CVE-2026-118025Other issue in the SVG component
- CVE-2026-118024Use-after-free in the Graphics: Text component