Mozilla
Monthly
Memory corruption in Mozilla Firefox's Networking component can be triggered when the browser processes crafted or malformed network data, giving an attacker who controls the data path a possible route to code execution inside the content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3. Reaching the bug requires the victim to actively browse to an attacker-controlled site or route traffic through a malicious or MITM'd endpoint, and exploitation further depends on winning a heap-layout/memory-corruption primitive, with any resulting execution initially confined to the sandboxed content process; no public exploit code is identified at time of analysis and EPSS is low at 0.15% (5th percentile). Note that the two CVSS vectors in circulation disagree - the NVD-supplied vector (8.8, AV:L/AC:L/PR:L) implies prior local low-privilege access, whereas the independent reassessment (AV:N/AC:H/PR:N/UI:R) describes the more plausible remote-web-content path, and that discrepancy should be resolved with Mozilla before finalising exposure decisions.
A mitigation bypass in the Mozilla Firefox Networking component lets remote attackers defeat a built-in browser security protection, yielding high confidentiality and integrity impact (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N as scored by Mozilla) against unpatched clients. Affected are Firefox versions prior to 156 and Firefox ESR prior to 153.3; our internal assessment keeps the same C:H/I:H/A:N impact but treats the recorded UI:N as optimistic and applies UI:R, since a client-side browser flaw in practice requires the victim to load attacker-influenced web content before the bypass can be exercised. No public exploit code has been identified at time of analysis and the EPSS score is low (0.16%, 5th percentile); vendor-released patches exist in Firefox 156 and Firefox ESR 153.3.
A mitigation bypass in the Firefox Popup Blocker allows attacker-controlled web content to defeat the browser's built-in popup-blocking protection, so unwanted windows can be spawned despite the user's configured blocking preference. All Firefox builds prior to 156 and Firefox ESR builds prior to 153.3 are affected, per the CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* and Mozilla advisories mfsa2026-90, mfsa2026-93, mfsa2026-94 and mfsa2026-96. Exploitation requires a victim to load the crafted content in an unpatched browser, and the practical outcome is a weakened anti-deception control enabling phishing and UI spoofing rather than code execution or direct data compromise; EPSS is a low 0.16% (5th percentile), and no public exploit has been identified at time of analysis. Note that the supplied CVSS 8.8 rating is not supported by the independent re-assessment, which scores the issue as AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N because impact is limited to integrity of the browser's protective behavior.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Memory-safety corruption in Mozilla Firefox's Safe Browsing component can be triggered when a victim loads attacker-controlled web content on any Firefox build before 156 or Firefox ESR before 153.3. The assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.0) shows the vulnerability is network-reachable with low complexity, but exploitation is gated by mandatory user interaction - the victim must visit or load content that the Safe Browsing component processes. No public exploit code has been identified at time of analysis and EPSS is low (0.14%, 4th percentile), but a browser memory-corruption bug with high C/I/A impact warrants prompt patching; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3.
Sandbox escape in Mozilla Firefox on Windows allows attacker-supplied web content to break out of the content-process sandbox through the browser's 'Widget: Win32' native window-handling code, stemming from incorrect boundary conditions that produce an out-of-bounds memory condition. It affects Firefox versions before 156 and Firefox ESR versions before 153.3 running on Windows, and although the vendor rates it 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), our independent reassessment applies AC:H because a successful escape also requires chaining this flaw with a separate content-process memory-corruption bug to first achieve code execution inside the renderer - the escape alone grants no execution. Exploitation is unauthenticated at the network vector but requires the victim to load attacker-controlled content (UI:R), no public exploit code has been identified at time of analysis, and the EPSS score is low at 0.14% (4th percentile).
Memory corruption in Mozilla Firefox's GTK widget backend (Widget: Gtk) lets attackers who persuade a victim to render attacker-controlled web content trigger a use-after-free, with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector rating confidentiality, integrity and availability impacts as high. Affected builds are Firefox before 156 and Firefox ESR before 153.3 running on Linux/GTK desktops; exploitation requires user interaction (loading the malicious page) but no authentication, privileges or non-default configuration. Threat signals are currently low: EPSS is 0.14% (4th percentile), the issue is not listed in CISA KEV, and no public exploit identified at time of analysis.
A sandbox escape in Firefox's Profile Backup component lets code that is already running inside the browser's sandboxed content process break out to browser and host privilege, but it is not a standalone remote compromise: the authoritative assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning an attacker must first hold an in-sandbox foothold (typically a separate content-process exploit) and typically requires user interaction. Mozilla's vendor advisory scores it 9.8 with a PR:N/UI:N/S:U vector, and the flaw is fixed in Firefox 156. EPSS is low at 0.14% (4th percentile) and no public exploit identified at time of analysis; there is no CISA KEV entry, so this reads as a second-stage chain link rather than a standalone exploit.
Sandbox escape in Mozilla Firefox on Windows stems from an incorrect boundary condition (CWE-119) in the Win32 Widget component, allowing an attacker who already has code execution inside a content/child sandbox to escape and gain high-impact code execution, data access, and availability impact. It affects Firefox before 156 and Firefox ESR before 153.3, with patched builds available as Firefox 156 and Firefox ESR 153.3. No public exploit or active exploitation is identified, and EPSS is low at 0.14% (4th percentile), but the CVSS score is 8.8 and exploitation is chain-dependent, typically requiring a separate content-process memory-safety bug to reach this escape stage.
Sandbox escape in Mozilla Firefox on Windows, in the Widget: Win32 component, lets an attacker who already holds low-privileged code execution inside a Firefox content/child process corrupt memory via an incorrect boundary condition (CWE-119) and break out of the browser sandbox into full user-level code execution. The flaw is Windows-only - the Win32 widget code path does not exist on macOS or Linux - and patched builds (Firefox 156 and Firefox ESR 153.3) are not exploitable; there is no public exploit identified at time of analysis and EPSS is low at 0.14% (4th percentile). Because this is a second-stage sandbox-escape primitive rather than a standalone remote bug, it is not independently exploitable against a default install without a preceding content-process compromise.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
Memory corruption in Mozilla Firefox's Process Sandboxing component, caused by incorrect boundary conditions, can be triggered when a victim browses attacker-controlled web content on any Firefox version prior to 156. Although the input feed carries a nominal CVSS of 9.8 and a CWE-119 (buffer bounds) classification, our assessment reduces the practical severity to AV:N/AC:H/PR:N/UI:R because successful exploitation requires the user to render malicious content and then reach and corrupt the targeted sandbox code path, which realistically implies chaining with a content-process compromise. No public exploit code has been identified and the flaw is not in CISA KEV, with an EPSS score of just 0.14% (4th percentile), indicating low near-term exploitation likelihood despite the high theoretical impact. The issue is unauthenticated from a network standpoint (PR:N) but is not zero-interaction.
Use-after-free in Mozilla Firefox's Internationalization (i18n) component allows remote attackers to corrupt memory and potentially execute code in the browser's content process when a victim renders attacker-controlled web content in versions before 156 or Firefox ESR before 153.3. Exploitation is unauthenticated (PR:N) but requires the victim to visit or render the malicious page (UI:R), and default cross-platform installations are exposed because the i18n code is always present. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), but the 8.8 CVSS reflects high confidentiality, integrity and availability impact confined to the content process; full system compromise would require an additional sandbox-escape chain.
Improper boundary conditions in the DOM Editor component of Mozilla Firefox can corrupt memory when a user renders crafted web content, allowing an attacker to potentially execute code inside the browser's content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; the CVSS vector sets PR:N, so unauthenticated remote delivery is possible, but the assessed exploitation path requires the victim to load attacker-controlled page content (UI:R) and reliable exploitation of a memory-corruption bug typically needs heap grooming and a sandbox escape to affect the host. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so despite the 9.3 base score the practical real-world priority is moderate, driven mainly by the browser's ubiquity and the fact that the fix is already shipped.
Use-after-free in Mozilla Firefox's Graphics component can be triggered when a victim browses attacker-controlled web content, allowing memory corruption that may lead to code execution or sensitive data disclosure in releases before Firefox 156 and Firefox ESR 153.3. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the default rendering configuration is exposed, so essentially all unpatched desktop users are potential targets; exploitation status is no public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile) despite the high CVSS of 8.8. Mozilla addresses the issue in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
Enterprise policy enforcement bypass in Mozilla Firefox affects all builds prior to 156 and Firefox ESR prior to 153.3, letting remote, unauthenticated attackers circumvent restrictions that administrators have locked down through the browser's Enterprise Policies component. Mozilla's advisory carries a CVSS 9.1 base score, while an independent re-assessment lowers the practical severity by raising attack complexity (AC:H) and scoping real-world impact to managed deployments where a policy is actually relied upon as a security control - a default consumer install with no policies configured has nothing to bypass. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and EPSS is only 0.15% (5th percentile); Mozilla has not disclosed the specific trigger mechanism, so precise preconditions remain unclear.
A use-after-free in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to cause memory corruption, potentially leading to code execution or information disclosure, when a user navigates to a malicious webpage. Affected are Firefox versions before 156 and Firefox ESR before 153.3; the flaw is unauthenticated (PR:N) but requires user interaction (UI:R) and is rated high severity (CVSS 8.8). No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.14% (4th percentile), indicating low likelihood of exploitation.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
Content spoofing caused by an invalid-pointer (null-pointer dereference) condition in Mozilla Firefox's Graphics rendering component affects Firefox versions prior to 156, allowing a remote, unauthenticated attacker to falsify or distort what a victim sees when the browser renders attacker-supplied web or graphics content. Mozilla shipped the fix in Firefox 156 (advisories MFSA2026-90 and MFSA2026-94, Bugzilla 2061393); there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low at roughly 0.14% (4th percentile). The raw CVSS 9.1 score overstates practical risk - our independent assessment lowers it to AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L because exploitation requires the victim to navigate to and render malicious content, and the realistic outcome is spoofing plus a limited crash/denial-of-service condition rather than full integrity or availability loss.
A race condition in Mozilla Firefox's XPConnect component allows an attacker who has already compromised execution inside the content/renderer sandbox to escape that boundary and reach higher-privileged browser code. Only Firefox builds prior to version 156 are affected; the flaw was fixed upstream and published in Mozilla's MFSA 2026-90/MFSA 2026-94 advisories. Exploitation is not a standalone remote code-execution path but a chained, timing-dependent step requiring a separate renderer compromise first, and no public exploit has been identified at time of analysis, with an EPSS score of just 0.14% (4th percentile) indicating low predicted real-world activity.
Use-after-free in Mozilla Firefox's Windows-only 'Widget: Win32' component allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution or information disclosure by convincing a victim on Firefox before 156 or Firefox ESR before 153.3 to render attacker-controlled web content. Exploitation requires user interaction (UI:R - the victim must load or interact with the crafted page) and is limited to the Windows platform, since the flawed Win32 widget code is Windows-specific. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low near-term exploitation likelihood, though the CVSS base of 8.8 reflects high confidentiality, integrity and availability impact if a working exploit is developed.
Sandbox escape in Mozilla Firefox's Widget:Win32 component on Windows allows code that is already running inside the browser's content/renderer sandbox to break out and execute on the host with the user's privileges, escalating a limited renderer compromise into full desktop compromise. It does not stand alone: an attacker must first obtain code execution in the content process via a separate bug, then trigger the boundary-condition memory corruption, and a victim must load attacker-controlled web content (CVSS 9.0, PR:L, UI:R, S:C). Vendor fixes are Firefox 156 and Firefox ESR 153.3; EPSS is only 0.15% (5th percentile) and no public exploit code or confirmed active exploitation has been identified, so the high base score should be weighed against the multi-stage, Windows-only prerequisites.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
Use-after-free in Mozilla Firefox's Graphics component allows remote attackers to corrupt memory and potentially achieve code execution in the browser content process, requiring only that a victim view attacker-controlled web content. Unauthenticated remote attack (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) with high confidentiality, integrity and availability impact, carrying a vendor CVSS of 8.8; affected builds are Firefox prior to 156 and Firefox ESR prior to 153.3, which are fixed in those releases. No public exploit code has been identified and EPSS is low at 0.15% (5th percentile), so exploitation is not confirmed as active; risk is concentrated in the mandatory user interaction (page visit) and sandbox constraints on post-corruption impact.
Sandbox escape in Mozilla Firefox (all versions before 156) and Firefox ESR (before 153.3) allows an attacker who gets malicious web content processed by the browser's WebRTC stack to break out of the sandboxed content process and run code with the privileges of the parent/broker process, yielding high confidentiality, integrity and availability impact. Exploitation is not trivial: the victim must load attacker-controlled content and, because the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, the bug realistically functions as a chain component on top of a renderer-level compromise rather than a single-shot webpage exploit. There is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.15% (5th percentile), so the practical near-term risk sits below the 9.6 base score headline; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3.
Information disclosure in Mozilla Firefox's Networking: HTTP component affects Firefox builds prior to 156 and Firefox ESR builds prior to 153.3, allowing a remote, unauthenticated attacker who can influence HTTP traffic a victim's browser processes to expose high-confidentiality data (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability loss is assessed - and the flaw is consistent with CWE-200 (Exposure of Sensitive Information). At time of analysis there is no public exploit identified and no CISA KEV listing; EPSS is 0.15% (5th percentile), indicating low modeled near-term exploitation likelihood, though the unauthenticated, low-complexity profile keeps it relevant for unpatched consumer and enterprise Firefox fleets.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
A race condition in Firefox's DOM: Content Processes component (CWE-362) lets attacker-controlled web content win a non-deterministic timing window and corrupt state inside the browser's content process, yielding high confidentiality and integrity impact; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3. Reachable from any loaded page but gated by user interaction and a hard-to-reliably-win race (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5), the bug carries low exploitation likelihood signals (EPSS 0.15%, 5th percentile), is not on CISA KEV, and no public exploit code has been identified at time of analysis. All Firefox builds prior to the fixed releases match the affected CPE wildcard, so unpatched installations remain exposed to remote attackers who can persuade a user to open a crafted page.
Mozilla Firefox builds before 156 (and Firefox ESR builds before 153.3) can be induced to bypass an existing browser security mitigation through attacker-influenced web content that exercises the DOM: Networking component, yielding high confidentiality and integrity impact without granting outright code execution. The vendor rates this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but our independent assessment adjusts the vector to UI:R, since the victim must actually load the malicious page for the bypass to trigger - a normal precondition for a client-side browser flaw. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), so near-term real-world risk is limited despite the critical score.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine can be triggered by loading attacker-controlled web content in versions before 156, potentially leading to memory corruption and code execution with high confidentiality, integrity, and availability impact. Exploitation requires user interaction (the victim must open a malicious page) but no authentication, and no public exploit or active exploitation is confirmed; the EPSS score is only 0.15% and CISA KEV does not list it, but the 8.8 CVSS and full-impact potential make patching to Firefox 156 a priority.
A mitigation bypass in Firefox's Remote Settings Client - the signed channel the browser uses to receive configuration, blocklist and policy updates - was fixed in Firefox 156 and Firefox ESR 153.3. The vendor's CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) rates it as an unauthenticated, network-reachable high-integrity/high-confidentiality issue, but that flat 9.1 should be read with caution: our independent assessment re-scores it at CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because a bypass of the Remote Settings mitigation realistically depends on the attacker being able to tamper with settings content or its delivery channel (a man-in-the-middle position or a spoofed/compromised settings source) rather than a zero-context hit against an idle browser. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (6th percentile), which is consistent with a terse, undisclosed-disparate advisory rather than a mass-exploited bug. All users on Firefox before 156 or Firefox ESR before 153.3 are affected.
Incorrect boundary conditions in the Firefox DOM Animation component (CWE-119) allow remote attackers to corrupt memory in the browser process of any default Firefox build prior to version 156, with Mozilla scoring the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) - the profile of a potential remote code execution issue. Exploitation requires the victim to load attacker-controlled web content (or attacker-supplied markup such as malvertising) that exercises the affected animation code path, so practical delivery is gated by victim interaction even though the vendor vector lists UI:N; our independent assessment therefore scores it UI:R while keeping confidentiality, integrity, and availability impact High. There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.15% (5th percentile), indicating low observed exploitation likelihood measured against the high theoretical severity. No authentication or special target configuration is needed - any unpatched Firefox install is exposed.
Memory corruption in Mozilla Firefox's HTTP networking component (CWE-119) allows an attacker who controls the content of an HTTP response - for example via a malicious or compromised web server, or by man-in-the-middle position - to corrupt Firefox's memory and potentially achieve code execution in the browser process on a victim running Firefox before 156. The issue is a client-side networking-stack flaw rather than a remotely reachable server service: exploitation requires the user to initiate and complete the malicious HTTP exchange, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H while the vendor/NVD vector lists UI:N at 9.8. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.15%, 5th percentile), and the flaw is closed by the regular Firefox 156 update, which sharply limits the exposure window.
Mozilla Firefox versions prior to 156 (and Firefox ESR prior to 153.3) contain a buffer-boundary flaw in the Graphics component that can be leveraged to escape the browser's content-process sandbox and reach the host, explaining the vendor's critical 9.6 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - the scope change reflects a crossing from the constrained renderer process into the host, with full confidentiality, integrity and availability impact. Exploitation is not standalone: it requires a victim to load attacker-controlled web content (UI:R is mandatory) and, in practice, must be chained after an attacker has already achieved code execution inside the Firefox content process, which is why the independent assessment raises attack complexity to AC:H while leaving the 9.6-level impact intact. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.15% (5th percentile), but the vendor-released fixes - Firefox 156 and Firefox ESR 153.3 - should be applied promptly given the sandbox-escape nature of the flaw.
Improper origin validation in Mozilla Firefox's Graphics component before version 156 can allow attacker-influenced web content, once rendered by a victim, to break site-isolation boundaries and potentially disclose or corrupt data across origins. Affected users are those running Firefox versions prior to 156; exploitation requires the victim to browse to malicious or compromised web content, so it is not a no-interaction mass network exploit despite the vendor's critical 9.1 score, and the independent assessment rates it lower with high attack complexity and required user interaction. No public exploit code or active exploitation has been identified, and EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity at time of analysis.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
Sandbox escape in Mozilla Firefox's Graphics component, rooted in an invalid-pointer memory-safety flaw (CWE-119), allows attacker-controlled content loaded by a victim to cross the browser's process-sandbox boundary and reach the privileges of the parent/broker process. Default configurations of Firefox before 156 and Firefox ESR before 140.16 / 153.3 are affected; the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates no authentication or privileges are required, but the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis and EPSS is low (0.16%, 5th percentile); the real-world bar is further raised because a sandbox escape of this class generally has to be chained with a separate content-process memory-corruption primitive to be exploited end-to-end.
Use-after-free in Mozilla Firefox's SVG component allows remote attackers to corrupt memory and potentially achieve code execution or sensitive data disclosure when a victim renders attacker-controlled SVG content in an unpatched browser. Only Firefox builds prior to 156 and Firefox ESR prior to 115.41, 140.16, and 153.3 are affected; Mozilla has shipped fixed releases in all of those channels. The attack is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R) - the victim must load a page or view content that renders the malicious SVG - and although EPSS is low (0.16%, 5th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, drive-by delivery via malvertising or compromised sites can satisfy that interaction requirement at scale, making this a genuine high-priority browser issue rather than an emergency.
Use-after-free in Firefox's DOM: Core & HTML component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). All Firefox builds prior to 156, plus ESR branches prior to 115.41, 140.16, and 153.3, are affected according to the Mozilla security advisories. No public exploit code or confirmed active exploitation was identified at time of analysis (EPSS 0.16%, 5th percentile), and vendor patches are available.
Use-after-free in Mozilla Firefox's DOM Streams component lets unauthenticated remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim simply loads attacker-controlled web content in an unpatched build. Any default Firefox installation older than 156, ESR 115.41, ESR 140.16, or ESR 153.3 is affected, and successful weaponization requires the crafted page to drive the DOM Streams code path and win a heap-grooming race after user interaction (navigation) - there is no public exploit code identified at time of analysis and no confirmed active exploitation (EPSS 0.16%, 5th percentile). Confidence in real-world exploitation is therefore low, but the high integrity/confidentiality/availability impact (CVSS 8.8) and the breadth of the Firefox install base make prompt patching worthwhile.
Use-after-free in the Networking component of Mozilla Firefox allows remote, unauthenticated attackers to potentially corrupt memory and achieve code execution or sensitive-data disclosure when a victim renders attacker-controlled web content, affecting Firefox builds prior to 156 and Firefox ESR prior to 140.16 or 153.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no credentials are needed but the victim must interact by loading a malicious or compromised page, and the browser must be unpatched. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.16% (5th percentile), so while the 8.8 base score reflects high potential impact, this is a genuine high-severity issue rather than a near-term emergency; practical exploitation would additionally require defeating the content-process sandbox and modern memory mitigations.
Use-after-free in Firefox's DOM: Navigation component allows memory corruption that a remote attacker can trigger by convincing a victim to load attacker-controlled web content in an unpatched build, potentially leading to code execution in the browser's content process. All Firefox builds below 156 are affected, along with the ESR branches below 115.41, 140.16 and 153.3, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) reflects unauthenticated remote attack with high confidentiality, integrity and availability impact, gated only by the required user interaction of visiting the crafted page. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), so this should be handled as a standard high-priority browser patch item rather than an emergency, though full compromise would additionally require escaping the content-process sandbox.
A use-after-free in the Firefox SVG rendering component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially achieve code execution by getting a victim to load a crafted SVG, whether on a web page or embedded in content the browser renders. Every Firefox release prior to 156 and all ESR branches below 115.41, 140.16, and 153.3 are affected; exploitation requires the user to open attacker-controlled content (UI:R), so no authentication or special privileges are needed and default configurations remain vulnerable because SVG rendering is enabled out of the box. Vendor/NVD scoring is 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), EPSS is a low 0.16% (5th percentile), and there is no public exploit identified at time of analysis - the primary constraints on real-world abuse are the required user interaction and the need to bypass the Firefox sandbox and other memory-safety mitigations for a full compromise.
Use-after-free in Mozilla Firefox's XML component can lead to memory corruption and potentially code execution when a user loads crafted content in an unpatched build. The flaw affects Firefox before 156 and Firefox ESR branches before 115.41, 140.16, and 153.3; per the CVSS vector it is remotely reachable without authentication (PR:N) but requires user interaction (UI:R), and the assessed severity is high (CVSS 8.8). No public exploit code was identified at time of analysis, and EPSS is 0.16% (5th percentile), so while the technical impact is serious, real-world urgency is moderate-to-high rather than emergency-tier.
A use-after-free in Firefox's DOM HTML Parser can corrupt memory when the victim loads attacker-controlled HTML, giving an unauthenticated remote attacker a path to code execution or information disclosure inside the browser process. Affected builds are Firefox before 156 and the ESR lines before 115.41, 140.16, and 153.3; exploitation requires only that a user open a malicious page or one serving malicious markup (UI:R, PR:N), not credentials or non-default settings. No public exploit code or in-the-wild activity has been identified, and EPSS is low at 0.16% (5th percentile), so this is a serious client-side bug that is not currently a top-of-queue emergency.
Use-after-free in Mozilla Firefox's JavaScript JIT compiler can lead to memory corruption and potentially remote code execution when an unauthenticated remote attacker convinces a victim to load attacker-controlled JavaScript in a vulnerable Firefox build. Affected versions are Mozilla Firefox releases prior to the fixed Firefox ESR 140.16, with exploitation requiring user interaction (UI:R) and JavaScript enabled, which is the default; the content-process sandbox and site isolation limit standalone impact. EPSS is 0.15% (5th percentile) and no public exploit code was identified at time of analysis, indicating a high-severity but not top-of-queue emergency.
An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.
A mitigation bypass in Mozilla Firefox's Remote Settings Client component allows a remote, unauthenticated attacker to defeat a browser security control when a victim interacts with attacker-influenced content, potentially leading to high confidentiality and integrity impact. All Firefox builds prior to 156 and ESR branches prior to 115.41, 140.16, and 153.3 are affected; the issue was fixed in those releases per Mozilla advisories mfsa2026-90 through mfsa2026-96. Exploitation requires user interaction (UI:R) and the vulnerability is characterized as a mitigation bypass that generally must be chained with another primitive to produce direct impact; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is low at 0.16% (6th percentile), so this should be treated as a moderate-priority patch item rather than an emergency.
Sandbox escape in Mozilla Firefox's DOM: Core & HTML component lets attacker-controlled web content break out of the browser's content sandbox, escalating an unprivileged web page into code execution outside the expected security boundary. Exploitation requires only that a victim load malicious HTML or navigate to an attacker-controlled page in an unpatched build - the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms no authentication or privileges are needed, with user interaction being the sole prerequisite. Affected are Firefox builds before 156 and Firefox ESR before 115.41, 140.16, or 153.3; fixes are already published by Mozilla. Risk signals are mixed: the CVSS base score of 9.6 signals critical impact, while EPSS is low at 0.16% (5th percentile) and no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs lets unauthenticated remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content, with the only significant precondition being that the user must visit or render the crafted page (UI:R). Affected builds are all Firefox versions before 156, Firefox ESR before 140.16, and Firefox ESR 153.3, across platforms covered by the wildcard CPE cpe:2.3:a:mozilla:mozilla:firefox:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); EPSS is low at 0.16% (5th percentile), but the 8.8 CVSS profile (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H) matches a heap-corruption bug that can escalate to code execution in the affected process, so patching should not be deferred.
Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present.
Thunderbird's remote attachment allowlist control (`mail.allowed_attachment_hostnames`) can be bypassed due to insufficient regex escaping of configured hostname values, allowing attacker-controlled servers to serve remote attachments that the filter was intended to block. Affected are all Thunderbird releases prior to 155 and 153.2; because hostname strings containing dots and other regex metacharacters are interpolated directly into a regular expression without sanitization, a crafted attachment hostname can pattern-match an allowlisted domain without being that domain. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with low-urgency real-world exploitation risk.
Heap memory disclosure in Mozilla Thunderbird's IMAP client allows a malicious IMAP server to trigger a use-after-free by sending a crafted ID extension response, leaking heap contents that are subsequently persisted to the user's prefs.js file on disk. All Thunderbird releases prior to 155, 140.15 (ESR), and 153.2 across three active release channels are affected. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.15% (4th percentile) reflects low current exploitation probability.
Thunderbird's mail header parser triggers a one-byte buffer over-read (CWE-126) when processing a maliciously crafted message header, potentially exposing a single byte of adjacent heap memory to the sender. All Thunderbird versions across three active release branches are affected until patched - 155, 140.15, and 153.2. No public exploit has been identified and EPSS sits at the 4th percentile, but the network-accessible attack path with no user interaction required keeps this relevant for unpatched deployments.
Use of uninitialized memory in Mozilla Thunderbird's MIME parser allows a remote attacker who sends a specially crafted email to trigger an error condition in certain MIME bodies, causing the client to read uninitialized memory. Depending on what previously occupied that memory, this can leak sensitive process data or crash the application. The flaw was fixed in Thunderbird 155, 140.15 ESR, and 153.2; no public exploit has been identified and EPSS exploitation probability is low (0.15%, 4th percentile).
Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile).
Memory safety vulnerabilities across multiple internally discovered bugs in Firefox 154 and Firefox ESR 153.1 allow network-based attackers to potentially achieve full browser compromise through memory corruption (CWE-119). Mozilla's own advisory clusters dozens of individual Bugzilla reports - including buffer overflows and related defects - under a single advisory umbrella, noting that sufficiently motivated attackers could likely exploit some of these bugs. Vendor-released patch is available: Firefox 155 and Firefox ESR 153.2. No public exploit identified at time of analysis.
Memory corruption in Mozilla Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14 stems from a batch of internally discovered memory-safety defects that Mozilla presumes could be exploited to run arbitrary code within the browser process. The flaws were found by Mozilla's own developers and fuzzing efforts (no external report), affect the mainline and both ESR trains, and are resolved in Firefox 155, ESR 140.15, and ESR 153.2. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Memory-corruption defects in Mozilla Firefox 154 were discovered internally by Mozilla and bundled under CVE-2026-84142 (advisories MFSA2026-82 and MFSA2026-86), and fixed in Firefox 155. Several of the reported Bugzilla issues showed evidence of memory corruption that Mozilla presumes could have been exploited with sufficient effort to achieve code execution when a user renders malicious web content. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with an internally-found, pre-disclosure fix rather than active abuse.
Memory corruption in the Graphics: ImageLib component of Mozilla Firefox stems from an integer overflow when handling image data, potentially allowing remote attackers to corrupt heap memory and achieve code execution when a victim renders malicious image content. Mozilla fixed the issue in Firefox 155 and Firefox ESR 153.2 (advisories mfsa2026-82/85/86/88). It carries a critical 9.8 CVSS score, but EPSS is only 0.14% (4th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Cross-origin data exposure in Mozilla Firefox's DOM: Navigation component stems from a site isolation failure that lets malicious web content bypass the same-origin/site boundary Firefox enforces to keep pages from different sites in separate processes. The flaw affects Firefox before version 155 and Firefox ESR before 153.2, and could allow a crafted page to read or influence data belonging to another origin. Reported and fixed by Mozilla (MFSA2026-82/-85/-86/-88); no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile).
An improper input validation defect (CWE-20) in Firefox Focus for Android was reported and fixed by Mozilla in Firefox 155 per advisory MFSA2026-82. The public description is a placeholder-grade 'Other issue' with no technical mechanism disclosed, so the concrete impact cannot be verified; there is no public exploit identified at time of analysis and EPSS is low (0.13%, 3rd percentile). Despite a headline CVSS of 9.8, the vendor tag set and thin description leave the real-world severity for this privacy-focused mobile browser unconfirmed.
Information disclosure in Mozilla Firefox's Profile Backup component, remediated in Firefox 155 and Firefox ESR 153.2 (Mozilla advisories MFSA2026-82/85/86/88). Mozilla provides only an 'Other issue' placeholder description, so the precise mechanism is undisclosed, but the CWE-200 classification points to unintended exposure of data handled during profile backup. No public exploit or active exploitation has been identified, and EPSS is very low (0.14%, 4th percentile).
Cross-origin information disclosure in Mozilla Firefox arises from a site-isolation failure in the DOM Push Subscriptions component (CWE-346, origin validation error), allowing content from one origin to be improperly associated with or exposed to another. It affects Firefox before 155 and Firefox ESR before 153.2, and was disclosed and patched by Mozilla; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 4th percentile). The 'Information Disclosure' tag is consistent with the CWE and the likely cross-origin read impact.
Information disclosure via Firefox's Networking: HTTP component exposes sensitive data to remote unauthenticated attackers in all Firefox versions prior to 155 and all Firefox ESR versions prior to 153.2. The flaw is tracked in Mozilla Bugzilla #2063020 and addressed across four Mozilla security advisories (mfsa2026-82, -85, -86, -88), indicating backport coverage across multiple ESR branches. No public exploit code exists and EPSS probability is very low (0.14%), though the SSVC framework marks the class as automatable.
Information disclosure in Mozilla Firefox's WebGPU graphics component allows remote attackers to read sensitive data - potentially including cross-origin content or GPU memory - by luring a user to a crafted web page. Affected releases are all Firefox versions prior to 155 and Firefox ESR prior to 153.2. Vendor-released patches are available in Firefox 155 and Firefox ESR 153.2; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data exposure in Mozilla Firefox arises from a site-isolation defect in the DOM Navigation component, where origin boundaries are not correctly enforced during navigation, potentially letting a malicious page access data belonging to another origin. It affects Firefox before 155 and Firefox ESR before 153.2, and was fixed by Mozilla in those releases (advisories mfsa2026-82/85/86/88). No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile).
Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.
Use-after-free in Firefox's WebGPU graphics component allows privilege escalation when a victim visits a specially crafted webpage. Affecting all Firefox versions prior to 155 and ESR prior to 153.2, a remote unauthenticated attacker can trigger memory corruption by delivering malicious WebGPU content, achieving full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none and the attack is not automatable due to required user interaction.
Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.
Memory corruption vulnerabilities internally discovered across multiple Firefox release lines (154, ESR 153.1, ESR 140.14, ESR 115.39) could enable remote code execution when a user visits a specially crafted webpage. Mozilla's security team identified a cluster of memory safety bugs spanning 15+ tracked Bugzilla issues, several of which showed direct evidence of memory corruption sufficient to presume exploitability with sufficient attacker effort. Patches are available across all affected branches (Firefox 155, ESR 115.40, ESR 140.15, ESR 153.2); no public exploit code or CISA KEV listing is associated with this advisory.
Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.
Sandbox escape via use-after-free in the Firefox DOM: Security component allows an attacker who lures a victim to a malicious web page to corrupt memory and break out of the browser content sandbox, potentially achieving code execution in a higher-privilege context. All Firefox release and ESR channels prior to the fixed builds are affected. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, but the 9.6 CVSS and scope-change sandbox-escape nature make this a high-priority browser update.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Navigation component, letting a malicious web page that a user visits corrupt memory and potentially execute code outside the content sandbox. It affects Firefox before 155 and multiple ESR trains (115.x, 140.x, 153.x), carries a critical 9.6 CVSS with a scope change (browser sandbox to host), and requires the victim to load attacker-controlled content (UI:R). No public exploit identified at time of analysis and CISA SSVC lists exploitation as none.
Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.
Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.
Memory corruption in Mozilla Firefox's Networking component can be triggered when the browser processes crafted or malformed network data, giving an attacker who controls the data path a possible route to code execution inside the content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3. Reaching the bug requires the victim to actively browse to an attacker-controlled site or route traffic through a malicious or MITM'd endpoint, and exploitation further depends on winning a heap-layout/memory-corruption primitive, with any resulting execution initially confined to the sandboxed content process; no public exploit code is identified at time of analysis and EPSS is low at 0.15% (5th percentile). Note that the two CVSS vectors in circulation disagree - the NVD-supplied vector (8.8, AV:L/AC:L/PR:L) implies prior local low-privilege access, whereas the independent reassessment (AV:N/AC:H/PR:N/UI:R) describes the more plausible remote-web-content path, and that discrepancy should be resolved with Mozilla before finalising exposure decisions.
A mitigation bypass in the Mozilla Firefox Networking component lets remote attackers defeat a built-in browser security protection, yielding high confidentiality and integrity impact (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N as scored by Mozilla) against unpatched clients. Affected are Firefox versions prior to 156 and Firefox ESR prior to 153.3; our internal assessment keeps the same C:H/I:H/A:N impact but treats the recorded UI:N as optimistic and applies UI:R, since a client-side browser flaw in practice requires the victim to load attacker-influenced web content before the bypass can be exercised. No public exploit code has been identified at time of analysis and the EPSS score is low (0.16%, 5th percentile); vendor-released patches exist in Firefox 156 and Firefox ESR 153.3.
A mitigation bypass in the Firefox Popup Blocker allows attacker-controlled web content to defeat the browser's built-in popup-blocking protection, so unwanted windows can be spawned despite the user's configured blocking preference. All Firefox builds prior to 156 and Firefox ESR builds prior to 153.3 are affected, per the CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* and Mozilla advisories mfsa2026-90, mfsa2026-93, mfsa2026-94 and mfsa2026-96. Exploitation requires a victim to load the crafted content in an unpatched browser, and the practical outcome is a weakened anti-deception control enabling phishing and UI spoofing rather than code execution or direct data compromise; EPSS is a low 0.16% (5th percentile), and no public exploit has been identified at time of analysis. Note that the supplied CVSS 8.8 rating is not supported by the independent re-assessment, which scores the issue as AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N because impact is limited to integrity of the browser's protective behavior.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Memory-safety corruption in Mozilla Firefox's Safe Browsing component can be triggered when a victim loads attacker-controlled web content on any Firefox build before 156 or Firefox ESR before 153.3. The assessed vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.0) shows the vulnerability is network-reachable with low complexity, but exploitation is gated by mandatory user interaction - the victim must visit or load content that the Safe Browsing component processes. No public exploit code has been identified at time of analysis and EPSS is low (0.14%, 4th percentile), but a browser memory-corruption bug with high C/I/A impact warrants prompt patching; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3.
Sandbox escape in Mozilla Firefox on Windows allows attacker-supplied web content to break out of the content-process sandbox through the browser's 'Widget: Win32' native window-handling code, stemming from incorrect boundary conditions that produce an out-of-bounds memory condition. It affects Firefox versions before 156 and Firefox ESR versions before 153.3 running on Windows, and although the vendor rates it 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), our independent reassessment applies AC:H because a successful escape also requires chaining this flaw with a separate content-process memory-corruption bug to first achieve code execution inside the renderer - the escape alone grants no execution. Exploitation is unauthenticated at the network vector but requires the victim to load attacker-controlled content (UI:R), no public exploit code has been identified at time of analysis, and the EPSS score is low at 0.14% (4th percentile).
Memory corruption in Mozilla Firefox's GTK widget backend (Widget: Gtk) lets attackers who persuade a victim to render attacker-controlled web content trigger a use-after-free, with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector rating confidentiality, integrity and availability impacts as high. Affected builds are Firefox before 156 and Firefox ESR before 153.3 running on Linux/GTK desktops; exploitation requires user interaction (loading the malicious page) but no authentication, privileges or non-default configuration. Threat signals are currently low: EPSS is 0.14% (4th percentile), the issue is not listed in CISA KEV, and no public exploit identified at time of analysis.
A sandbox escape in Firefox's Profile Backup component lets code that is already running inside the browser's sandboxed content process break out to browser and host privilege, but it is not a standalone remote compromise: the authoritative assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning an attacker must first hold an in-sandbox foothold (typically a separate content-process exploit) and typically requires user interaction. Mozilla's vendor advisory scores it 9.8 with a PR:N/UI:N/S:U vector, and the flaw is fixed in Firefox 156. EPSS is low at 0.14% (4th percentile) and no public exploit identified at time of analysis; there is no CISA KEV entry, so this reads as a second-stage chain link rather than a standalone exploit.
Sandbox escape in Mozilla Firefox on Windows stems from an incorrect boundary condition (CWE-119) in the Win32 Widget component, allowing an attacker who already has code execution inside a content/child sandbox to escape and gain high-impact code execution, data access, and availability impact. It affects Firefox before 156 and Firefox ESR before 153.3, with patched builds available as Firefox 156 and Firefox ESR 153.3. No public exploit or active exploitation is identified, and EPSS is low at 0.14% (4th percentile), but the CVSS score is 8.8 and exploitation is chain-dependent, typically requiring a separate content-process memory-safety bug to reach this escape stage.
Sandbox escape in Mozilla Firefox on Windows, in the Widget: Win32 component, lets an attacker who already holds low-privileged code execution inside a Firefox content/child process corrupt memory via an incorrect boundary condition (CWE-119) and break out of the browser sandbox into full user-level code execution. The flaw is Windows-only - the Win32 widget code path does not exist on macOS or Linux - and patched builds (Firefox 156 and Firefox ESR 153.3) are not exploitable; there is no public exploit identified at time of analysis and EPSS is low at 0.14% (4th percentile). Because this is a second-stage sandbox-escape primitive rather than a standalone remote bug, it is not independently exploitable against a default install without a preceding content-process compromise.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
Memory corruption in Mozilla Firefox's Process Sandboxing component, caused by incorrect boundary conditions, can be triggered when a victim browses attacker-controlled web content on any Firefox version prior to 156. Although the input feed carries a nominal CVSS of 9.8 and a CWE-119 (buffer bounds) classification, our assessment reduces the practical severity to AV:N/AC:H/PR:N/UI:R because successful exploitation requires the user to render malicious content and then reach and corrupt the targeted sandbox code path, which realistically implies chaining with a content-process compromise. No public exploit code has been identified and the flaw is not in CISA KEV, with an EPSS score of just 0.14% (4th percentile), indicating low near-term exploitation likelihood despite the high theoretical impact. The issue is unauthenticated from a network standpoint (PR:N) but is not zero-interaction.
Use-after-free in Mozilla Firefox's Internationalization (i18n) component allows remote attackers to corrupt memory and potentially execute code in the browser's content process when a victim renders attacker-controlled web content in versions before 156 or Firefox ESR before 153.3. Exploitation is unauthenticated (PR:N) but requires the victim to visit or render the malicious page (UI:R), and default cross-platform installations are exposed because the i18n code is always present. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), but the 8.8 CVSS reflects high confidentiality, integrity and availability impact confined to the content process; full system compromise would require an additional sandbox-escape chain.
Improper boundary conditions in the DOM Editor component of Mozilla Firefox can corrupt memory when a user renders crafted web content, allowing an attacker to potentially execute code inside the browser's content process. All Firefox builds before 156 and Firefox ESR builds before 153.3 are affected; the CVSS vector sets PR:N, so unauthenticated remote delivery is possible, but the assessed exploitation path requires the victim to load attacker-controlled page content (UI:R) and reliable exploitation of a memory-corruption bug typically needs heap grooming and a sandbox escape to affect the host. No public exploit code has been identified at time of analysis and EPSS is low at 0.14% (4th percentile), so despite the 9.3 base score the practical real-world priority is moderate, driven mainly by the browser's ubiquity and the fact that the fix is already shipped.
Use-after-free in Mozilla Firefox's Graphics component can be triggered when a victim browses attacker-controlled web content, allowing memory corruption that may lead to code execution or sensitive data disclosure in releases before Firefox 156 and Firefox ESR 153.3. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the default rendering configuration is exposed, so essentially all unpatched desktop users are potential targets; exploitation status is no public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile) despite the high CVSS of 8.8. Mozilla addresses the issue in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
Enterprise policy enforcement bypass in Mozilla Firefox affects all builds prior to 156 and Firefox ESR prior to 153.3, letting remote, unauthenticated attackers circumvent restrictions that administrators have locked down through the browser's Enterprise Policies component. Mozilla's advisory carries a CVSS 9.1 base score, while an independent re-assessment lowers the practical severity by raising attack complexity (AC:H) and scoping real-world impact to managed deployments where a policy is actually relied upon as a security control - a default consumer install with no policies configured has nothing to bypass. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and EPSS is only 0.15% (5th percentile); Mozilla has not disclosed the specific trigger mechanism, so precise preconditions remain unclear.
A use-after-free in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to cause memory corruption, potentially leading to code execution or information disclosure, when a user navigates to a malicious webpage. Affected are Firefox versions before 156 and Firefox ESR before 153.3; the flaw is unauthenticated (PR:N) but requires user interaction (UI:R) and is rated high severity (CVSS 8.8). No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.14% (4th percentile), indicating low likelihood of exploitation.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
Content spoofing caused by an invalid-pointer (null-pointer dereference) condition in Mozilla Firefox's Graphics rendering component affects Firefox versions prior to 156, allowing a remote, unauthenticated attacker to falsify or distort what a victim sees when the browser renders attacker-supplied web or graphics content. Mozilla shipped the fix in Firefox 156 (advisories MFSA2026-90 and MFSA2026-94, Bugzilla 2061393); there is no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is low at roughly 0.14% (4th percentile). The raw CVSS 9.1 score overstates practical risk - our independent assessment lowers it to AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L because exploitation requires the victim to navigate to and render malicious content, and the realistic outcome is spoofing plus a limited crash/denial-of-service condition rather than full integrity or availability loss.
A race condition in Mozilla Firefox's XPConnect component allows an attacker who has already compromised execution inside the content/renderer sandbox to escape that boundary and reach higher-privileged browser code. Only Firefox builds prior to version 156 are affected; the flaw was fixed upstream and published in Mozilla's MFSA 2026-90/MFSA 2026-94 advisories. Exploitation is not a standalone remote code-execution path but a chained, timing-dependent step requiring a separate renderer compromise first, and no public exploit has been identified at time of analysis, with an EPSS score of just 0.14% (4th percentile) indicating low predicted real-world activity.
Use-after-free in Mozilla Firefox's Windows-only 'Widget: Win32' component allows unauthenticated remote attackers to corrupt memory and potentially achieve code execution or information disclosure by convincing a victim on Firefox before 156 or Firefox ESR before 153.3 to render attacker-controlled web content. Exploitation requires user interaction (UI:R - the victim must load or interact with the crafted page) and is limited to the Windows platform, since the flawed Win32 widget code is Windows-specific. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low near-term exploitation likelihood, though the CVSS base of 8.8 reflects high confidentiality, integrity and availability impact if a working exploit is developed.
Sandbox escape in Mozilla Firefox's Widget:Win32 component on Windows allows code that is already running inside the browser's content/renderer sandbox to break out and execute on the host with the user's privileges, escalating a limited renderer compromise into full desktop compromise. It does not stand alone: an attacker must first obtain code execution in the content process via a separate bug, then trigger the boundary-condition memory corruption, and a victim must load attacker-controlled web content (CVSS 9.0, PR:L, UI:R, S:C). Vendor fixes are Firefox 156 and Firefox ESR 153.3; EPSS is only 0.15% (5th percentile) and no public exploit code or confirmed active exploitation has been identified, so the high base score should be weighed against the multi-stage, Windows-only prerequisites.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
Use-after-free in Mozilla Firefox's Graphics component allows remote attackers to corrupt memory and potentially achieve code execution in the browser content process, requiring only that a victim view attacker-controlled web content. Unauthenticated remote attack (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) with high confidentiality, integrity and availability impact, carrying a vendor CVSS of 8.8; affected builds are Firefox prior to 156 and Firefox ESR prior to 153.3, which are fixed in those releases. No public exploit code has been identified and EPSS is low at 0.15% (5th percentile), so exploitation is not confirmed as active; risk is concentrated in the mandatory user interaction (page visit) and sandbox constraints on post-corruption impact.
Sandbox escape in Mozilla Firefox (all versions before 156) and Firefox ESR (before 153.3) allows an attacker who gets malicious web content processed by the browser's WebRTC stack to break out of the sandboxed content process and run code with the privileges of the parent/broker process, yielding high confidentiality, integrity and availability impact. Exploitation is not trivial: the victim must load attacker-controlled content and, because the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, the bug realistically functions as a chain component on top of a renderer-level compromise rather than a single-shot webpage exploit. There is no public exploit identified at time of analysis, CISA KEV does not list it, and EPSS is only 0.15% (5th percentile), so the practical near-term risk sits below the 9.6 base score headline; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3.
Information disclosure in Mozilla Firefox's Networking: HTTP component affects Firefox builds prior to 156 and Firefox ESR builds prior to 153.3, allowing a remote, unauthenticated attacker who can influence HTTP traffic a victim's browser processes to expose high-confidentiality data (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability loss is assessed - and the flaw is consistent with CWE-200 (Exposure of Sensitive Information). At time of analysis there is no public exploit identified and no CISA KEV listing; EPSS is 0.15% (5th percentile), indicating low modeled near-term exploitation likelihood, though the unauthenticated, low-complexity profile keeps it relevant for unpatched consumer and enterprise Firefox fleets.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
A race condition in Firefox's DOM: Content Processes component (CWE-362) lets attacker-controlled web content win a non-deterministic timing window and corrupt state inside the browser's content process, yielding high confidentiality and integrity impact; Mozilla fixed it in Firefox 156 and Firefox ESR 153.3. Reachable from any loaded page but gated by user interaction and a hard-to-reliably-win race (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5), the bug carries low exploitation likelihood signals (EPSS 0.15%, 5th percentile), is not on CISA KEV, and no public exploit code has been identified at time of analysis. All Firefox builds prior to the fixed releases match the affected CPE wildcard, so unpatched installations remain exposed to remote attackers who can persuade a user to open a crafted page.
Mozilla Firefox builds before 156 (and Firefox ESR builds before 153.3) can be induced to bypass an existing browser security mitigation through attacker-influenced web content that exercises the DOM: Networking component, yielding high confidentiality and integrity impact without granting outright code execution. The vendor rates this 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), but our independent assessment adjusts the vector to UI:R, since the victim must actually load the malicious page for the bypass to trigger - a normal precondition for a client-side browser flaw. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), so near-term real-world risk is limited despite the critical score.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine can be triggered by loading attacker-controlled web content in versions before 156, potentially leading to memory corruption and code execution with high confidentiality, integrity, and availability impact. Exploitation requires user interaction (the victim must open a malicious page) but no authentication, and no public exploit or active exploitation is confirmed; the EPSS score is only 0.15% and CISA KEV does not list it, but the 8.8 CVSS and full-impact potential make patching to Firefox 156 a priority.
A mitigation bypass in Firefox's Remote Settings Client - the signed channel the browser uses to receive configuration, blocklist and policy updates - was fixed in Firefox 156 and Firefox ESR 153.3. The vendor's CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) rates it as an unauthenticated, network-reachable high-integrity/high-confidentiality issue, but that flat 9.1 should be read with caution: our independent assessment re-scores it at CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, because a bypass of the Remote Settings mitigation realistically depends on the attacker being able to tamper with settings content or its delivery channel (a man-in-the-middle position or a spoofed/compromised settings source) rather than a zero-context hit against an idle browser. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.16% (6th percentile), which is consistent with a terse, undisclosed-disparate advisory rather than a mass-exploited bug. All users on Firefox before 156 or Firefox ESR before 153.3 are affected.
Incorrect boundary conditions in the Firefox DOM Animation component (CWE-119) allow remote attackers to corrupt memory in the browser process of any default Firefox build prior to version 156, with Mozilla scoring the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) - the profile of a potential remote code execution issue. Exploitation requires the victim to load attacker-controlled web content (or attacker-supplied markup such as malvertising) that exercises the affected animation code path, so practical delivery is gated by victim interaction even though the vendor vector lists UI:N; our independent assessment therefore scores it UI:R while keeping confidentiality, integrity, and availability impact High. There is no KEV listing and no public exploit code identified at time of analysis, and EPSS is only 0.15% (5th percentile), indicating low observed exploitation likelihood measured against the high theoretical severity. No authentication or special target configuration is needed - any unpatched Firefox install is exposed.
Memory corruption in Mozilla Firefox's HTTP networking component (CWE-119) allows an attacker who controls the content of an HTTP response - for example via a malicious or compromised web server, or by man-in-the-middle position - to corrupt Firefox's memory and potentially achieve code execution in the browser process on a victim running Firefox before 156. The issue is a client-side networking-stack flaw rather than a remotely reachable server service: exploitation requires the user to initiate and complete the malicious HTTP exchange, which is why the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H while the vendor/NVD vector lists UI:N at 9.8. No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.15%, 5th percentile), and the flaw is closed by the regular Firefox 156 update, which sharply limits the exposure window.
Mozilla Firefox versions prior to 156 (and Firefox ESR prior to 153.3) contain a buffer-boundary flaw in the Graphics component that can be leveraged to escape the browser's content-process sandbox and reach the host, explaining the vendor's critical 9.6 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) - the scope change reflects a crossing from the constrained renderer process into the host, with full confidentiality, integrity and availability impact. Exploitation is not standalone: it requires a victim to load attacker-controlled web content (UI:R is mandatory) and, in practice, must be chained after an attacker has already achieved code execution inside the Firefox content process, which is why the independent assessment raises attack complexity to AC:H while leaving the 9.6-level impact intact. There is no KEV listing and no public exploit identified at time of analysis, and EPSS is low at 0.15% (5th percentile), but the vendor-released fixes - Firefox 156 and Firefox ESR 153.3 - should be applied promptly given the sandbox-escape nature of the flaw.
Improper origin validation in Mozilla Firefox's Graphics component before version 156 can allow attacker-influenced web content, once rendered by a victim, to break site-isolation boundaries and potentially disclose or corrupt data across origins. Affected users are those running Firefox versions prior to 156; exploitation requires the victim to browse to malicious or compromised web content, so it is not a no-interaction mass network exploit despite the vendor's critical 9.1 score, and the independent assessment rates it lower with high attack complexity and required user interaction. No public exploit code or active exploitation has been identified, and EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity at time of analysis.
Privilege escalation in Mozilla Firefox for Android allows an attacker who can get a user to open a crafted web page to gain privileges beyond those normally granted to web content, with high impact to confidentiality, integrity, and availability. Mozilla fixed the flaw in Firefox 156; no public exploit code and no active exploitation have been identified, and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. The 8.8 CVSS score is driven entirely by a network attack vector plus required user interaction (UI:R), so real-world risk depends on convincing a target to browse attacker-controlled content rather than on mass scanning.
Sandbox escape in Mozilla Firefox's Graphics component, rooted in an invalid-pointer memory-safety flaw (CWE-119), allows attacker-controlled content loaded by a victim to cross the browser's process-sandbox boundary and reach the privileges of the parent/broker process. Default configurations of Firefox before 156 and Firefox ESR before 140.16 / 153.3 are affected; the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) indicates no authentication or privileges are required, but the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis and EPSS is low (0.16%, 5th percentile); the real-world bar is further raised because a sandbox escape of this class generally has to be chained with a separate content-process memory-corruption primitive to be exploited end-to-end.
Use-after-free in Mozilla Firefox's SVG component allows remote attackers to corrupt memory and potentially achieve code execution or sensitive data disclosure when a victim renders attacker-controlled SVG content in an unpatched browser. Only Firefox builds prior to 156 and Firefox ESR prior to 115.41, 140.16, and 153.3 are affected; Mozilla has shipped fixed releases in all of those channels. The attack is unauthenticated per the CVSS vector (PR:N) but requires user interaction (UI:R) - the victim must load a page or view content that renders the malicious SVG - and although EPSS is low (0.16%, 5th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, drive-by delivery via malvertising or compromised sites can satisfy that interaction requirement at scale, making this a genuine high-priority browser issue rather than an emergency.
Use-after-free in Firefox's DOM: Core & HTML component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). All Firefox builds prior to 156, plus ESR branches prior to 115.41, 140.16, and 153.3, are affected according to the Mozilla security advisories. No public exploit code or confirmed active exploitation was identified at time of analysis (EPSS 0.16%, 5th percentile), and vendor patches are available.
Use-after-free in Mozilla Firefox's DOM Streams component lets unauthenticated remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim simply loads attacker-controlled web content in an unpatched build. Any default Firefox installation older than 156, ESR 115.41, ESR 140.16, or ESR 153.3 is affected, and successful weaponization requires the crafted page to drive the DOM Streams code path and win a heap-grooming race after user interaction (navigation) - there is no public exploit code identified at time of analysis and no confirmed active exploitation (EPSS 0.16%, 5th percentile). Confidence in real-world exploitation is therefore low, but the high integrity/confidentiality/availability impact (CVSS 8.8) and the breadth of the Firefox install base make prompt patching worthwhile.
Use-after-free in the Networking component of Mozilla Firefox allows remote, unauthenticated attackers to potentially corrupt memory and achieve code execution or sensitive-data disclosure when a victim renders attacker-controlled web content, affecting Firefox builds prior to 156 and Firefox ESR prior to 140.16 or 153.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), no credentials are needed but the victim must interact by loading a malicious or compromised page, and the browser must be unpatched. No public exploit code has been identified at time of analysis and the EPSS score is low at 0.16% (5th percentile), so while the 8.8 base score reflects high potential impact, this is a genuine high-severity issue rather than a near-term emergency; practical exploitation would additionally require defeating the content-process sandbox and modern memory mitigations.
Use-after-free in Firefox's DOM: Navigation component allows memory corruption that a remote attacker can trigger by convincing a victim to load attacker-controlled web content in an unpatched build, potentially leading to code execution in the browser's content process. All Firefox builds below 156 are affected, along with the ESR branches below 115.41, 140.16 and 153.3, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) reflects unauthenticated remote attack with high confidentiality, integrity and availability impact, gated only by the required user interaction of visiting the crafted page. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), so this should be handled as a standard high-priority browser patch item rather than an emergency, though full compromise would additionally require escaping the content-process sandbox.
A use-after-free in the Firefox SVG rendering component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially achieve code execution by getting a victim to load a crafted SVG, whether on a web page or embedded in content the browser renders. Every Firefox release prior to 156 and all ESR branches below 115.41, 140.16, and 153.3 are affected; exploitation requires the user to open attacker-controlled content (UI:R), so no authentication or special privileges are needed and default configurations remain vulnerable because SVG rendering is enabled out of the box. Vendor/NVD scoring is 8.8 High (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), EPSS is a low 0.16% (5th percentile), and there is no public exploit identified at time of analysis - the primary constraints on real-world abuse are the required user interaction and the need to bypass the Firefox sandbox and other memory-safety mitigations for a full compromise.
Use-after-free in Mozilla Firefox's XML component can lead to memory corruption and potentially code execution when a user loads crafted content in an unpatched build. The flaw affects Firefox before 156 and Firefox ESR branches before 115.41, 140.16, and 153.3; per the CVSS vector it is remotely reachable without authentication (PR:N) but requires user interaction (UI:R), and the assessed severity is high (CVSS 8.8). No public exploit code was identified at time of analysis, and EPSS is 0.16% (5th percentile), so while the technical impact is serious, real-world urgency is moderate-to-high rather than emergency-tier.
A use-after-free in Firefox's DOM HTML Parser can corrupt memory when the victim loads attacker-controlled HTML, giving an unauthenticated remote attacker a path to code execution or information disclosure inside the browser process. Affected builds are Firefox before 156 and the ESR lines before 115.41, 140.16, and 153.3; exploitation requires only that a user open a malicious page or one serving malicious markup (UI:R, PR:N), not credentials or non-default settings. No public exploit code or in-the-wild activity has been identified, and EPSS is low at 0.16% (5th percentile), so this is a serious client-side bug that is not currently a top-of-queue emergency.
Use-after-free in Mozilla Firefox's JavaScript JIT compiler can lead to memory corruption and potentially remote code execution when an unauthenticated remote attacker convinces a victim to load attacker-controlled JavaScript in a vulnerable Firefox build. Affected versions are Mozilla Firefox releases prior to the fixed Firefox ESR 140.16, with exploitation requiring user interaction (UI:R) and JavaScript enabled, which is the default; the content-process sandbox and site isolation limit standalone impact. EPSS is 0.15% (5th percentile) and no public exploit code was identified at time of analysis, indicating a high-severity but not top-of-queue emergency.
An incorrect-bounds condition in Firefox's WebRender graphics component lets crafted web content corrupt memory inside the browser, giving the attacker a path to code execution and privilege escalation on the affected system. All Firefox releases before 156 are affected, along with the ESR branches before 115.41, 140.16, and 153.3; exploitation requires the victim to load attacker-influenced content (CVSS UI:R), and no public exploit code or CISA KEV entry has been recorded at time of analysis. With a CVSS base of 8.8 across full confidentiality, integrity, and availability impact, this is a high-severity browser flaw that should be patched on a normal browser-update cadence.
A mitigation bypass in Mozilla Firefox's Remote Settings Client component allows a remote, unauthenticated attacker to defeat a browser security control when a victim interacts with attacker-influenced content, potentially leading to high confidentiality and integrity impact. All Firefox builds prior to 156 and ESR branches prior to 115.41, 140.16, and 153.3 are affected; the issue was fixed in those releases per Mozilla advisories mfsa2026-90 through mfsa2026-96. Exploitation requires user interaction (UI:R) and the vulnerability is characterized as a mitigation bypass that generally must be chained with another primitive to produce direct impact; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the EPSS score is low at 0.16% (6th percentile), so this should be treated as a moderate-priority patch item rather than an emergency.
Sandbox escape in Mozilla Firefox's DOM: Core & HTML component lets attacker-controlled web content break out of the browser's content sandbox, escalating an unprivileged web page into code execution outside the expected security boundary. Exploitation requires only that a victim load malicious HTML or navigate to an attacker-controlled page in an unpatched build - the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms no authentication or privileges are needed, with user interaction being the sole prerequisite. Affected are Firefox builds before 156 and Firefox ESR before 115.41, 140.16, or 153.3; fixes are already published by Mozilla. Risk signals are mixed: the CVSS base score of 9.6 signals critical impact, while EPSS is low at 0.16% (5th percentile) and no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs lets unauthenticated remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content, with the only significant precondition being that the user must visit or render the crafted page (UI:R). Affected builds are all Firefox versions before 156, Firefox ESR before 140.16, and Firefox ESR 153.3, across platforms covered by the wildcard CPE cpe:2.3:a:mozilla:mozilla:firefox:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); EPSS is low at 0.16% (5th percentile), but the 8.8 CVSS profile (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H) matches a heap-corruption bug that can escalate to code execution in the affected process, so patching should not be deferred.
Let me synthesize. CVE-2026-92015 — privilege escalation in Firefox WebExtensions. CVSS 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-269 improper privilege management. Fixed in Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. SSVC: exploitation none, automatable no, technical impact total. No KEV, no POC mentioned. Product name: "Firefox WebExtensions" — 1-3 words. Maybe "Mozilla Firefox" is safest but the specific component is WebExtensions. Let's use "Firefox WebExtensions". Hmm, guidance says product name 1-3 words, specific product. "Firefox WebExtensions" works. Summary: must not start with "A vulnerability". Start with impact verb + product. "Privilege escalation in Mozilla Firefox's WebExtensions component allows ..." Requires UI:R, so user interaction — a user must visit a page or install an extension? Description is vague. CVSS says AV:N/PR:N/UI:R. So an attacker could get a user to interact (e.g., install malicious extension or visit a page) which then allows privilege escalation from extension context to higher privileges (browser-level / OS-level?). CWE-269 improper privilege management. Be careful: we don't know exact mechanism beyond "privilege escalation in WebExtensions component". Confidence notes should state that the root cause mechanism is not described publicly beyond CWE-269; Bugzilla bug 2060235 is likely restricted. Affected products: Firefox < 156, ESR < 115.41, ESR < 140.16, ESR < 153.3. CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. Advisories mfsa2026-90 through -93. Remediation: upgrade to Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3. Workarounds: restrict extension installation via enterprise policy (ExtensionSettings / blocked_install_message), disable WebExtensions? Not feasible. Mention that extension installation restrictions reduce exposure; trade-off: blocks all extension installs including legitimate ones. Prevalence: Firefox is widely deployed → high. Maybe "high" — ubiquitous is for OpenSSL/nginx/Linux kernel. Firefox
Incorrect boundary conditions in Firefox's Graphics component allow a privilege escalation that was fixed in Firefox ESR 115.41 and Firefox ESR 140.16. An attacker who can get a victim to load crafted content — a web page or similar rendered surface — can trigger a buffer overflow (CWE-120) in the graphics pipeline and potentially cross from the low-privilege content process into a more privileged browser context, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC records exploitation status as 'none', though the CVSS base score of 8.8 and the total technical impact rating make patching a priority for any organization running an unpatched ESR branch.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a crafted web page corrupt memory and gain privileges beyond those normally granted to web content. Exploitation requires the victim to open a malicious page in an affected Firefox build (network vector, no authentication, user interaction required), after which an attacker can achieve high confidentiality, integrity and availability impact. Mozilla fixed the flaw in Firefox 156, Firefox ESR 115.41, ESR 140.16 and ESR 153.3; CISA SSVC records no known exploitation and the issue is not considered automatable, and no public exploit code has been identified at time of analysis.
A boundary-condition error in Firefox's Graphics: CanvasWebGL component allows an attacker who lures a victim to a crafted web page to corrupt memory and escalate privileges, with a CVSS base score of 8.8 reflecting high confidentiality, integrity, and availability impact. The flaw is a classic buffer overflow (CWE-120) in the WebGL/Canvas rendering path, reachable over the network with no authentication but requiring user interaction (UI:R) in the form of visiting attacker-controlled content. Mozilla has shipped fixes in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3, and no public exploit code or active exploitation has been identified at time of analysis.
A memory-corruption flaw in Mozilla Firefox's CanvasWebGL graphics component (incorrect boundary conditions, CWE-120) allows a remote attacker to crash or corrupt the browser's heap and potentially escalate privileges beyond the normal content-process security boundary. Every Firefox release before 156 and every ESR branch before 115.41, 140.16, and 153.3 is affected, and exploitation requires the victim to load attacker-controlled web content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code and no active exploitation are reported at time of analysis — CISA's SSVC records Exploitation: none and Automatable: no, so this is a patch-priority issue rather than an emergency.
Memory corruption in Mozilla Firefox's Graphics: CanvasWebGL component lets a web page that renders attacker-crafted WebGL content corrupt memory and escalate out of the browser's restricted process, yielding code execution at higher privilege. All Firefox builds before 156 are affected, with ESR branches fixed in 115.41, 140.16, and 153.3. No public exploit code exists and CISA SSVC records exploitation as 'none', so this is a high-severity patch-now bug rather than an active campaign.
An out-of-bounds write in Firefox's Graphics: CanvasWebGL component lets a malicious web page corrupt memory and gain elevated privileges on the host, affecting Firefox builds prior to 156 and the ESR branches prior to 115.41, 140.16, and 153.3. Exploitation is remote but requires the victim to load attacker-controlled WebGL/Canvas content (CVSS UI:R), so it is not automatable and no public exploit code or active exploitation has been identified at time of analysis. Mozilla rated it High (CVSS 8.8) with total technical impact under CISA's SSVC framework.
Incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allow a remote attacker who convinces a user to open a crafted page to corrupt memory and achieve code execution with the privileges of the browser. The flaw is a classic buffer overflow (CWE-120) rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), meaning no authentication is needed but the victim must load attacker-controlled content. Mozilla fixed it in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3; no public exploit code has been identified and CISA's SSVC assessment records no active exploitation.
Privilege escalation in Mozilla Firefox's Graphics: CanvasWebGL component lets a remote, unauthenticated attacker corrupt memory via malformed WebGL content and gain elevated code execution inside the browser process, provided the victim loads an attacker-controlled page. Mozilla shipped fixes in Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3 (mfsa2026-90 through mfsa2026-93). CVSS is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), CISA SSVC records Exploitation: none and Automatable: no, no CISA KEV listing is present, and no public exploit code has been identified at time of analysis.
A memory-safety flaw in the Graphics: CanvasWebGL component of Mozilla Firefox allows a crafted web page to corrupt memory and escalate privileges beyond the browser's normal security boundary. Because exploitation only requires the victim to load attacker-controlled WebGL/Canvas content in an unpatched Firefox build, the issue affects all mainstream, ESR 115, ESR 140, and ESR 153 release trains prior to the fixed versions. Mozilla has released Firefox 156, Firefox ESR 115.41, ESR 140.16, and ESR 153.3, and while no public exploit code or CISA KEV entry has been identified at time of analysis, the CWE-120 buffer-condition root cause and CVSS 8.8 rating make prompt patching important.
Sandbox escape in wasm2c (wabt ≤ 1.0.41) allows an attacker controlling WebAssembly content to achieve arbitrary read/write of host process memory and code execution by exploiting an unchecked calloc() return value during funcref table allocation. When calloc() fails, table->data is left NULL while table->size retains the guest-declared element count, causing bounds checks to pass and element accesses to resolve to absolute low-memory addresses - fully defeating the isolation wasm2c exists to provide. Firefox's RLBox sandboxing of Graphite, Hunspell, Ogg, Expat, and Woff2 libraries is affected, and a public proof-of-concept ('table flip') is available, though exploitation requires specific memory-failure conditions to be present.
Thunderbird's remote attachment allowlist control (`mail.allowed_attachment_hostnames`) can be bypassed due to insufficient regex escaping of configured hostname values, allowing attacker-controlled servers to serve remote attachments that the filter was intended to block. Affected are all Thunderbird releases prior to 155 and 153.2; because hostname strings containing dots and other regex metacharacters are interpolated directly into a regular expression without sanitization, a crafted attachment hostname can pattern-match an allowlisted domain without being that domain. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with low-urgency real-world exploitation risk.
Heap memory disclosure in Mozilla Thunderbird's IMAP client allows a malicious IMAP server to trigger a use-after-free by sending a crafted ID extension response, leaking heap contents that are subsequently persisted to the user's prefs.js file on disk. All Thunderbird releases prior to 155, 140.15 (ESR), and 153.2 across three active release channels are affected. No public exploit or active exploitation has been identified at time of analysis; the EPSS score of 0.15% (4th percentile) reflects low current exploitation probability.
Thunderbird's mail header parser triggers a one-byte buffer over-read (CWE-126) when processing a maliciously crafted message header, potentially exposing a single byte of adjacent heap memory to the sender. All Thunderbird versions across three active release branches are affected until patched - 155, 140.15, and 153.2. No public exploit has been identified and EPSS sits at the 4th percentile, but the network-accessible attack path with no user interaction required keeps this relevant for unpatched deployments.
Use of uninitialized memory in Mozilla Thunderbird's MIME parser allows a remote attacker who sends a specially crafted email to trigger an error condition in certain MIME bodies, causing the client to read uninitialized memory. Depending on what previously occupied that memory, this can leak sensitive process data or crash the application. The flaw was fixed in Thunderbird 155, 140.15 ESR, and 153.2; no public exploit has been identified and EPSS exploitation probability is low (0.15%, 4th percentile).
Arbitrary code execution in Mozilla Thunderbird before 154 (and before ESR 153.2) on Windows allows a crafted calendar (iCalendar) invitation to attach a file:// URI that points at a local or network-hosted executable, bypassing Thunderbird's normal blocking of executable attachments. When the new invitation display is enabled the attachment can also be shown under a misleading, benign-looking filename. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; EPSS is low at 0.15% (5th percentile).
Memory safety vulnerabilities across multiple internally discovered bugs in Firefox 154 and Firefox ESR 153.1 allow network-based attackers to potentially achieve full browser compromise through memory corruption (CWE-119). Mozilla's own advisory clusters dozens of individual Bugzilla reports - including buffer overflows and related defects - under a single advisory umbrella, noting that sufficiently motivated attackers could likely exploit some of these bugs. Vendor-released patch is available: Firefox 155 and Firefox ESR 153.2. No public exploit identified at time of analysis.
Memory corruption in Mozilla Firefox 154, Firefox ESR 153.1, and Firefox ESR 140.14 stems from a batch of internally discovered memory-safety defects that Mozilla presumes could be exploited to run arbitrary code within the browser process. The flaws were found by Mozilla's own developers and fuzzing efforts (no external report), affect the mainline and both ESR trains, and are resolved in Firefox 155, ESR 140.15, and ESR 153.2. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).
Memory-corruption defects in Mozilla Firefox 154 were discovered internally by Mozilla and bundled under CVE-2026-84142 (advisories MFSA2026-82 and MFSA2026-86), and fixed in Firefox 155. Several of the reported Bugzilla issues showed evidence of memory corruption that Mozilla presumes could have been exploited with sufficient effort to achieve code execution when a user renders malicious web content. There is no public exploit identified at time of analysis and EPSS is low (0.14%), consistent with an internally-found, pre-disclosure fix rather than active abuse.
Memory corruption in the Graphics: ImageLib component of Mozilla Firefox stems from an integer overflow when handling image data, potentially allowing remote attackers to corrupt heap memory and achieve code execution when a victim renders malicious image content. Mozilla fixed the issue in Firefox 155 and Firefox ESR 153.2 (advisories mfsa2026-82/85/86/88). It carries a critical 9.8 CVSS score, but EPSS is only 0.14% (4th percentile), it is not in CISA KEV, and no public exploit was identified at time of analysis.
Cross-origin data exposure in Mozilla Firefox's DOM: Navigation component stems from a site isolation failure that lets malicious web content bypass the same-origin/site boundary Firefox enforces to keep pages from different sites in separate processes. The flaw affects Firefox before version 155 and Firefox ESR before 153.2, and could allow a crafted page to read or influence data belonging to another origin. Reported and fixed by Mozilla (MFSA2026-82/-85/-86/-88); no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile).
An improper input validation defect (CWE-20) in Firefox Focus for Android was reported and fixed by Mozilla in Firefox 155 per advisory MFSA2026-82. The public description is a placeholder-grade 'Other issue' with no technical mechanism disclosed, so the concrete impact cannot be verified; there is no public exploit identified at time of analysis and EPSS is low (0.13%, 3rd percentile). Despite a headline CVSS of 9.8, the vendor tag set and thin description leave the real-world severity for this privacy-focused mobile browser unconfirmed.
Information disclosure in Mozilla Firefox's Profile Backup component, remediated in Firefox 155 and Firefox ESR 153.2 (Mozilla advisories MFSA2026-82/85/86/88). Mozilla provides only an 'Other issue' placeholder description, so the precise mechanism is undisclosed, but the CWE-200 classification points to unintended exposure of data handled during profile backup. No public exploit or active exploitation has been identified, and EPSS is very low (0.14%, 4th percentile).
Cross-origin information disclosure in Mozilla Firefox arises from a site-isolation failure in the DOM Push Subscriptions component (CWE-346, origin validation error), allowing content from one origin to be improperly associated with or exposed to another. It affects Firefox before 155 and Firefox ESR before 153.2, and was disclosed and patched by Mozilla; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 4th percentile). The 'Information Disclosure' tag is consistent with the CWE and the likely cross-origin read impact.
Information disclosure via Firefox's Networking: HTTP component exposes sensitive data to remote unauthenticated attackers in all Firefox versions prior to 155 and all Firefox ESR versions prior to 153.2. The flaw is tracked in Mozilla Bugzilla #2063020 and addressed across four Mozilla security advisories (mfsa2026-82, -85, -86, -88), indicating backport coverage across multiple ESR branches. No public exploit code exists and EPSS probability is very low (0.14%), though the SSVC framework marks the class as automatable.
Information disclosure in Mozilla Firefox's WebGPU graphics component allows remote attackers to read sensitive data - potentially including cross-origin content or GPU memory - by luring a user to a crafted web page. Affected releases are all Firefox versions prior to 155 and Firefox ESR prior to 153.2. Vendor-released patches are available in Firefox 155 and Firefox ESR 153.2; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data exposure in Mozilla Firefox arises from a site-isolation defect in the DOM Navigation component, where origin boundaries are not correctly enforced during navigation, potentially letting a malicious page access data belonging to another origin. It affects Firefox before 155 and Firefox ESR before 153.2, and was fixed by Mozilla in those releases (advisories mfsa2026-82/85/86/88). No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile).
Privilege escalation in Firefox's WebDriver BiDi component allows network-based attackers, with user interaction, to achieve full compromise of the browser process across confidentiality, integrity, and availability dimensions. All Mozilla Firefox versions prior to 155 are affected, as confirmed by vendor advisory mfsa2026-82 and the wildcard CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis, and SSVC confirms no observed exploitation, though CISA rates the technical impact as total.
Use-after-free in Firefox's WebGPU graphics component allows privilege escalation when a victim visits a specially crafted webpage. Affecting all Firefox versions prior to 155 and ESR prior to 153.2, a remote unauthenticated attacker can trigger memory corruption by delivering malicious WebGPU content, achieving full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit or active exploitation has been identified at time of analysis; SSVC confirms exploitation status as none and the attack is not automatable due to required user interaction.
Privilege escalation in Mozilla Firefox for Android (versions prior to 155) allows a remote, unauthenticated attacker to achieve full compromise of confidentiality, integrity, and availability by exploiting improper access control (CWE-284) when a user interacts with attacker-controlled content. Mozilla confirmed the fix in Firefox 155, documented under MFSA2026-82. No public exploit code exists and CISA has not added this to KEV, though SSVC rates the technical impact as 'total', underscoring the severity if successfully triggered.
Memory corruption vulnerabilities internally discovered across multiple Firefox release lines (154, ESR 153.1, ESR 140.14, ESR 115.39) could enable remote code execution when a user visits a specially crafted webpage. Mozilla's security team identified a cluster of memory safety bugs spanning 15+ tracked Bugzilla issues, several of which showed direct evidence of memory corruption sufficient to presume exploitability with sufficient attacker effort. Patches are available across all affected branches (Firefox 155, ESR 115.40, ESR 140.15, ESR 153.2); no public exploit code or CISA KEV listing is associated with this advisory.
Privilege escalation in Mozilla Firefox's Graphics component via an invalid pointer (CWE-763) exposes users running all Firefox versions prior to 155 and ESR branches prior to 115.40, 140.15, and 153.2 to full compromise of confidentiality, integrity, and availability. The CVSS 8.8 network-vector score with no required privileges but mandatory user interaction (UI:R) places this squarely in the drive-by exploitation category - a victim visiting a crafted webpage is sufficient to trigger the flaw. No active exploitation is confirmed at time of analysis (SSVC exploitation: none, no KEV listing), but the total technical impact rating and the broad Firefox install base make this a high-priority patching target.
Sandbox escape via use-after-free in the Firefox DOM: Security component allows an attacker who lures a victim to a malicious web page to corrupt memory and break out of the browser content sandbox, potentially achieving code execution in a higher-privilege context. All Firefox release and ESR channels prior to the fixed builds are affected. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, but the 9.6 CVSS and scope-change sandbox-escape nature make this a high-priority browser update.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the DOM: Navigation component, letting a malicious web page that a user visits corrupt memory and potentially execute code outside the content sandbox. It affects Firefox before 155 and multiple ESR trains (115.x, 140.x, 153.x), carries a critical 9.6 CVSS with a scope change (browser sandbox to host), and requires the victim to load attacker-controlled content (UI:R). No public exploit identified at time of analysis and CISA SSVC lists exploitation as none.
Memory-safety defects in Mozilla Firefox 153 could allow remote attackers to corrupt memory and potentially achieve arbitrary code execution when a victim renders malicious web content, and were resolved in Firefox 154. These bugs were discovered internally by Mozilla with no public exploit identified at time of analysis, and the EPSS exploitation probability is low (0.15%, 5th percentile). The issues are classified as buffer/memory-corruption defects (CWE-119) that Mozilla presumes could have been exploited with sufficient effort.
Memory-corruption defects in Mozilla Firefox 153 and Firefox ESR 153.0, disclosed by Mozilla in advisories MFSA2026-74/77/78/80, could allow a remote attacker to corrupt memory and potentially achieve arbitrary code execution within the browser process. The issues were found internally by Mozilla developers and fixed in Firefox 154 and Firefox ESR 153.1. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), consistent with a proactively-patched roll-up of memory-safety bugs rather than an actively exploited flaw.