mozilla has 182 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 85 in the last 90 days against 33 in the 90 before. The busiest recent month was September 2026 with 79. The median CVSS is 8.8 (high), with 40 rated critical. 2% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (37) and CWE-119 (25). Most affected products: Firefox (149), firefox_mobile (27), thunderbird (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —(1)
- Last 90 days
- 85 prev 33
Weakness classes
Products
- Firefox 149
- firefox_mobile 27
- thunderbird 3
- firefox_focus 2
- Firefox for iOS 1
Worst active — by depth score
CVE-2024-9680Critical· 9.8An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines89CVE-2022-26486Critical· 9.6An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape78CVE-2022-26485High· 8.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free76CVE-2026-74943Critical· 9.8Use-after-free in the Graphics: ImageLib component66CVE-2026-74936Critical· 9.8Use-after-free in the JavaScript: WebAssembly component66
Mozilla vulnerabilities
CVEs affecting Mozilla, newest first. Open any entry for full detail, references, and exploit status.
182 CVEsRSS
CVE-2020-12404Medium· 4.3For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.
CVE-2020-6830High· 7.5For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was als…