Mozilla Firefox vulnerabilities
2,318 published CVEs name Mozilla Firefox among the affected products; CISA lists 9 of them as exploited in the wild.
- 2,318Published CVEs2,283 of them scored
- 928Last 12 monthspublished in the last year
- 495Critical1,013 more rated high
- 9Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2024-9680
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this…
Mozilla · Firefox
ExploitedCritical9.8 - CVE-2016-9079
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox…
Mozilla · Firefox
ExploitedHigh7.5 - CVE-2019-11707
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware…
Mozilla · Firefox ESR
ExploitedHigh8.8 - CVE-2019-11708
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process…
Mozilla · Firefox ESR
ExploitedCritical10.0 - CVE-2022-26485
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.…
Mozilla · Firefox
ExploitedHigh8.8 - CVE-2022-26486
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild…
Mozilla · Firefox
ExploitedCritical9.6 - CVE-2020-6819
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild…
Mozilla · Thunderbird
ExploitedHigh8.1 - CVE-2020-6820
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing…
Mozilla · Thunderbird
ExploitedHigh8.1 - CVE-2019-17026
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild…
Mozilla · Firefox ESR
ExploitedHigh8.8