Patchfirst
Patchfirst

Vendor

Mozilla

13 of 39 Mozilla CVEs in Patchfirst (33%) are in of vulnerabilities exploited in the wild, 1 of them used by ransomware.

CVEs
39
In CISA KEV
1333%
Known ransomware use
1
Median days to KEV
1,035
from publication
Latest KEV listing
6 Oct 2025
Watch Mozilla Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs
  • Firefox and Thunderbird In KEV: 6 CVEs: 6
  • Firefox In KEV: 5 CVEs: 24
  • Firefox, Firefox ESR, and Thunderbird In KEV: 1 CVEs: 1
  • Multiple Products In KEV: 1 CVEs: 1
  • Thunderbird In KEV: 0 CVEs: 4
  • Firefox ESR In KEV: 0 CVEs: 3

Top ATT&CK techniques

What attackers do with Mozilla CVEs
Open in ATT&CK Navigator

Counts are Mozilla CVEs linked to the technique. Each link’s provenance is on the CVE page.

Mozilla CVEs

39 CVEs, by priority
  1. CVE-2024-9680Mozilla Firefox Use-After-Free Vulnerability
    Mozilla · FirefoxKEVRansomwarePublic exploitCritical · 9.8
    23.2%Top 2.2%
    79.4priority
  2. CVE-2019-11708Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
    Mozilla · Firefox and ThunderbirdKEVPublic exploitCritical · 10.0T1068Exploitation for Privilege Escalation
    55.9%Top 0.96%
    69.8priority
  3. CVE-2010-3765Mozilla Multiple Products Remote Code Execution Vulnerability
    Mozilla · Multiple ProductsKEVPublic exploitCritical · 9.8T1059.007JavaScript
    83.2%Top 0.32%
    69.8priority
  4. CVE-2015-4495Mozilla Firefox Security Feature Bypass Vulnerability
    Mozilla · FirefoxKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1005Data from Local System
    68.6%Top 0.66%
    69.0priority
  5. CVE-2013-1690Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
    Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 more
    69.0%Top 0.65%
    69.0priority
  6. CVE-2019-17026Mozilla Firefox And Thunderbird Type Confusion Vulnerability
    Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1059Command and Scripting Interpreter+1 more
    46.3%Top 1.2%
    68.9priority
  7. CVE-2019-11707Mozilla Firefox and Thunderbird Type Confusion Vulnerability
    Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution
    38.0%Top 1.5%
    68.9priority
  8. CVE-2022-26485Mozilla Firefox Use-After-Free Vulnerability
    Mozilla · FirefoxKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution
    14.3%Top 3.4%
    68.5priority
  9. CVE-2016-9079Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability
    Mozilla · Firefox, Firefox ESR, and ThunderbirdKEVPublic exploitHigh · 7.5
    87.4%Top 0.24%
    68.2priority
  10. CVE-2022-1802If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…
    Mozilla · Firefox ESRPublic exploitHigh · 8.8
    28.5%Top 1.9%
    67.2priority
  11. CVE-2022-26486Mozilla Firefox Use-After-Free Vulnerability
    Mozilla · FirefoxKEVPublic exploitCritical · 9.6T1189Drive-by CompromiseT1068Exploitation for Privilege Escalation
    2.4%Top 16%
    66.5priority
  12. CVE-2013-1675Mozilla Firefox Information Disclosure Vulnerability
    Mozilla · FirefoxKEVPublic exploitMedium · 6.5T1189Drive-by CompromiseT1005Data from Local System
    6.7%Top 6.1%
    66.3priority
  13. CVE-2020-6819Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
    Mozilla · Firefox and ThunderbirdKEVPublic exploitHigh · 8.1
    3.0%Top 13%
    66.2priority
  14. CVE-2022-28281If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent…
    Mozilla · ThunderbirdPublic exploitHigh · 8.8
    2.8%Top 14%
    65.0priority
  15. CVE-2025-2857Incorrect handle could lead to sandbox escapes
    Mozilla · FirefoxCritical · 10.0
    2.0%Top 20%
    64.7priority
  16. CVE-2020-6820Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
    Mozilla · Firefox and ThunderbirdKEVHigh · 8.1
    7.1%Top 5.8%
    62.5priority
  17. CVE-2022-1529An attacker could have sent a message to the parent process where the contents were used to double-index into a…
    Mozilla · Firefox ESRHigh · 8.8
    17.6%Top 2.9%
    62.0priority
  18. CVE-2019-9810Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds…
    Mozilla · FirefoxPublic exploit
    27.2%Top 1.9%
    61.2priority
  19. CVE-2022-1097<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on…
    Mozilla · ThunderbirdMedium · 6.5
    1.0%Top 39%
    53.7priority
  20. CVE-2022-34478The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft…
    Mozilla · FirefoxMedium · 6.5
    0.8%Top 43%
    52.2priority
  21. CVE-2020-15654When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is…
    Mozilla · Firefox ESR
    1.4%Top 27%
    49.6priority
  22. CVE-2019-9806A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed…
    Mozilla · Firefox
    1.1%Top 35%
    48.0priority
  23. CVE-2021-23957Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox
    Mozilla · Firefox
    0.8%Top 44%
    46.3priority
  24. CVE-2019-11695A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when…
    Mozilla · Firefox
    0.7%Top 46%
    45.9priority
  25. CVE-2024-4367A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js…
    Mozilla · FirefoxPublic exploitMedium · 5.6
    70.7%Top 0.61%
    30.4priority
  26. CVE-2019-9791The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects…
    Mozilla · ThunderbirdPublic exploit
    19.9%Top 2.6%
    24.5priority
  27. CVE-2026-113399Incorrect boundary conditions in the SVG component
    Mozilla · FirefoxCritical · 9.8
    0.5%Top 58%
    17.2priority
  28. CVE-2026-109750Site isolation issue in the DOM: Web Authentication component
    Mozilla · FirefoxCritical · 9.6
    0.4%Top 68%
    15.4priority
  29. CVE-2026-109780Mitigation bypass in the DOM: Core & HTML component
    Mozilla · FirefoxCritical · 9.8
    0.4%Top 70%
    15.2priority
  30. CVE-2026-113867Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas
    Mozilla · ThunderbirdCritical · 9.1
    0.4%Top 66%
    15.1priority
  31. CVE-2026-109774Invalid pointer, undefined behavior in the DOM: Notifications component
    Mozilla · FirefoxCritical · 9.8
    0.3%Top 72%
    14.7priority
  32. CVE-2026-109745Sandbox escape due to uninitialized memory in the DOM: Web Serial component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 71%
    14.7priority
  33. CVE-2026-109740Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 71%
    14.7priority
  34. CVE-2026-109755Sandbox escape in the DOM: Content Processes component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 73%
    14.4priority
  35. CVE-2026-109708Sandbox escape due to incorrect boundary conditions in the Networking component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 73%
    14.4priority
  36. CVE-2026-109707Sandbox escape due to use-after-free in the Networking component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 74%
    14.1priority
  37. CVE-2026-109705Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component
    Mozilla · FirefoxCritical · 9.6
    0.3%Top 74%
    14.1priority
  38. CVE-2026-106016Mitigation bypass in the File Handling component
    Mozilla · FirefoxCritical · 9.8
    0.3%Top 75%
    14.1priority
  39. CVE-2020-6808When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML…
    Mozilla · Firefox
    1.1%Top 34%
    13.1priority
↑ ↓ chooseEnter openEsc close