mozilla has 181 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 86 in the last 90 days against 33 in the 90 before. The busiest recent month was September 2026 with 80. The median CVSS is 8.4 (high), with 33 rated critical. 2% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (36) and CWE-825 (21). Most affected products: Firefox (147), firefox_mobile (27), Thunderbird (4).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 2% vs 1% corpus
Median CVSS: 8.4
Publish → KEV: —(1)
Last 90 days: 86 prev 33

Weakness classes

Products

Firefox 147
firefox_mobile 27
Thunderbird 4
firefox_focus 2
Firefox for iOS 1

Follow mozilla:RSS feed Save a search →Embed badge ↗

181

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

mozilla vulnerabilities

CVEs affecting mozilla, newest first. Open any entry for full detail, references, and exploit status.

181 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

mozilla vulnerabilities

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird

A maliciously constructed IMAP line could cause an out-of-bounds buffer read

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations

Mitigation bypass in the Widget: Win32 component

Denial-of-service in the Security component

Denial-of-service in the SVG component

Incorrect boundary conditions in the Networking component

Mitigation bypass in the Networking component

Mitigation bypass in the Popup Blocker component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation in the WebExtensions component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Use-after-free in the Audio/Video: Web Codecs component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation due to incorrect boundary conditions in the Graphics component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Use-after-free in the Disability Access APIs component

Privilege escalation in the DOM: Service Workers component

Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

Mitigation bypass in the Remote Settings Client component

Sandbox escape in the DOM: Core & HTML component

Use-after-free in the XML component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the Networking component

Use-after-free in the SVG component

Use-after-free in the DOM: HTML Parser component