Mozilla Firefox Open source web browser
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Mozilla Firefox.
Recent Mozilla Firefox Security Advisories
| Advisory | Title | Published |
|---|---|---|
| mfsa2026-123 | Security Vulnerabilities fixed in Firefox 159.0.1 mfsa2026-123 | November 3, 2026 |
| mfsa2026-118 | Security Vulnerabilities fixed in Firefox 159 mfsa2026-118 | October 27, 2026 |
| mfsa2026-119 | Security Vulnerabilities fixed in Firefox ESR 115.44 mfsa2026-119 | October 27, 2026 |
| mfsa2026-120 | Security Vulnerabilities fixed in Firefox ESR 153.6 mfsa2026-120 | October 27, 2026 |
| mfsa2026-117 | Security Vulnerabilities fixed in Firefox for iOS 156.1 mfsa2026-117 | October 26, 2026 |
| mfsa2026-116 | Security Vulnerabilities fixed in Firefox for Android 158.0.2 mfsa2026-116 | October 21, 2026 |
| mfsa2026-113 | Security Vulnerabilities fixed in Firefox ESR 115.43.1 mfsa2026-113 | October 20, 2026 |
| mfsa2026-111 | Security Vulnerabilities fixed in Firefox 158.0.1 mfsa2026-111 | October 20, 2026 |
| mfsa2026-112 | Security Vulnerabilities fixed in Firefox ESR 153.5.1 mfsa2026-112 | October 20, 2026 |
| mfsa2026-108 | Security Vulnerabilities fixed in Firefox ESR 153.5 mfsa2026-108 | October 13, 2026 |
Known Exploited Mozilla Firefox Vulnerabilities
The following Mozilla Firefox vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. CVE-2024-9680 Exploit Probability: 23.2% |
October 15, 2024 |
| Mozilla Firefox Security Feature Bypass Vulnerability |
Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. CVE-2015-4495 Exploit Probability: 68.6% |
May 25, 2022 |
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. CVE-2022-26486 Exploit Probability: 2.4% |
March 7, 2022 |
| Mozilla Firefox Use-After-Free Vulnerability |
Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. CVE-2022-26485 Exploit Probability: 14.3% |
March 7, 2022 |
| Mozilla Firefox Information Disclosure Vulnerability |
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. CVE-2013-1675 Exploit Probability: 6.7% |
March 3, 2022 |
The vulnerability CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability is in the top 1% of the currently known exploitable vulnerabilities. 2 known exploited Mozilla Firefox vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
EOL Dates
Ensure that you are using a supported version of Mozilla Firefox. Here are some end of life, and end of support dates for Mozilla Firefox.
| Release | EOL Date | Status |
|---|---|---|
| 159 | November 10, 2026 |
EOL This Year
Mozilla Firefox 159 will become EOL this year, in November 2026. |
| 158 | October 27, 2026 |
EOL
Mozilla Firefox 158 became EOL in 2026. |
| 157 | October 13, 2026 |
EOL
Mozilla Firefox 157 became EOL in 2026. |
| 156 | September 29, 2026 |
EOL
Mozilla Firefox 156 became EOL in 2026. |
| 155 | September 15, 2026 |
EOL
Mozilla Firefox 155 became EOL in 2026. |
| 154 | September 1, 2026 |
EOL
Mozilla Firefox 154 became EOL in 2026. |
| 153 | - |
Active
|
| 152 | July 21, 2026 |
EOL
Mozilla Firefox 152 became EOL in 2026. |
| 151 | June 16, 2026 |
EOL
Mozilla Firefox 151 became EOL in 2026. |
| 150 | May 18, 2026 |
EOL
Mozilla Firefox 150 became EOL in 2026. |
| 149 | April 21, 2026 |
EOL
Mozilla Firefox 149 became EOL in 2026. |
| 148 | March 24, 2026 |
EOL
Mozilla Firefox 148 became EOL in 2026. |
| 147 | February 24, 2026 |
EOL
Mozilla Firefox 147 became EOL in 2026. |
| 146 | January 13, 2026 |
EOL
Mozilla Firefox 146 became EOL in 2026. |
| 145 | December 9, 2025 |
EOL
Mozilla Firefox 145 became EOL in 2025. |
| 144 | November 11, 2025 |
EOL
Mozilla Firefox 144 became EOL in 2025. |
| 143 | October 14, 2025 |
EOL
Mozilla Firefox 143 became EOL in 2025. |
| 142 | September 16, 2025 |
EOL
Mozilla Firefox 142 became EOL in 2025. |
| 141 | August 19, 2025 |
EOL
Mozilla Firefox 141 became EOL in 2025. |
| 140 | September 29, 2026 |
EOL
Mozilla Firefox 140 became EOL in 2026. |
By the Year
In 2026 there have been 742 vulnerabilities in Mozilla Firefox with an average score of 8.0 out of ten. Last year, in 2025 Firefox had 189 security vulnerabilities published. That is, 553 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.42.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 742 | 7.96 |
| 2025 | 189 | 7.54 |
| 2024 | 190 | 7.15 |
| 2023 | 180 | 7.38 |
| 2022 | 159 | 7.44 |
| 2021 | 123 | 7.13 |
| 2020 | 148 | 7.27 |
| 2019 | 121 | 7.44 |
| 2018 | 312 | 7.82 |
It may take a day or so for new Firefox vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Mozilla Firefox Security Vulnerabilities
Firefox 159: Incorrect Boundary Conditions in Layout (Block & Inline)
CVE-2026-120572
8.8 - High
- November 03, 2026
Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.
Buffer Overflow
Firefox before 115.44 Frame Poisoning in Layout Component
CVE-2026-118027
9.1 - Critical
- October 27, 2026
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
User Interface (UI) Misrepresentation of Critical Information
Mozilla Firefox/Thunderbird JS GC Invalid Pointer
CVE-2026-118026
8.8 - High
- October 27, 2026
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
SVG component flaw in Firefox/Thunderbird (CVE-2026-118025)
CVE-2026-118025
8.8 - High
- October 27, 2026
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Improper Input Validation
Mozilla Firefox/Thunderbird Use-After-Free in Graphics Text Component
CVE-2026-118024
8.8 - High
- October 27, 2026
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird WebRender UAF Sandbox Escape (CVE-2026-118023)
CVE-2026-118023
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free Sandbox Escape via Disability Access APIs
CVE-2026-118022
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird XPCOM UAF Sandbox Escape
CVE-2026-118021
8.8 - High
- October 27, 2026
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Use-After-Free in Firefox/Thunderbird Layout Component
CVE-2026-118020
8.8 - High
- October 27, 2026
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird DOM File UAF Race Condition
CVE-2026-118019
8.8 - High
- October 27, 2026
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Race Condition
Firefox for Android Downloads component spoofing vulnerability (CVE-2026-118018)
CVE-2026-118018
8.8 - High
- October 27, 2026
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
User Interface (UI) Misrepresentation of Critical Information
Mozilla Firefox/Thunderbird SVG Use-After-Free
CVE-2026-118017
8.8 - High
- October 27, 2026
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Use-After-Free in Firefox DOM Core/HTML Component (CVE-2026-118016)
CVE-2026-118016
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free in DOM Core/HTML (CVE2026118015)
CVE-2026-118015
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird Use-After-Free in Layout Images/Video/HTML Frames
CVE-2026-118013
8.8 - High
- October 27, 2026
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird DOM Animation UAF
CVE-2026-118012
8.8 - High
- October 27, 2026
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird JIT Use-After-Free (CVE-2026-118014)
CVE-2026-118014
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Firefox/Thunderbird CSS Parsing Frame Poisoning (CVE-2026-118011)
CVE-2026-118011
8.8 - High
- October 27, 2026
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
User Interface (UI) Misrepresentation of Critical Information
Mozilla Firefox/Thunderbird Use-After-Free in Disability Access APIs
CVE-2026-118010
8.8 - High
- October 27, 2026
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird Text Graphics UAF & Integer Overflow
CVE-2026-118009
8.8 - High
- October 27, 2026
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Integer Overflow or Wraparound
Mozilla Firefox/Thunderbird Use-After-Free in JS GC
CVE-2026-118007
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird WebRTC Signaling UAF PrivEsc
CVE-2026-118006
8.8 - High
- October 27, 2026
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Use-After-Free in Mozilla WebRTC Signaling (Firefox/Thunderbird)
CVE-2026-118005
8.8 - High
- October 27, 2026
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
Dangling pointer
Mozilla Firefox/Thunderbird CSS Transitions Boundary Error pre159
CVE-2026-118004
8.1 - High
- October 27, 2026
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird DNS info disclosure (<=158)
CVE-2026-118003
8.1 - High
- October 27, 2026
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Mozilla Firefox/Thunderbird Networking Race Cond Info Disclosure (<=159)
CVE-2026-118002
8.1 - High
- October 27, 2026
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Mozilla Firefox/Thunderbird IPC Race Condition (fixed in 159, ESR 153.6)
CVE-2026-117999
8.8 - High
- October 27, 2026
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Race Condition
Firefox & Thunderbird HTTP Networking info disclosure before 159
CVE-2026-118000
8.1 - High
- October 27, 2026
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Firefox/Thunderbird Widget UAF sandbox escape (pre159)
CVE-2026-117997
9.6 - Critical
- October 27, 2026
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Mozilla Firefox/Thunderbird DOM Push Subscriptions Bypass (fixed in 159/153.6)
CVE-2026-117998
8.8 - High
- October 27, 2026
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Protection Mechanism Failure
Firefox UI Events & Focus Handling PrivEsc (pre159)
CVE-2026-117995
8.8 - High
- October 27, 2026
Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Authorization
Firefox/Thunderbird Use-After-Free in JS GC (fixed in 159, ESR 153.6)
CVE-2026-117994
8.8 - High
- October 27, 2026
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird WebRTC Boundary Check Bypass (pre159)
CVE-2026-117996
8.1 - High
- October 27, 2026
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Text & Fonts Layout OOB Boundary (pre 159)
CVE-2026-117991
8.8 - High
- October 27, 2026
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Mozilla Firefox/Thunderbird CSS Parser Info Disclosure (pre-159/115.44)
CVE-2026-117992
6.5 - Medium
- October 27, 2026
Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Information Disclosure
Firefox/Thunderbird Text Component Integer Overflow (pre159)
CVE-2026-117993
8.8 - High
- October 27, 2026
Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Integer Overflow or Wraparound
Mozilla Firefox/Thunderbird CanvasWebGL Sandbox Escape (pre159/153.6)
CVE-2026-117988
9.6 - Critical
- October 27, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Mozilla Firefox/Thunderbird WebRender Sandbox Escape (pre159/153.6)
CVE-2026-117990
9.6 - Critical
- October 27, 2026
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Graphics UAF (fixed in 159, ESR 153.6)
CVE-2026-117989
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Graphics UAF (fixed in 159/153.6)
CVE-2026-117986
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Mozilla Firefox/Thunderbird Graphics UAF before 159/153.6
CVE-2026-117987
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Mozilla Firefox/Thunderbird Graphics UAF Sandbox Escape (pre159)
CVE-2026-117985
9.6 - Critical
- October 27, 2026
Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Layout Scrolling & Overflow OOB before 159
CVE-2026-117984
8.8 - High
- October 27, 2026
Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Use-After-Free in Graphics (pre-159)
CVE-2026-117983
8.8 - High
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird JIT Invalid Pointer Vulnerability (fixed in 159/153.6)
CVE-2026-117982
9.8 - Critical
- October 27, 2026
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Graphics Use-After-Free (pre-159)
CVE-2026-117980
9.8 - Critical
- October 27, 2026
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Dangling pointer
Firefox/Thunderbird Toolkit Privilege Escalation (pre-159/153.6)
CVE-2026-117981
9.8 - Critical
- October 27, 2026
Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Improper Privilege Management
Firefox/Thunderbird WebRender OOB Read Fixed in 159, 115.44 ESR
CVE-2026-117979
8.8 - High
- October 27, 2026
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Firefox/Thunderbird Console Component Vulnerability (pre 159)
CVE-2026-117977
8.1 - High
- October 27, 2026
Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Improper Output Neutralization for Logs
Firefox/Thunderbird Graphics OOB Read <159
CVE-2026-117978
8.1 - High
- October 27, 2026
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Buffer Overflow
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Mozilla Firefox or by Mozilla? Click the Watch button to subscribe.
