Mozilla

Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.

Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.

Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.

Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.

Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.

Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Race condition in Firefox's JavaScript Engine (CVE-2026-74984) exposes users on all Firefox versions prior to 154 and ESR versions prior to 153.1 to potential confidentiality and integrity compromise. The CWE-362 flaw creates a timing window during concurrent JavaScript execution in which an attacker-controlled script can race against the engine's internal state management, enabling memory read or write access. No public exploit code has been identified and EPSS sits at the 5th percentile, indicating no widespread exploitation at time of analysis.

Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.

Site isolation bypass in Mozilla Firefox's Audio/Video Web Codecs component allows remote attackers to perform cross-origin data access, potentially reading or modifying content belonging to other origins within the browser. Rooted in CWE-346 (Origin Validation Error), the flaw affects all Firefox releases prior to 154 and all ESR releases prior to 153.1. No public exploit identified at time of analysis, and an EPSS score of 0.15% (5th percentile) signals low current exploitation probability despite the high CVSS base score of 8.1.

Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.

Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.

Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.

Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.

UI spoofing in the Downloads component of Firefox for Android allows network-accessible attackers to misrepresent critical information to users, potentially deceiving them about the nature or origin of downloaded content. Affected versions are those prior to Firefox 154 on Android, as confirmed by Mozilla's security advisory MFSA2026-74. No public exploit code exists and CISA has not added this to the KEV catalog; SSVC signals exploitation status as none with partial technical impact.

Site isolation bypass in Firefox's Graphics component allows a remote attacker who can induce user interaction to read cross-origin data or tamper with content across site boundaries. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1. No public exploit has been identified and CISA SSVC rates exploitation as none at time of analysis, but the network-accessible attack surface and broad deployment footprint make this a meaningful patching priority.

Site isolation bypass in Firefox's Graphics: WebRender component allows a remote attacker to achieve limited cross-origin information disclosure and content manipulation by delivering a crafted webpage to a user (CWE-346, origin validation error). All Firefox releases prior to 154 and Firefox ESR releases prior to 153.1 are affected across all platforms. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).

Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.

Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.

Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.

Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.

Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.

Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.

Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.

Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.

Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.

Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.

Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue.

Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.

Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.

Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.

JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.

Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.

Race condition and use-after-free memory corruption in Mozilla Firefox's Graphics component allows remote unauthenticated attackers to achieve limited confidentiality and integrity impact when a user visits a malicious web page. Affected across the standard release channel and all ESR branches, the vulnerability is fixed in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1 per Mozilla's official advisories. No public exploit code has been identified and CISA has not listed this in KEV; the SSVC framework rates exploitation status as none and marks it not automatable.

Information disclosure through Firefox's DOM Push Subscriptions component exposes limited confidential data to network-positioned attackers who can induce user interaction. All Firefox releases prior to 154 and both Firefox ESR branches (pre-140.14 and pre-153.1) are affected, with Mozilla issuing at least six security advisories (mfsa2026-74 through mfsa2026-80) addressing this and related issues. No public exploit code or CISA KEV listing has been identified at time of analysis, and the CVSS 4.3 Medium rating reflects the limited scope of data exposed and the mandatory user-interaction requirement.

Information disclosure in Firefox's DOM UI Events and Focus Handling component exposes limited sensitive data to remote attackers when a victim visits a crafted web page. All Firefox releases prior to 154, ESR prior to 140.14, and ESR 153.x prior to 153.1 are affected across all platforms, as confirmed by Mozilla across six simultaneous security advisories (mfsa2026-74 through mfsa2026-80). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is moderated by the required user interaction and limited confidentiality-only impact.

Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.

Same-origin policy bypass in Firefox's Audio/Video Playback component exposes users to cross-origin data reads and limited content manipulation when visiting a malicious webpage. All Firefox stable releases prior to 154 and both ESR tracks prior to 140.14 and 153.1 are affected, with Mozilla issuing a coordinated advisory series (mfsa2026-74 through mfsa2026-80) covering the full release matrix. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction but no credentials or special configuration.

Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.

Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Same-origin policy bypass in Firefox's Networking: Cookies component exposes users to cross-origin cookie theft and manipulation when visiting attacker-controlled pages. All Firefox versions prior to 154 and both ESR branches prior to ESR 140.14 and ESR 153.1 are affected, with Mozilla publishing at least six separate security advisories (mfsa2026-74 through mfsa2026-80) indicating broad coverage across release tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 5.4 Medium score reflects real but bounded confidentiality and integrity risk, gated by a mandatory user-interaction requirement.

Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.

Site isolation is broken in Firefox's WebExtensions component, allowing cross-origin access control boundaries to be violated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) places this as network-exploitable with high confidentiality and integrity impact, requiring only that a user visit an attacker-controlled page. Vendor-released patches are confirmed across all active Firefox release channels; no public exploit has been identified at time of analysis and EPSS at 0.16% (5th percentile) reflects low current exploitation probability.

Protection-mechanism bypass in the Storage: Cache API of Mozilla Firefox lets remote web content defeat a built-in security mitigation, exposing sensitive data and allowing unauthorized modification (CVSS 9.1, C:H/I:H). All Firefox builds prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. Reported by Mozilla with no public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile).

Safe Browsing mitigation bypass in Mozilla Firefox allows a remote unauthenticated attacker (with user interaction) to circumvent Firefox's phishing and malware URL-blocking protections, classified under CWE-693 (Protection Mechanism Failure). Affected versions span all Firefox releases prior to 154 and all ESR branches prior to 140.14 and 153.1, giving this a broad blast radius across consumer and enterprise deployments. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low observed exploitation activity despite the high CVSS score of 8.1.

Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.

Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.

Information disclosure in Firefox's Graphics component exposes sensitive data to remote attackers who can lure users to a malicious webpage. All Firefox release channels prior to version 154 and multiple ESR branches are affected, with fixes shipping in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1. No public exploit code has been identified and exploitation probability is very low (EPSS 0.16%), though the high confidentiality impact and zero-privilege-required attack path make patching a straightforward priority.

Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.

Information disclosure in Firefox's Graphics: Text rendering component allows a remote unauthenticated attacker to leak sensitive memory contents when a user visits or interacts with crafted content. All Firefox release channels are affected, spanning the main release (pre-154) and three ESR branches (pre-115.39, pre-140.14, pre-153.1). No public exploit code exists and EPSS exploitation probability sits at just 0.20% (10th percentile), suggesting low real-world exploitation activity despite the high confidentiality impact scored by CVSS.

Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.

Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.

Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.

Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.

Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).

Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.

Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.

Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.

Predictable temporary file paths in Etherpad's import and export handlers expose multi-tenant deployments to a symlink-based file overwrite attack. All ep_etherpad-lite versions through v3.0.0 are affected; exploitation requires local host access, an unprivileged OS account, and - for high-impact scenarios - the Etherpad process running as root, a common default in many Docker base images. A proof-of-concept sketch is included in the vendor advisory GHSA-2jwf-f4xq-f24h; no public weaponized exploit code beyond that sketch exists and this vulnerability is not listed in the CISA KEV catalog.

Broken access control in Flowise's GET /api/v1/upsert-history API endpoint exposes the entire server-wide upsert history - exceeding 100MB per response - to any authenticated user, leaking sensitive infrastructure credentials including Qdrant server URLs, collection names, and vector pipeline configuration across all tenants and workspaces. The vulnerability is confirmed in flowise <= 3.1.2 and publicly documented in GHSA-fr6g-7cq8-fg82 with a working curl-based proof-of-concept, meaning any account holder on a multi-tenant deployment can harvest cross-tenant vector store configuration for reconnaissance or targeted follow-on attacks against exposed backends. Vendor-released patch flowise@3.1.3 is confirmed available and addresses missing workspace-scoping enforcement across multiple API controllers.

Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.

Information disclosure in Firefox for Android and Firefox Focus for Android exposes sensitive user data to network-based attackers who can lure a victim into interacting with a crafted web resource. The vulnerability, tracked under CWE-200 and assigned a CVSS score of 6.5 with high confidentiality impact, is limited to Android platform builds and does not affect desktop Firefox. Mozilla patched this in Firefox 153.0.3 per advisory mfsa2026-73; no public exploit or active exploitation has been identified at time of analysis.

Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.

Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.

Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.

Public-only personal access token scope enforcement in Gitea's REST API is inconsistently applied across two organization endpoints, allowing a token holder to enumerate private organization memberships and retrieve detailed permission data (ownership, admin status, write access, repository-creation capability) that the public-only restriction was explicitly designed to block. All Gitea versions prior to 1.27.0 are affected via GET /api/v1/user/orgs and GET /api/v1/users/{username}/orgs/{org}/permissions. Publicly available exploit code with full HTTP request/response traces is confirmed in the GHSA advisory; no CISA KEV listing exists, indicating no confirmed opportunistic mass exploitation at time of analysis.

Draft release attachment disclosure in Gitea exposes files uploaded to draft releases to unauthenticated network callers via UUID-based web endpoints, bypassing access controls that correctly gate the parallel API handlers. This is an incomplete fix for CVE-2026-27660: that advisory's PR #36659 added `canAccessReleaseDraft` checks to every API code path but left the web-side `ServeAttachment` handler ungated, allowing anyone who obtains an attachment UUID to download its contents with no authentication. A working proof-of-concept is documented in the advisory and confirmed against Gitea v1.27.0+dev; no public exploit identified at time of analysis beyond the advisory PoC, and the vulnerability does not appear in CISA KEV.

Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.

Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.

Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.

Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.

Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.

Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.

Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.

Access-control mitigation bypass in the DOM Service Workers component of Mozilla Firefox before version 153 allows remote content to circumvent a browser security mitigation, undermining protections intended to isolate web origins. Mozilla self-reported the flaw (MFSA2026-68/71) and shipped a fix in Firefox 153; there is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile). The NVD-assigned CVSS of 9.8 (full CIA impact, no user interaction) is notably higher than typical for a browser mitigation bypass, which warrants scrutiny.

Security mitigation bypass in the Networking component of Mozilla Firefox before version 153 lets remote attackers defeat a built-in protection mechanism, carrying high confidentiality and integrity impact per the CVSS 9.1 rating. The flaw was reported and fixed by Mozilla in Firefox 153 (advisory MFSA2026-68) and is classified under CWE-693 (Protection Mechanism Failure), with tags indicating an authentication/authorization bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.

UI/content spoofing in Mozilla Firefox for Android (fixed in version 153) lets a remote attacker who lures a user to attacker-controlled content misrepresent trusted interface elements, undermining the integrity of what the user believes they are viewing or interacting with. The flaw is classified as an authentication-bypass-by-spoofing weakness (CWE-290) and requires user interaction. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.13%, 3rd percentile).

Address bar spoofing in Mozilla Firefox (all versions prior to 153) enables a remote, unauthenticated attacker to misrepresent the displayed origin in the browser's address bar, the primary trust signal users rely on to validate site authenticity. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms exploitation is low-complexity and requires only a single user interaction - navigating to a crafted page - with no authentication or special privileges needed from the attacker. No public exploit has been identified and EPSS sits at 0.13% (3rd percentile), indicating limited exploitation activity; however, the integrity of user trust decisions is fully undermined when the flaw is triggered, making it an effective phishing enabler.

Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.

Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.

Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).

Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).

Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.

Clickjacking (UI redressing) in the WebExtensions component of Firefox for Android allows a network-based attacker to hijack user interactions, resulting in high-integrity impact against the victim's browser session. All Firefox for Android versions prior to 153 are affected; Mozilla has released a fix in Firefox 153. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.

Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Protection mechanism failure in the DOM: Security component of Mozilla Firefox lets remote attackers bypass a browser security mitigation, undermining defenses that isolate web content and enforce origin/policy boundaries. Mozilla rates this Critical (CVSS 9.1) with high confidentiality and integrity impact and no authentication or user interaction required per the assigned vector; it is corrected in Firefox 153 (MFSA 2026-68). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.