What’s Vulnerable › Products

Mozilla Firefox vulnerabilities

3445 known vulnerabilities, 15 confirmed exploited in the wild (CISA KEV), 590 published in the last 12 months.

Check whether your Mozilla Firefox version is affected

Exploited Mozilla Firefox vulnerabilities

• CVE-2010-3765 — Mozilla Multiple Products Remote Code Execution Vulnerability
• CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability
• CVE-2023-5217 — Google Chromium libvpx Heap Buffer Overflow Vulnerability
• CVE-2023-4863 — Google Chromium WebP Heap-Based Buffer Overflow Vulnerability
• CVE-2016-9079 — Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
• CVE-2015-4495 — Mozilla Firefox Security Feature Bypass Vulnerability
• CVE-2019-11708 — Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
• CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability
• CVE-2013-1690 — Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
• CVE-2022-26486 — Mozilla Firefox Use-After-Free Vulnerability
• CVE-2022-26485 — Mozilla Firefox Use-After-Free Vulnerability
• CVE-2013-1675 — Mozilla Firefox Information Disclosure Vulnerability
• CVE-2020-6820 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
• CVE-2020-6819 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
• CVE-2019-17026 — Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Latest Mozilla Firefox vulnerabilities

• CVE-2026-106016 — Mitigation bypass in the File Handling component (CVSS 9.8)
• CVE-2026-96869 — Information disclosure in the Networking component (CVSS 4.3)
• CVE-2026-100832 — Use-after-free in the Graphics: Canvas2D component (CVSS 8.8)
• CVE-2026-100831 — Use-after-free in the DOM: UI Events & Focus Handling component (CVSS 8.8)
• CVE-2026-100830 — Mitigation bypass in the DOM: Navigation component (CVSS 8.1)
• CVE-2026-100829 — Mitigation bypass in the DOM: Security component (CVSS 9.6)
• CVE-2026-100828 — Mitigation bypass in the Bookmarks & History component (CVSS 9.6)
• CVE-2026-100826 — Denial-of-service in the Storage: StorageManager component (CVSS 6.5)
• CVE-2026-100825 — Use-after-free in the JavaScript Engine: JIT component (CVSS 8.8)
• CVE-2026-100824 — Privilege escalation in the Places component (CVSS 8.8)
• CVE-2026-100822 — Spoofing issue in the Networking: HTTP component (CVSS 5.4)
• CVE-2026-100821 — Site isolation issue in the Panning and Zooming component (CVSS 4.7)
• CVE-2026-100820 — Privilege escalation in the Address Bar component (CVSS 8.8)
• CVE-2026-100819 — Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVSS 9.6)
• CVE-2026-100818 — Sandbox escape due to use-after-free in the Widget: Gtk component (CVSS 9.6)
• CVE-2026-100817 — Other issue in the JavaScript: WebAssembly component (CVSS 5.4)
• CVE-2026-100816 — Site isolation issue in the DOM: Networking component (CVSS 8.1)
• CVE-2026-100815 — Use-after-free in the CSS Parsing and Computation component (CVSS 8.8)
• CVE-2026-100814 — Incorrect boundary conditions in the JavaScript Engine: JIT component (CVSS 8.8)
• CVE-2026-100813 — Invalid pointer in the JavaScript Engine: JIT component (CVSS 8.8)
• CVE-2026-100812 — Denial-of-service in the Graphics component (CVSS 6.5)
• CVE-2026-100811 — Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVSS 9.6)
• CVE-2026-100810 — Other issue in the DevTools component (CVSS 9.8)
• CVE-2026-100809 — Same-origin policy bypass in the DevTools component (CVSS 8.1)
• CVE-2026-100808 — Mitigation bypass in the DOM: Service Workers component (CVSS 8.8)