FI
Browser
Firefox
On CISA KEVExploited in the wildRansomware-linked
3,445
CVEs
15
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 489High 10Medium 1Low 0
Watch
Add Firefox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-74988 | 9.8 | Aug 18 | Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154 Affected: before 153.1.0; before 153.1.0 |
| CVE-2026-74985 | 9.8 | Aug 18 | Privilege escalation in the Enterprise Policies component Affected: before 153.1.0 |
| CVE-2026-74979 | 9.8 | Aug 18 | Mitigation bypass in the Add-ons Manager component Affected: before 153.1.0; before 154.0.0 |
| CVE-2026-74990 | 9.8 | Aug 18 | Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 Affected: before 115.39.0; 116.0 before 140.14.0; 141.0 before 153.1.0 |
| CVE-2026-74987 | 9.8 | Aug 18 | Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 Affected: before 140.14.0; 141.0 before 153.1.0 |
| CVE-2026-74964 | 9.8 | Aug 18 | Integer overflow in the Graphics component Affected: before 140.14.0; 141.0.0 before 153.1.0 |
| CVE-2026-74944 | 9.8 | Aug 18 | Use-after-free in the DOM: Core & HTML component Affected: before 140.14.0; 141.0.0 before 153.1.0 |
| CVE-2026-74943 | 9.8 | Aug 18 | Use-after-free in the Graphics: ImageLib component Affected: before 115.39.0; 116.0 before 140.14.0; 141.0 before 153.1.0 |
| CVE-2026-74940 | 9.8 | Aug 18 | Use-after-free in the Graphics: Text component Affected: before 115.39.0; 116.0 before 140.14.0; 141.0 before 154.0.0 |
| CVE-2026-74936 | 9.8 | Aug 18 | Use-after-free in the JavaScript: WebAssembly component Affected: before 140.14.0; 141.0.0 before 153.1.0 |
| CVE-2026-16361 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird ESR 140.13 Affected: before 115.38.0; 128.1.0 before 140.13.0 |
| CVE-2026-16360 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16412 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 Affected: before 153.0.0; 140.1.0 before 140.13.0 |
| CVE-2026-16411 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird 153 Affected: before 153.0.0 |
| CVE-2026-16410 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript Engine: JIT component Affected: before 153.0.0 |
| CVE-2026-16408 | 9.8 | Jul 21 | Integer overflow in the Audio/Video: Playback component Affected: before 153.0.0 |
| CVE-2026-16407 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Service Workers component Affected: before 153.0.0 |
| CVE-2026-16402 | 9.8 | Jul 21 | Integer overflow in the Graphics: ImageLib component Affected: before 153.0.0 |
| CVE-2026-16395 | 9.8 | Jul 21 | Integer overflow in the Audio/Video component Affected: before 153.0.0 |
| CVE-2026-16389 | 9.8 | Jul 21 | Incorrect boundary conditions, integer overflow in the Libraries component in NSS Affected: before 153.0.0 |
| CVE-2026-16388 | 9.8 | Jul 21 | Sandbox escape in the DOM: Networking component Affected: before 153.0.0 |
| CVE-2026-16387 | 9.8 | Jul 21 | Site isolation issue in the Networking component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16383 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Networking component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16382 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Service Workers component Affected: before 153.0.0 |
| CVE-2026-16358 | 9.8 | Jul 21 | Site isolation issue in the Graphics: WebRender component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16377 | 9.8 | Jul 21 | Mitigation bypass in the PDF Viewer component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16375 | 9.8 | Jul 21 | Site isolation issue in the Networking: HTTP component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16357 | 9.8 | Jul 21 | Incorrect boundary conditions in the Graphics component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16356 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16355 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript Engine: JIT component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16369 | 9.8 | Jul 21 | Integer overflow in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16368 | 9.8 | Jul 21 | Incorrect boundary conditions in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16353 | 9.8 | Jul 21 | Invalid pointer in the DOM: Bindings (WebIDL) component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16363 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16352 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16351 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the DOM: Navigation component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16350 | 9.8 | Jul 21 | Incorrect boundary conditions in the Audio/Video: cubeb component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16349 | 9.8 | Jul 21 | Same-origin policy bypass in the DOM: Navigation component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-14241 | 9.8 | Jun 30 | Memory safety bugs fixed in Firefox 152.0.4 Affected: 152.0.3 |
| CVE-2026-12293 | 9.8 | Jun 16 | Use-after-free in the Graphics: WebGPU component Affected: before 152.0.0 |
| CVE-2026-8956 | 9.8 | May 19 | Integer overflow in the Networking: JAR component Affected: before 140.11.0; before 151.0.0 |
| CVE-2026-8401 | 9.8 | May 12 | Sandbox escape in the Profile Backup component Affected: before 150.0.3 |
| CVE-2026-8094 | 9.8 | May 7 | Other issue in the WebRTC component Affected: before 140.10.2 |
| CVE-2026-8091 | 9.8 | May 7 | Incorrect boundary conditions in the Audio/Video: Playback component Affected: before 115.35.2; 140.0 before 140.10.1 |
| CVE-2026-6771 | 9.8 | Apr 21 | Mitigation bypass in the DOM: Security component Affected: before 150.0; 140.0 before 140.10.0 |
| CVE-2026-6768 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6760 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6748 | 9.8 | Apr 21 | Uninitialized memory in the Audio/Video: Web Codecs component Affected: before 140.10.0; before 150.0 |
| CVE-2026-5735 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 149.0.2 |
| CVE-2026-5734 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 140.9.1; before 149.0.2 |
The 500 most important CVEs for this product (exploited first, then by severity)