Patchfirst: Mozilla vulnerabilitieshttps://patchfirst.co/vendor/mozilla/New and newly exploited Mozilla CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-113399: Incorrect boundary conditions in the SVG componenthttps://patchfirst.co/cve/CVE-2026-113399/CVE-2026-113399Tue, 20 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.5% (higher than 42% of CVEs). CVSS 9.8 CRITICAL. Priority 17.2 of 100.CVE-2026-113867: Thunderbird did not escape attribute values when serializing outgoing XMPP stanzashttps://patchfirst.co/cve/CVE-2026-113867/CVE-2026-113867Tue, 20 Oct 2026 00:00:00 GMTMozilla · Thunderbird. Not in CISA KEV. EPSS 0.4% (higher than 34.1% of CVEs). CVSS 9.1 CRITICAL. Priority 15.1 of 100.CVE-2026-109750: Site isolation issue in the DOM: Web Authentication componenthttps://patchfirst.co/cve/CVE-2026-109750/CVE-2026-109750Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.4% (higher than 32% of CVEs). CVSS 9.6 CRITICAL. Priority 15.4 of 100.CVE-2026-109780: Mitigation bypass in the DOM: Core & HTML componenthttps://patchfirst.co/cve/CVE-2026-109780/CVE-2026-109780Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.4% (higher than 30.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.2 of 100.CVE-2026-109774: Invalid pointer, undefined behavior in the DOM: Notifications componenthttps://patchfirst.co/cve/CVE-2026-109774/CVE-2026-109774Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 27.7% of CVEs). CVSS 9.8 CRITICAL. Priority 14.7 of 100.CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial componenthttps://patchfirst.co/cve/CVE-2026-109745/CVE-2026-109745Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.7 of 100.CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 componenthttps://patchfirst.co/cve/CVE-2026-109740/CVE-2026-109740Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.7 of 100.CVE-2026-109755: Sandbox escape in the DOM: Content Processes componenthttps://patchfirst.co/cve/CVE-2026-109755/CVE-2026-109755Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 27.2% of CVEs). CVSS 9.6 CRITICAL. Priority 14.4 of 100.CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking componenthttps://patchfirst.co/cve/CVE-2026-109708/CVE-2026-109708Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 26.8% of CVEs). CVSS 9.6 CRITICAL. Priority 14.4 of 100.CVE-2026-109707: Sandbox escape due to use-after-free in the Networking componenthttps://patchfirst.co/cve/CVE-2026-109707/CVE-2026-109707Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 25.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.1 of 100.CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking componenthttps://patchfirst.co/cve/CVE-2026-109705/CVE-2026-109705Tue, 13 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 25.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.1 of 100.CVE-2026-106016: Mitigation bypass in the File Handling componenthttps://patchfirst.co/cve/CVE-2026-106016/CVE-2026-106016Tue, 06 Oct 2026 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 24.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.1 of 100.[KEV] CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerabilityhttps://patchfirst.co/cve/CVE-2010-3765/CVE-2010-3765#kevMon, 06 Oct 2025 00:00:00 GMTMozilla · Multiple Products. In CISA KEV since 2025-10-06. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059.007 JavaScript. Priority 69.8 of 100.kevpublic-exploitT1059.007CVE-2025-2857: Incorrect handle could lead to sandbox escapeshttps://patchfirst.co/cve/CVE-2025-2857/CVE-2025-2857Thu, 27 Mar 2025 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 2.0% (higher than 80.5% of CVEs). CVSS 10.0 CRITICAL. Priority 64.7 of 100.[KEV] CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2024-9680/CVE-2024-9680#kevTue, 15 Oct 2024 00:00:00 GMTMozilla · Firefox. In CISA KEV since 2024-10-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 23.2% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 79.4 of 100.kevransomwarepublic-exploitCVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js…https://patchfirst.co/cve/CVE-2024-4367/CVE-2024-4367Tue, 14 May 2024 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 70.7% (higher than 99.39% of CVEs). CVSS 5.6 MEDIUM. Public exploit code exists. Priority 30.4 of 100.public-exploit[KEV] CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2016-9079/CVE-2016-9079#kevThu, 22 Jun 2023 00:00:00 GMTMozilla · Firefox, Firefox ESR, and Thunderbird. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 87.4% (higher than 99.76% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 68.2 of 100.kevpublic-exploitCVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2022-26485/CVE-2022-26485Thu, 22 Dec 2022 00:00:00 GMTMozilla · Firefox. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 14.3% (higher than 96.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.5 of 100.kevpublic-exploitT1189T1203CVE-2022-1802: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…https://patchfirst.co/cve/CVE-2022-1802/CVE-2022-1802Thu, 22 Dec 2022 00:00:00 GMTMozilla · Firefox ESR. Not in CISA KEV. EPSS 28.5% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 67.2 of 100.public-exploitCVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2022-26486/CVE-2022-26486Thu, 22 Dec 2022 00:00:00 GMTMozilla · Firefox. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 2.4% (higher than 83.8% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1068 Exploitation for Privilege Escalation. Priority 66.5 of 100.kevpublic-exploitT1189T1068CVE-2022-28281: If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent…https://patchfirst.co/cve/CVE-2022-28281/CVE-2022-28281Thu, 22 Dec 2022 00:00:00 GMTMozilla · Thunderbird. Not in CISA KEV. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 65.0 of 100.public-exploitCVE-2022-1529: An attacker could have sent a message to the parent process where the contents were used to double-index into a…https://patchfirst.co/cve/CVE-2022-1529/CVE-2022-1529Thu, 22 Dec 2022 00:00:00 GMTMozilla · Firefox ESR. Not in CISA KEV. EPSS 17.6% (higher than 97.1% of CVEs). CVSS 8.8 HIGH. Priority 62.0 of 100.CVE-2022-1097: <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on…https://patchfirst.co/cve/CVE-2022-1097/CVE-2022-1097Thu, 22 Dec 2022 00:00:00 GMTMozilla · Thunderbird. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 6.5 MEDIUM. Priority 53.7 of 100.CVE-2022-34478: The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft…https://patchfirst.co/cve/CVE-2022-34478/CVE-2022-34478Thu, 22 Dec 2022 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.8% (higher than 56.6% of CVEs). CVSS 6.5 MEDIUM. Priority 52.2 of 100.[KEV] CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerabilityhttps://patchfirst.co/cve/CVE-2015-4495/CVE-2015-4495#kevWed, 25 May 2022 00:00:00 GMTMozilla · Firefox. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 68.6% (higher than 99.34% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1005 Data from Local System. Priority 69.0 of 100.kevpublic-exploitT1189T1005[KEV] CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-11708/CVE-2019-11708#kevMon, 23 May 2022 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 55.9% (higher than 99.04% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 69.8 of 100.kevpublic-exploitT1068[KEV] CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-11707/CVE-2019-11707#kevMon, 23 May 2022 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 38.0% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.9 of 100.kevpublic-exploitT1189T1203[KEV] CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerabilityhttps://patchfirst.co/cve/CVE-2013-1690/CVE-2013-1690#kevMon, 28 Mar 2022 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 69.0% (higher than 99.35% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter; T1499 Endpoint Denial of Service. Priority 69.0 of 100.kevpublic-exploitT1189T1059T1499[KEV] CVE-2013-1675: Mozilla Firefox Information Disclosure Vulnerabilityhttps://patchfirst.co/cve/CVE-2013-1675/CVE-2013-1675#kevThu, 03 Mar 2022 00:00:00 GMTMozilla · Firefox. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 93.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1005 Data from Local System. Priority 66.3 of 100.kevpublic-exploitT1189T1005[KEV] CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerabilityhttps://patchfirst.co/cve/CVE-2019-17026/CVE-2019-17026#kevWed, 03 Nov 2021 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 46.3% (higher than 98.8% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.9 of 100.kevpublic-exploitT1059T1189T1203[KEV] CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2020-6819/CVE-2020-6819#kevWed, 03 Nov 2021 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 3.0% (higher than 87.5% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 66.2 of 100.kevpublic-exploit[KEV] CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilityhttps://patchfirst.co/cve/CVE-2020-6820/CVE-2020-6820#kevWed, 03 Nov 2021 00:00:00 GMTMozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.1% (higher than 94.2% of CVEs). CVSS 8.1 HIGH. Priority 62.5 of 100.kevCVE-2021-23957: Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandboxhttps://patchfirst.co/cve/CVE-2021-23957/CVE-2021-23957Fri, 26 Feb 2021 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.8% (higher than 56.3% of CVEs). Priority 46.3 of 100.CVE-2020-15654: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is…https://patchfirst.co/cve/CVE-2020-15654/CVE-2020-15654Mon, 10 Aug 2020 00:00:00 GMTMozilla · Firefox ESR. Not in CISA KEV. EPSS 1.4% (higher than 72.9% of CVEs). Priority 49.6 of 100.CVE-2020-6808: When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML…https://patchfirst.co/cve/CVE-2020-6808/CVE-2020-6808Wed, 25 Mar 2020 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). Priority 13.1 of 100.CVE-2019-11695: A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when…https://patchfirst.co/cve/CVE-2019-11695/CVE-2019-11695Tue, 23 Jul 2019 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 0.7% (higher than 54.4% of CVEs). Priority 45.9 of 100.CVE-2019-9810: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds…https://patchfirst.co/cve/CVE-2019-9810/CVE-2019-9810Fri, 26 Apr 2019 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 27.2% (higher than 98.1% of CVEs). Public exploit code exists. Priority 61.2 of 100.public-exploitCVE-2019-9806: A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed…https://patchfirst.co/cve/CVE-2019-9806/CVE-2019-9806Fri, 26 Apr 2019 00:00:00 GMTMozilla · Firefox. Not in CISA KEV. EPSS 1.1% (higher than 65.1% of CVEs). Priority 48.0 of 100.CVE-2019-9791: The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects…https://patchfirst.co/cve/CVE-2019-9791/CVE-2019-9791Fri, 26 Apr 2019 00:00:00 GMTMozilla · Thunderbird. Not in CISA KEV. EPSS 19.9% (higher than 97.4% of CVEs). Public exploit code exists. Priority 24.5 of 100.public-exploit