HighCVSS 8.8
EPSS 0.28%
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
Product
mozilla Firefox vulnerabilities
3,812 published CVES affecting mozilla Firefox, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 3,812
- Critical
- 531
- High
- 1,780
- Medium
- 1,419
- Low
- 82
- Unscored
- 0
- CISA KEV
- 15
Latest mozilla Firefox CVEs
Newest publication first · page 1 of 40 · showing the latest 1,000
-
-
LowCVSS 3.4 EPSS 0.19%
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
LowCVSS 3.4 EPSS 0.17%
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.33%
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
LowCVSS 3.4 EPSS 0.17%
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
LowCVSS 3.4 EPSS 0.17%
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.32%
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 4.3 EPSS 0.27%
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
LowCVSS 3.4 EPSS 0.13%
Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.
-
MediumCVSS 6.1 EPSS 0.19%
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
LowCVSS 3.4 EPSS 0.17%
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 6.1 EPSS 0.18%
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 4.3 EPSS 0.29%
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 6.1 EPSS 0.18%
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 6.1 EPSS 0.18%
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.32%
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
MediumCVSS 6.1 EPSS 0.14%
Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.
-
HighCVSS 8.8 EPSS 0.32%
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.37%
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
CVE-2026-124900 Sandbox escape due to use-after-free in the DOM: Service Workers component
PublishedCriticalCVSS 9.6 EPSS 0.32%Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.37%
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.37%
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.38%
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
HighCVSS 8.8 EPSS 0.33%
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
LowCVSS 3.4 EPSS 0.18%
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.