Where
-Infinity
0

Trending

Last week
Last month
Last year

Mozilla Firefox ESRSite isolation issue in the Panning and Zooming component

Risk 24
Severity
4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100821

Mozilla FirefoxMitigation bypass in the DOM: Security component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100829

Mozilla FirefoxMitigation bypass in the DOM: Navigation component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100830

Mozilla FirefoxMitigation bypass in the Bookmarks & History component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100828

Mozilla FirefoxSame-origin policy bypass in the DevTools component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100809

Mozilla Firefox ESRSame-origin policy bypass in the WebExtensions component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100803

Mozilla FirefoxMitigation bypass in the DOM: Service Workers component

Risk 77
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100808

Mozilla FirefoxSite isolation issue in the DOM: Networking component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100816

Mozilla Firefox ESRSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Risk 80
Severity
9.6
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100781

Mozilla Firefox ESRSandbox escape in the Graphics component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100775

Mozilla FirefoxCryptography misuse in Storage: Quota Manager component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100798

Mozilla FirefoxSandbox escape in the XUL component

Risk 80
Severity
9.6
Input Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100787

Mozilla Firefox ESRSandbox escape due to incorrect boundary conditions in the Internationalization component

Risk 80
Severity
9.6
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100794

Mozilla Firefox ESRUndefined behavior in the DOM: Streams component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100771

Mozilla Firefox ESRJIT miscompilation in the JavaScript: WebAssembly component

Risk 47
Severity
7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100792

Mozilla FirefoxSandbox escape in the Security: Process Sandboxing component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100760

Mozilla Firefox ESRInvalid pointer in the JavaScript: WebAssembly component

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100788

Mozilla Firefox ESRUninitialized memory in the Storage: Quota Manager component

Risk 59
Severity
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100759

Mozilla FirefoxSpoofing issue in the Networking: HTTP component

Risk 34
Severity
5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

First published (updated )
CVE-2026-100822

Mozilla Firefox ESRSandbox escape in the DOM: Navigation component

Risk 80
Severity
9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100758

Mozilla Firefox ESRIncorrect boundary conditions in the Audio/Video: Playback component

Risk 59
Severity
8.1
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

First published (updated )
CVE-2026-100756

debian/firefoxCompartment mismatch when parsing JavaScript JSON module

Risk 15
Severity
4
EPSS
0.04%
Use After Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Last updated 9 January 2025

1 / 6
Source: Ubuntu
First published (updated )
CVE-2025-0240

debian/firefoxMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

Risk 29
Severity
6.5
EPSS
0.04%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Last updated 9 January 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2025-0242

debian/firefoxWebChannel APIs susceptible to confused deputy attack

Risk 25
Severity
5.4
EPSS
0.04%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Last updated 9 January 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2025-0237

debian/firefoxMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6

Risk 23
Severity
5.1
EPSS
0.04%
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Last updated 9 January 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2025-0243

debian/firefoxAlt-Svc ALPN validation failure when redirected

Risk 15
Severity
4
EPSS
0.04%
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Last updated 9 January 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2025-0239

debian/firefoxMemory corruption when using JavaScript Text Segmentation

Risk 47
Severity
7.7
EPSS
0.04%
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Last updated 9 January 2025

1 / 5
Source: Ubuntu
First published (updated )
CVE-2025-0241

debian/firefoxUse-after-free in Custom Highlight

Risk 86
Severity
9.8
Use After Free
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash.

1 / 4
Source: Mozilla
First published (updated )
CVE-2025-1010

debian/firefoxUse-after-free during concurrent delazification

Risk 86
Severity
9.8
Use After Free
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A race during concurrent delazification could have led to a use-after-free.

1 / 4
Source: Mozilla
First published (updated )
CVE-2025-1012

debian/firefoxA bug in WebAssembly code generation could result in a crash

Risk 86
Severity
9.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution.

1 / 4
Source: Mozilla
First published (updated )
CVE-2025-1011

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203