mozilla has 182 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 85 in the last 90 days against 33 in the 90 before. The busiest recent month was September 2026 with 79. The median CVSS is 8.8 (high), with 40 rated critical. 2% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-416 (37) and CWE-119 (25). Most affected products: Firefox (149), firefox_mobile (27), thunderbird (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —(1)
- Last 90 days
- 85 prev 33
Weakness classes
Products
- Firefox 149
- firefox_mobile 27
- thunderbird 3
- firefox_focus 2
- Firefox for iOS 1
Worst active — by depth score
CVE-2024-9680Critical· 9.8An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines89CVE-2022-26486Critical· 9.6An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape78CVE-2022-26485High· 8.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free76CVE-2026-74943Critical· 9.8Use-after-free in the Graphics: ImageLib component66CVE-2026-74936Critical· 9.8Use-after-free in the JavaScript: WebAssembly component66
mozilla vulnerabilities
CVEs affecting mozilla, newest first. Open any entry for full detail, references, and exploit status.
182 CVEsRSS
CVE-2023-29540Medium· 6.1Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox fo…
CVE-2023-29539High· 8.8When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to inst…
CVE-2023-29538Medium· 4.3Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability af…
CVE-2023-29537High· 7.5Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVE-2023-29536High· 8.8An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash
An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 11…
CVE-2023-29535Medium· 6.5Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for And…
CVE-2023-29533Medium· 4.3A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user conf…
CVE-2019-17003Medium· 6.1Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
CVE-2022-38474Medium· 4.3A website that had permission to access the microphone could record audio without the audio notification being shown
A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once perm…
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.
CVE-2022-26486Critical· 9.6CISA KEV0dayAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.…
CVE-2022-26485High· 8.8CISA KEV0dayPoCRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for A…
CVE-2021-29993High· 8.1Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs
Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affect…
CVE-2020-26977Medium· 6.5By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain
By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating sy…
CVE-2020-26975Medium· 6.5When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation
When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resol…
CVE-2020-26964Medium· 6.8If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interac…
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interac…
CVE-2020-26957Medium· 6.5OneCRL was non-functional in the new Firefox for Android due to a missing service initialization
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operatin…
CVE-2020-26955Medium· 6.5When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in privat…
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in privat…
CVE-2020-26954Medium· 4.3When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI s…
CVE-2020-6829Medium· 5.3When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation
When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature gener…
CVE-2020-12401Medium· 4.7During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 an…
CVE-2020-12400Medium· 4.7When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CVE-2020-15664Medium· 6.5By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension
By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user con…
CVE-2020-15671Low· 3.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary
When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerabilit…
CVE-2020-15670High· 8.8Mozilla developers reported memory safety bugs present in Firefox for Android 79
Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod…
CVE-2020-15668Medium· 4.3A lock was missing when accessing a data structure and importing certificate information into the trust database
A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CVE-2020-15666Medium· 6.5When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerro…
CVE-2020-15662Medium· 6.5A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
CVE-2020-15661Medium· 6.5A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.
CVE-2020-12414Medium· 6.5IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulne…