Class familyMozilla · Firefox
Mozilla Firefox memory corruption flaws, 2013–2026
61 Firefox CVEs with CWE-119 weaknesses, 16 May 2013 to 13 Oct 2026. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2013’13
2014’14
2015’15
2016’16
2017’17
2018’18
2019’19
2020’20
2021’21
2022’22
2023’23
1 2024’24
6 2025’25
53 2026’26
In CISA KEVNot in KEV
20131 CVE, 1 in KEV
20241 CVE
20256 CVEs
202653 CVEs
- CVE-2026-0879
- CVE-2026-0886
- CVE-2026-0891
- CVE-2026-2773
- CVE-2026-2776
- CVE-2026-2778
- CVE-2026-2788
- CVE-2026-4710
- CVE-2026-4719
- CVE-2026-5731
- CVE-2026-6752
- CVE-2026-6753
- CVE-2026-6764
- CVE-2026-6767
- CVE-2026-7320
- CVE-2026-8388
- CVE-2026-8391
- CVE-2026-8946
- CVE-2026-12290
- CVE-2026-12292
- CVE-2026-12297
- CVE-2026-12305
- CVE-2026-12306
- CVE-2026-12307
- CVE-2026-12308
- CVE-2026-12309
- CVE-2026-12310
- CVE-2026-12312
- CVE-2026-12314
- CVE-2026-12327
- CVE-2026-12329
- CVE-2026-16357
- CVE-2026-16359
- CVE-2026-16368
- CVE-2026-74946
- CVE-2026-74990
- CVE-2026-84145
- CVE-2026-92032
- CVE-2026-92035
- CVE-2026-92054
- CVE-2026-92059
- CVE-2026-92072
- CVE-2026-92076
- CVE-2026-100756
- CVE-2026-100781
- CVE-2026-100782
- CVE-2026-100819
- CVE-2026-109708
- CVE-2026-109715
- CVE-2026-109716
- CVE-2026-109753
- CVE-2026-109754
- CVE-2026-109762
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2013-1675KEV | 16 May 2013 | Mozilla Firefox Information Disclosure Vulnerability | Grouped by weakness | 66.3 |
| CVE-2024-9401 | 1 Oct 2024 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2 | Grouped by weakness | 17.8 |
| CVE-2025-8034 | 22 Jul 2025 | Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1… | Grouped by weakness | 14.2 |
| CVE-2025-8035 | 22 Jul 2025 | Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1… | Grouped by weakness | 13.0 |
| CVE-2025-8040 | 22 Jul 2025 | Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | Grouped by weakness | 12.3 |
| CVE-2025-9185 | 19 Aug 2025 | Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2… | Grouped by weakness | 14.4 |
| CVE-2025-10537 | 16 Sep 2025 | Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 | Grouped by weakness | 11.6 |
| CVE-2025-11714 | 14 Oct 2025 | Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird… | Grouped by weakness | 11.5 |
| CVE-2026-0879 | 13 Jan 2026 | Sandbox escape due to incorrect boundary conditions in the Graphics component | Grouped by weakness | 15.4 |
| CVE-2026-0886 | 13 Jan 2026 | Incorrect boundary conditions in the Graphics component | Grouped by weakness | 10.2 |
| CVE-2026-0891 | 13 Jan 2026 | Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 | Grouped by weakness | 13.9 |
| CVE-2026-2773 | 24 Feb 2026 | Incorrect boundary conditions in the Web Audio component | Grouped by weakness | 18.9 |
| CVE-2026-2776 | 24 Feb 2026 | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software | Grouped by weakness | 16.4 |
| CVE-2026-2778 | 24 Feb 2026 | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component | Grouped by weakness | 16.4 |
| CVE-2026-2788 | 24 Feb 2026 | Incorrect boundary conditions in the Audio/Video: GMP component | Grouped by weakness | 17.3 |
| CVE-2026-4710 | 24 Mar 2026 | Incorrect boundary conditions in the Audio/Video component | Grouped by weakness | 14.2 |
| CVE-2026-4719 | 24 Mar 2026 | Incorrect boundary conditions in the Graphics: Text component | Grouped by weakness | 13.1 |
| CVE-2026-5731 | 7 Apr 2026 | Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and… | Grouped by weakness | 12.3 |
| CVE-2026-6752 | 21 Apr 2026 | Incorrect boundary conditions in the WebRTC component | Grouped by weakness | 9.8 |
| CVE-2026-6753 | 21 Apr 2026 | Incorrect boundary conditions in the WebRTC component | Grouped by weakness | 9.8 |
| CVE-2026-6764 | 21 Apr 2026 | Incorrect boundary conditions in the DOM: Device Interfaces component | Grouped by weakness | 7.3 |
| CVE-2026-6767 | 21 Apr 2026 | Other issue in the Libraries component in NSS | Grouped by weakness | 6.4 |
| CVE-2026-7320 | 28 Apr 2026 | Information disclosure due to incorrect boundary conditions in the Audio/Video component | Grouped by weakness | 10.3 |
| CVE-2026-8388 | 12 May 2026 | Incorrect boundary conditions in the JavaScript Engine: JIT component | Grouped by weakness | 7.7 |
| CVE-2026-8391 | 12 May 2026 | Other issue in the JavaScript Engine component | Grouped by weakness | 8.2 |
| CVE-2026-8946 | 19 May 2026 | Incorrect boundary conditions in the Audio/Video: Web Codecs component | Grouped by weakness | 14.6 |
| CVE-2026-12290 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 12.5 |
| CVE-2026-12292 | 16 Jun 2026 | Incorrect boundary conditions in the Web Audio component | Grouped by weakness | 14.1 |
| CVE-2026-12297 | 16 Jun 2026 | Sandbox escape due to incorrect boundary conditions in the Networking component | Grouped by weakness | 13.4 |
| CVE-2026-12305 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 11.5 |
| CVE-2026-12306 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 7.3 |
| CVE-2026-12307 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 7.3 |
| CVE-2026-12308 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 7.3 |
| CVE-2026-12309 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 7.4 |
| CVE-2026-12310 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 8.6 |
| CVE-2026-12312 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 8.6 |
| CVE-2026-12314 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird 152 | Grouped by weakness | 8.6 |
| CVE-2026-12327 | 16 Jun 2026 | Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | Grouped by weakness | 12.7 |
| CVE-2026-12329 | 16 Jun 2026 | Memory safety bug fixed in Thunderbird ESR 140.12 | Grouped by weakness | 8.6 |
| CVE-2026-16357 | 21 Jul 2026 | Incorrect boundary conditions in the Graphics component | Grouped by weakness | 16.5 |
| CVE-2026-16359 | 21 Jul 2026 | Incorrect boundary conditions in the Audio/Video: GMP component | Grouped by weakness | 14.5 |
| CVE-2026-16368 | 21 Jul 2026 | Incorrect boundary conditions in the JavaScript: WebAssembly component | Grouped by weakness | 16.3 |
| CVE-2026-74946 | 18 Aug 2026 | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component | Grouped by weakness | 14.7 |
| CVE-2026-74990 | 18 Aug 2026 | Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 | Grouped by weakness | 17.6 |
| CVE-2026-84145 | 1 Sep 2026 | Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 | Grouped by weakness | 11.4 |
| CVE-2026-92032 | 15 Sep 2026 | Sandbox escape due to invalid pointer in the Graphics component | Grouped by weakness | 11.7 |
| CVE-2026-92035 | 15 Sep 2026 | Sandbox escape due to incorrect boundary conditions in the Graphics component | Grouped by weakness | 11.9 |
| CVE-2026-92054 | 15 Sep 2026 | Privilege escalation in the Memory component | Grouped by weakness | 9.3 |
| CVE-2026-92059 | 15 Sep 2026 | Incorrect boundary conditions in the DOM: Editor component | Grouped by weakness | 6.8 |
| CVE-2026-92072 | 15 Sep 2026 | Incorrect boundary conditions in the Safe Browsing component | Grouped by weakness | 8.3 |
| CVE-2026-92076 | 15 Sep 2026 | Incorrect boundary conditions in the Networking component | Grouped by weakness | 6.4 |
| CVE-2026-100756 | 29 Sep 2026 | Incorrect boundary conditions in the Audio/Video: Playback component | Grouped by weakness | 10.4 |
| CVE-2026-100781 | 29 Sep 2026 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | Grouped by weakness | 11.9 |
| CVE-2026-100782 | 29 Sep 2026 | Privilege escalation due to incorrect boundary conditions in the Graphics component | Grouped by weakness | 9.7 |
| CVE-2026-100819 | 29 Sep 2026 | Sandbox escape due to incorrect boundary conditions in the XPCOM component | Grouped by weakness | 10.4 |
| CVE-2026-109708 | 13 Oct 2026 | Sandbox escape due to incorrect boundary conditions in the Networking component | Grouped by weakness | 14.4 |
| CVE-2026-109715 | 13 Oct 2026 | Incorrect boundary conditions in the JavaScript Engine component | Grouped by weakness | 15.5 |
| CVE-2026-109716 | 13 Oct 2026 | Incorrect boundary conditions in the JavaScript Engine component | Grouped by weakness | 10.5 |
| CVE-2026-109753 | 13 Oct 2026 | Incorrect boundary conditions in the Layout component | Grouped by weakness | 11.2 |
| CVE-2026-109754 | 13 Oct 2026 | Incorrect boundary conditions in the DOM: Editor component | Grouped by weakness | 10.8 |
| CVE-2026-109762 | 13 Oct 2026 | Incorrect boundary conditions in the SVG component | Grouped by weakness | 11.9 |