FI
Browser
Firefox
On CISA KEVExploited in the wildRansomware-linked
3,445
CVEs
15
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 489High 10Medium 1Low 0
Watch
Add Firefox to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16360 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16412 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 Affected: before 153.0.0; 140.1.0 before 140.13.0 |
| CVE-2026-16411 | 9.8 | Jul 21 | Memory safety bugs fixed in Thunderbird 153 Affected: before 153.0.0 |
| CVE-2026-16410 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript Engine: JIT component Affected: before 153.0.0 |
| CVE-2026-16408 | 9.8 | Jul 21 | Integer overflow in the Audio/Video: Playback component Affected: before 153.0.0 |
| CVE-2026-16407 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Service Workers component Affected: before 153.0.0 |
| CVE-2026-16402 | 9.8 | Jul 21 | Integer overflow in the Graphics: ImageLib component Affected: before 153.0.0 |
| CVE-2026-16395 | 9.8 | Jul 21 | Integer overflow in the Audio/Video component Affected: before 153.0.0 |
| CVE-2026-16389 | 9.8 | Jul 21 | Incorrect boundary conditions, integer overflow in the Libraries component in NSS Affected: before 153.0.0 |
| CVE-2026-16388 | 9.8 | Jul 21 | Sandbox escape in the DOM: Networking component Affected: before 153.0.0 |
| CVE-2026-16387 | 9.8 | Jul 21 | Site isolation issue in the Networking component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16383 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Networking component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16382 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Service Workers component Affected: before 153.0.0 |
| CVE-2026-16358 | 9.8 | Jul 21 | Site isolation issue in the Graphics: WebRender component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16377 | 9.8 | Jul 21 | Mitigation bypass in the PDF Viewer component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16375 | 9.8 | Jul 21 | Site isolation issue in the Networking: HTTP component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16357 | 9.8 | Jul 21 | Incorrect boundary conditions in the Graphics component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16356 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16355 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript Engine: JIT component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16369 | 9.8 | Jul 21 | Integer overflow in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16368 | 9.8 | Jul 21 | Incorrect boundary conditions in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16353 | 9.8 | Jul 21 | Invalid pointer in the DOM: Bindings (WebIDL) component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16363 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript: WebAssembly component Affected: before 140.13.0; before 153.0.0 |
| CVE-2026-16352 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16351 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the DOM: Navigation component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16350 | 9.8 | Jul 21 | Incorrect boundary conditions in the Audio/Video: cubeb component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-16349 | 9.8 | Jul 21 | Same-origin policy bypass in the DOM: Navigation component Affected: before 115.38.0; before 153.0.0; 128.1.0 before 140.13.0 |
| CVE-2026-14241 | 9.8 | Jun 30 | Memory safety bugs fixed in Firefox 152.0.4 Affected: 152.0.3 |
| CVE-2026-12293 | 9.8 | Jun 16 | Use-after-free in the Graphics: WebGPU component Affected: before 152.0.0 |
| CVE-2026-8956 | 9.8 | May 19 | Integer overflow in the Networking: JAR component Affected: before 140.11.0; before 151.0.0 |
| CVE-2026-8401 | 9.8 | May 12 | Sandbox escape in the Profile Backup component Affected: before 150.0.3 |
| CVE-2026-8094 | 9.8 | May 7 | Other issue in the WebRTC component Affected: before 140.10.2 |
| CVE-2026-8091 | 9.8 | May 7 | Incorrect boundary conditions in the Audio/Video: Playback component Affected: before 115.35.2; 140.0 before 140.10.1 |
| CVE-2026-6771 | 9.8 | Apr 21 | Mitigation bypass in the DOM: Security component Affected: before 150.0; 140.0 before 140.10.0 |
| CVE-2026-6768 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6760 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6748 | 9.8 | Apr 21 | Uninitialized memory in the Audio/Video: Web Codecs component Affected: before 140.10.0; before 150.0 |
| CVE-2026-5735 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 149.0.2 |
| CVE-2026-5734 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 140.9.1; before 149.0.2 |
| CVE-2026-5731 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 Affected: 115.34.0; 140.9.0; 149.0.1 |
| CVE-2026-4721 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 Affected: before 115.34.0; before 149.0; 128.0 before 140.9.0 |
| CVE-2026-4729 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox 149 and Thunderbird 149 Affected: before 149.0 |
| CVE-2026-4720 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 Affected: before 140.9.0; before 149.0 |
| CVE-2026-4717 | 9.8 | Mar 24 | Privilege escalation in the Netmonitor component Affected: before 140.9.0; before 149.0 |
| CVE-2026-4711 | 9.8 | Mar 24 | Use-after-free in the Widget: Cocoa component Affected: before 140.9.0; before 149.0 |
| CVE-2026-4710 | 9.8 | Mar 24 | Incorrect boundary conditions in the Audio/Video component Affected: before 140.9.0; before 149.0 |
| CVE-2026-4705 | 9.8 | Mar 24 | Undefined behavior in the WebRTC: Signaling component Affected: before 140.9.0; before 149.0 |
| CVE-2026-4723 | 9.8 | Mar 24 | Use-after-free in the JavaScript Engine component Affected: before 149.0 |
| CVE-2026-4702 | 9.8 | Mar 24 | JIT miscompilation in the JavaScript Engine component Affected: before 140.9.0; before 149.0 |
| CVE-2026-4701 | 9.8 | Mar 24 | Use-after-free in the JavaScript Engine component Affected: before 140.9.0; before 149.0 |
The 500 most important CVEs for this product (exploited first, then by severity)