Mozilla Firefox Open source web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Mozilla Firefox.
Recent Mozilla Firefox Security Advisories
| Advisory | Title | Published |
|---|---|---|
| mfsa2026-126 | Security Vulnerabilities fixed in Firefox ESR 115.45 mfsa2026-126 | November 10, 2026 |
| mfsa2026-125 | Security Vulnerabilities fixed in Firefox 160 mfsa2026-125 | November 10, 2026 |
| mfsa2026-127 | Security Vulnerabilities fixed in Firefox ESR 153.7 mfsa2026-127 | November 10, 2026 |
| mfsa2026-124 | Security Vulnerabilities fixed in Firefox for iOS 160.0 mfsa2026-124 | November 9, 2026 |
| mfsa2026-123 | Security Vulnerabilities fixed in Firefox 159.0.1 mfsa2026-123 | November 3, 2026 |
| mfsa2026-118 | Security Vulnerabilities fixed in Firefox 159 mfsa2026-118 | October 27, 2026 |
| mfsa2026-119 | Security Vulnerabilities fixed in Firefox ESR 115.44 mfsa2026-119 | October 27, 2026 |
| mfsa2026-120 | Security Vulnerabilities fixed in Firefox ESR 153.6 mfsa2026-120 | October 27, 2026 |
| mfsa2026-117 | Security Vulnerabilities fixed in Firefox for iOS 156.1 mfsa2026-117 | October 26, 2026 |
| mfsa2026-116 | Security Vulnerabilities fixed in Firefox for Android 158.0.2 mfsa2026-116 | October 21, 2026 |
Known Exploited Mozilla Firefox Vulnerabilities
The following Mozilla Firefox vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. CVE-2024-9680 Exploit Probability: 23.2% |
October 15, 2024 |
| Mozilla Firefox Security Feature Bypass Vulnerability |
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. CVE-2015-4495 Exploit Probability: 68.6% |
May 25, 2022 |
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. CVE-2022-26486 Exploit Probability: 2.4% |
March 7, 2022 |
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. CVE-2022-26485 Exploit Probability: 14.3% |
March 7, 2022 |
| Mozilla Firefox Information Disclosure Vulnerability |
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. CVE-2013-1675 Exploit Probability: 6.7% |
March 3, 2022 |
The vulnerability CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited Mozilla Firefox vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Mozilla Firefox. Here are some end of life, and end of support dates for Mozilla Firefox.
| Release | EOL Date | Status |
|---|---|---|
| 159 | November 10, 2026 |
EOL
Mozilla Firefox 159 became EOL in 2026. |
| 158 | October 27, 2026 |
EOL
Mozilla Firefox 158 became EOL in 2026. |
| 157 | October 13, 2026 |
EOL
Mozilla Firefox 157 became EOL in 2026. |
| 156 | September 29, 2026 |
EOL
Mozilla Firefox 156 became EOL in 2026. |
| 155 | September 15, 2026 |
EOL
Mozilla Firefox 155 became EOL in 2026. |
| 154 | September 1, 2026 |
EOL
Mozilla Firefox 154 became EOL in 2026. |
| 153 | - |
Active
|
| 152 | July 21, 2026 |
EOL
Mozilla Firefox 152 became EOL in 2026. |
| 151 | June 16, 2026 |
EOL
Mozilla Firefox 151 became EOL in 2026. |
| 150 | May 18, 2026 |
EOL
Mozilla Firefox 150 became EOL in 2026. |
| 149 | April 21, 2026 |
EOL
Mozilla Firefox 149 became EOL in 2026. |
| 148 | March 24, 2026 |
EOL
Mozilla Firefox 148 became EOL in 2026. |
| 147 | February 24, 2026 |
EOL
Mozilla Firefox 147 became EOL in 2026. |
| 146 | January 13, 2026 |
EOL
Mozilla Firefox 146 became EOL in 2026. |
| 145 | December 9, 2025 |
EOL
Mozilla Firefox 145 became EOL in 2025. |
| 144 | November 11, 2025 |
EOL
Mozilla Firefox 144 became EOL in 2025. |
| 143 | October 14, 2025 |
EOL
Mozilla Firefox 143 became EOL in 2025. |
| 142 | September 16, 2025 |
EOL
Mozilla Firefox 142 became EOL in 2025. |
| 141 | August 19, 2025 |
EOL
Mozilla Firefox 141 became EOL in 2025. |
| 140 | September 29, 2026 |
EOL
Mozilla Firefox 140 became EOL in 2026. |
By the Year
In 2026 there have been 929 vulnerabilities in Mozilla Firefox with an average score of 7.9 out of ten. Last year, in 2025 Firefox had 189 security vulnerabilities published. That is, 740 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.35.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 929 | 7.90 |
| 2025 | 189 | 7.54 |
| 2024 | 190 | 7.15 |
| 2023 | 180 | 7.38 |
| 2022 | 159 | 7.44 |
| 2021 | 123 | 7.13 |
| 2020 | 148 | 7.27 |
| 2019 | 121 | 7.44 |
| 2018 | 312 | 7.82 |
It may take a day or so for new Firefox vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Mozilla Firefox Security Vulnerabilities
Firefox ESR <115.45 Audio/Video Use-After-Free
CVE-2026-124952
8.8 - High
- November 10, 2026
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.
Dangling pointer
Firefox CSS SOP Bypass (CVE-2026-124950)
CVE-2026-124950
- November 10, 2026
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124949 SVG Component Flaw in Mozilla Firefox
CVE-2026-124949
- November 10, 2026
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Graphics Component Boundary Condition OOB
CVE-2026-124947
8.8 - High
- November 10, 2026
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Classic Buffer Overflow
Firefox JIT Invalid Pointer Exploit (CVE-2026-124946)
CVE-2026-124946
- November 10, 2026
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Layout Text & Fonts Invalid Pointer Deref
CVE-2026-124945
- November 10, 2026
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Marionette Info Disclosure (CVE-2026-124944)
CVE-2026-124944
4.3 - Medium
- November 10, 2026
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Information Disclosure
Firefox Layout Component Use-After-Free
CVE-2026-124943
8.8 - High
- November 10, 2026
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox for Android Media Component Vulnerability (CVE-2026-124937)
CVE-2026-124937
- November 10, 2026
Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160.
Firefox Address Bar Spoofing (CVE-2026-124936)
CVE-2026-124936
- November 10, 2026
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Layout Component Info Disclosure (CVE2026124925)
CVE-2026-124925
4.3 - Medium
- November 10, 2026
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Information Disclosure
Firefox SVG Mitigation Bypass (CVE-2026-124928)
CVE-2026-124928
- November 10, 2026
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox WebGPU Sandbox Escape (CVE-2026-124921)
CVE-2026-124921
- November 10, 2026
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Agent Sandbox Escape (CVE-2026-124923)
CVE-2026-124923
- November 10, 2026
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Firefox Android Autofill Clickjacking
CVE-2026-124911
- November 10, 2026
Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.
Firefox WebGPU Uninitialized Memory
CVE-2026-124920
- November 10, 2026
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Use-after-Free in Firefox CSS Parsing Component (CVE-2026-124908)
CVE-2026-124908
8.8 - High
- November 10, 2026
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox Service Worker UAF Sandbox Escape (CVE-2026-124900)
CVE-2026-124900
9.6 - Critical
- November 10, 2026
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox SVG Use-After-Free (CVE-2026-124904)
CVE-2026-124904
8.8 - High
- November 10, 2026
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox Use-After-Free in Layout Positioned Component (CVE-2026-124878)
CVE-2026-124878
8.8 - High
- November 10, 2026
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox HTML Parser Use-After-Free (DOM)
CVE-2026-124871
8.8 - High
- November 10, 2026
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox Use-After-Free in DOM Editor Component (CVE-2026-124867)
CVE-2026-124867
8.8 - High
- November 10, 2026
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Dangling pointer
Firefox CanvasWebGL OOB Boundary Condition Vulnerability
CVE-2026-124852
8.8 - High
- November 10, 2026
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
Classic Buffer Overflow
Firefox <160 / ESR <153.7 Nimbus Desktop Client PrivEsc
CVE-2026-124951
- November 10, 2026
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox Graphics Use-After-Free (pre-160)
CVE-2026-124948
8.8 - High
- November 10, 2026
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Buffer Overflow
Firefox DOM Streams Invalid Pointer Deref Fixed in 160/153.7
CVE-2026-124942
- November 10, 2026
Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 (RLBox) Info Disclosure
CVE-2026-124941
4.3 - Medium
- November 10, 2026
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Information Disclosure
Firefox <160/153.7 File Handling Mitigation Bypass
CVE-2026-124940
- November 10, 2026
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox Add-ons Manager Mitigation Bypass (fixed in 160, ESR 153.7)
CVE-2026-124938
- November 10, 2026
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 JIT miscompilation in JS Engine (component)
CVE-2026-124939
- November 10, 2026
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 (ESR <153.7) WebRTC Networking UB
CVE-2026-124935
- November 10, 2026
Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox < 160 Console sandbox escape (CVE-2026-124933)
CVE-2026-124933
- November 10, 2026
Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 Security component spoofing (CVE-2026-124934)
CVE-2026-124934
- November 10, 2026
Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox < 160 Same-Origin Policy Bypass in DOM Core/HTML
CVE-2026-124931
- November 10, 2026
Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox 160/ESR 153.7 Use-After-Free in Graphics Component
CVE-2026-124932
8.8 - High
- November 10, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Dangling pointer
Firefox <160, <153.7 ESR Address Bar Info Disclosure (CVE-2026-124930)
CVE-2026-124930
4.3 - Medium
- November 10, 2026
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Information Disclosure
Firefox 160/ESR 153.7 Layout Form Controls Info Disclosure
CVE-2026-124929
4.3 - Medium
- November 10, 2026
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Information Disclosure
Firefox <160 / ESR 153.7 WebRender site isolation flaw
CVE-2026-124927
- November 10, 2026
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 / ESR 153.7 WebRTC OOB boundary condition
CVE-2026-124926
8.8 - High
- November 10, 2026
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Classic Buffer Overflow
Firefox WebRender OOB Write before 160 (fixed in 160)
CVE-2026-124924
8.8 - High
- November 10, 2026
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Classic Buffer Overflow
Firefox 160/ESR 153.7 WebRTC Networking UseAfterFree PrivEsc
CVE-2026-124919
8.8 - High
- November 10, 2026
Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Dangling pointer
Firefox <160 Use-After-Free in CSS Transitions/Animations
CVE-2026-124922
8.8 - High
- November 10, 2026
Use-after-free in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Dangling pointer
Firefox <160 (ESR <153.7) UAF in Gtk Widget sandbox escape
CVE-2026-124917
9.6 - Critical
- November 10, 2026
Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox <160 WebRender OOBE PrivEsc
CVE-2026-124918
8.8 - High
- November 10, 2026
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Classic Buffer Overflow
Firefox before 160 (ESR 153.7) - WebGPU boundary condition flaw
CVE-2026-124915
8.8 - High
- November 10, 2026
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Classic Buffer Overflow
Firefox <160 Site Isolation Nav DOM issue
CVE-2026-124914
- November 10, 2026
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Mozilla Firefox Networking Site Isolation Bypass (pre-160, pre-153.7)
CVE-2026-124913
- November 10, 2026
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox WebExtensions mitigation bypass (fixed in 160, ESR 153.7)
CVE-2026-124910
- November 10, 2026
Mitigation bypass in the WebExtensions component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox < 160, 153.7 DOM Security Component Spoofing
CVE-2026-124912
- November 10, 2026
Spoofing issue in the DOM: Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Firefox Private Browsing Info Disclosure (fixed in 160, ESR 153.7)
CVE-2026-124909
4.3 - Medium
- November 10, 2026
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.
Information Disclosure
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Mozilla Firefox or by Mozilla? Click the Watch button to subscribe.
