Aggregates CVE and security vulnerability intelligence across all Mozilla-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk path handling and vendor risk input validation and related problems; some flaws may lead to vendor impact unexpected behavior, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-8953 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | [email protected] | 9.6 | 0.53% | 2026-05-19 | 2026-06-17 |
| CVE-2026-8952 | Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | [email protected] | 8.8 | 0.36% | 2026-05-19 | 2026-06-17 |
| CVE-2026-8951 | Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151. | [email protected] | 6.5 | 0.25% | 2026-05-19 | 2026-06-17 |
| CVE-2026-8950 | Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | [email protected] | 9.3 | 0.19% | 2026-05-19 | 2026-06-17 |
| CVE-2026-8949 | Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | [email protected] | 7.5 | 0.58% | 2026-05-19 | 2026-06-17 |
| CVE-2026-8948 | Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | [email protected] | 9.1 | 0.39% | 2026-05-19 | 2026-07-14 |
| CVE-2026-8947 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | [email protected] | 7.3 | 0.37% | 2026-05-19 | 2026-07-14 |
| CVE-2026-8946 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | [email protected] | 7.5 | 0.56% | 2026-05-19 | 2026-07-15 |
| CVE-2026-8945 | Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151. | [email protected] | 7.5 | 0.37% | 2026-05-19 | 2026-07-14 |
| CVE-2026-8401 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | [email protected] | 9.8 | 0.31% | 2026-05-12 | 2026-07-14 |
| CVE-2026-8391 | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | [email protected] | 5.3 | 0.30% | 2026-05-12 | 2026-07-14 |
| CVE-2026-8390 | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3. | [email protected] | 7.3 | 0.26% | 2026-05-12 | 2026-07-14 |
| CVE-2026-8389 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3. | [email protected] | 8.8 | 0.31% | 2026-05-12 | 2026-07-14 |
| CVE-2026-8388 | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. | [email protected] | 6.5 | 0.19% | 2026-05-12 | 2026-07-14 |
| CVE-2026-41512 | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in `BrowserAutomation::PlaywrightService`. This issue has been patched in version 1.4.1. | [email protected] | 9.9 | 0.59% | 2026-05-08 | 2026-06-17 |
| CVE-2026-8094 | Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2. | [email protected] | 9.8 | 0.44% | 2026-05-07 | 2026-07-14 |
| CVE-2026-8093 | Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2. | [email protected] | 8.1 | 0.32% | 2026-05-07 | 2026-07-14 |
| CVE-2026-8092 | Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2. | [email protected] | 8.1 | 0.37% | 2026-05-07 | 2026-07-14 |
| CVE-2026-8091 | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. | [email protected] | 9.8 | 0.44% | 2026-05-07 | 2026-07-14 |
| CVE-2026-8090 | Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2. | [email protected] | 7.3 | 0.29% | 2026-05-07 | 2026-07-14 |