Mozilla Vulnerabilities and Affected Products

Products

Firefox1,739 vulnerabilities
Thunderbird1,209 vulnerabilities
Firefox ESR712 vulnerabilities
firefox_esr69 vulnerabilities
Firefox for iOS54 vulnerabilities
Firefox for Android33 vulnerabilities
Focus for Android17 vulnerabilities
Focus for iOS13 vulnerabilities
Thunderbird ESR13 vulnerabilities
Firefox and Thunderbird7 vulnerabilities
NSS6 vulnerabilities
Focus3 vulnerabilities
Hubs Cloud2 vulnerabilities
Mozilla Bleach2 vulnerabilities
Mozilla VPN2 vulnerabilities
WebThings Gateway2 vulnerabilities
Bugzilla1 vulnerability
common-voice1 vulnerability
Convict1 vulnerability
Firefox for1 vulnerability
Firefox, Firefox ESR, and Thunderbird1 vulnerability
firefox_for_ios1 vulnerability
focus_for_ios1 vulnerability
geckodriver1 vulnerability
hawk1 vulnerability

Mozilla vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-14899HIGH	Off-by-one out of bounds read in MIME header parser for forwarding The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13. CWE-193Jul 22, 2026	CVSS7.5v3.1	EPSS0.274%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16361CRITICAL	Memory safety bugs fixed in Thunderbird ESR 140.13 Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. CWE-119Jul 21, 2026	CVSS9.8v3.1	EPSS0.309%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16360CRITICAL	Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-119Jul 21, 2026	CVSS9.8v3.1	EPSS0.326%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16412CRITICAL	Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-119Jul 21, 2026	CVSS9.8v3.1	EPSS0.333%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16411CRITICAL	Memory safety bugs fixed in Firefox 153 Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-119Jul 21, 2026	CVSS9.8v3.1	EPSS0.315%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16410CRITICAL	JIT miscompilation in the JavaScript Engine: JIT component JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-843Jul 21, 2026	CVSS9.8v3.1	EPSS0.305%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16409HIGH	Invalid pointer in the Security: PSM component Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-824Jul 21, 2026	CVSS7.5v3.1	EPSS0.288%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16408CRITICAL	Integer overflow in the Audio/Video: Playback component Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-190Jul 21, 2026	CVSS9.8v3.1	EPSS0.336%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16407CRITICAL	Mitigation bypass in the DOM: Service Workers component Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-284 CWE-693Jul 21, 2026	CVSS9.8v3.1	EPSS0.279%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16406CRITICAL	Mitigation bypass in the Networking component Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-693Jul 21, 2026	CVSS9.1v3.1	EPSS0.245%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16405HIGH	Information disclosure in the Networking: WebSockets component Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-200Jul 21, 2026	CVSS7.5v3.1	EPSS0.256%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16403MEDIUM	Spoofing issue in the Address Bar component Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-451Jul 21, 2026	CVSS6.5v3.1	EPSS0.198%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16402CRITICAL	Integer overflow in the Graphics: ImageLib component Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-190Jul 21, 2026	CVSS9.8v3.1	EPSS0.336%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16401HIGH	Privilege escalation in the Data Loss Prevention component Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-269Jul 21, 2026	CVSS8.8v3.1	EPSS0.214%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16400HIGH	Information disclosure in the DOM: Security component Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-200Jul 21, 2026	CVSS7.5v3.1	EPSS0.248%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16399HIGH	Site isolation issue in the DOM: Navigation component Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-346Jul 21, 2026	CVSS7.5v3.1	EPSS0.149%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16398HIGH	Site isolation issue in the Graphics component Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-200 CWE-346Jul 21, 2026	CVSS7.5v3.1	EPSS0.149%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16396HIGH	Privilege escalation in WebExtensions Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-269Jul 21, 2026	CVSS8.8v3.1	EPSS0.241%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16395CRITICAL	Integer overflow in the Audio/Video component Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-190Jul 21, 2026	CVSS9.8v3.1	EPSS0.336%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16394CRITICAL	Mitigation bypass in the DOM: Security component Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-693Jul 21, 2026	CVSS9.1v3.1	EPSS0.251%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16359CRITICAL	Incorrect boundary conditions in the Audio/Video: GMP component Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-119Jul 21, 2026	CVSS9.1v3.1	EPSS0.263%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16393CRITICAL	Incorrect boundary conditions in the Graphics: WebGPU component Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-119Jul 21, 2026	CVSS9.1v3.1	EPSS0.299%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16392CRITICAL	JIT miscompilation in the JavaScript Engine: JIT component JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CWE-670 CWE-843Jul 21, 2026	CVSS9.1v3.1	EPSS0.362%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16391HIGH	Information disclosure in the Storage: IndexedDB component Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-200Jul 21, 2026	CVSS7.5v3.1	EPSS0.322%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16390CRITICAL	Mitigation bypass in the Enterprise Policies component Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. CWE-693Jul 21, 2026	CVSS9.1v3.1	EPSS0.316%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX