Mozilla
Monthly
Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.
Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Site isolation bypass in Mozilla Firefox's Audio/Video Web Codecs component allows remote attackers to perform cross-origin data access, potentially reading or modifying content belonging to other origins within the browser. Rooted in CWE-346 (Origin Validation Error), the flaw affects all Firefox releases prior to 154 and all ESR releases prior to 153.1. No public exploit identified at time of analysis, and an EPSS score of 0.15% (5th percentile) signals low current exploitation probability despite the high CVSS base score of 8.1.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue.
Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.
Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Site isolation is broken in Firefox's WebExtensions component, allowing cross-origin access control boundaries to be violated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) places this as network-exploitable with high confidentiality and integrity impact, requiring only that a user visit an attacker-controlled page. Vendor-released patches are confirmed across all active Firefox release channels; no public exploit has been identified at time of analysis and EPSS at 0.16% (5th percentile) reflects low current exploitation probability.
Protection-mechanism bypass in the Storage: Cache API of Mozilla Firefox lets remote web content defeat a built-in security mitigation, exposing sensitive data and allowing unauthorized modification (CVSS 9.1, C:H/I:H). All Firefox builds prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. Reported by Mozilla with no public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile).
Safe Browsing mitigation bypass in Mozilla Firefox allows a remote unauthenticated attacker (with user interaction) to circumvent Firefox's phishing and malware URL-blocking protections, classified under CWE-693 (Protection Mechanism Failure). Affected versions span all Firefox releases prior to 154 and all ESR branches prior to 140.14 and 153.1, giving this a broad blast radius across consumer and enterprise deployments. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low observed exploitation activity despite the high CVSS score of 8.1.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.
Broken access control in Flowise's GET /api/v1/upsert-history API endpoint exposes the entire server-wide upsert history - exceeding 100MB per response - to any authenticated user, leaking sensitive infrastructure credentials including Qdrant server URLs, collection names, and vector pipeline configuration across all tenants and workspaces. The vulnerability is confirmed in flowise <= 3.1.2 and publicly documented in GHSA-fr6g-7cq8-fg82 with a working curl-based proof-of-concept, meaning any account holder on a multi-tenant deployment can harvest cross-tenant vector store configuration for reconnaissance or targeted follow-on attacks against exposed backends. Vendor-released patch flowise@3.1.3 is confirmed available and addresses missing workspace-scoping enforcement across multiple API controllers.
Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.
Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.
Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.
Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.
Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.
Access-control mitigation bypass in the DOM Service Workers component of Mozilla Firefox before version 153 allows remote content to circumvent a browser security mitigation, undermining protections intended to isolate web origins. Mozilla self-reported the flaw (MFSA2026-68/71) and shipped a fix in Firefox 153; there is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile). The NVD-assigned CVSS of 9.8 (full CIA impact, no user interaction) is notably higher than typical for a browser mitigation bypass, which warrants scrutiny.
Security mitigation bypass in the Networking component of Mozilla Firefox before version 153 lets remote attackers defeat a built-in protection mechanism, carrying high confidentiality and integrity impact per the CVSS 9.1 rating. The flaw was reported and fixed by Mozilla in Firefox 153 (advisory MFSA2026-68) and is classified under CWE-693 (Protection Mechanism Failure), with tags indicating an authentication/authorization bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.
UI/content spoofing in Mozilla Firefox for Android (fixed in version 153) lets a remote attacker who lures a user to attacker-controlled content misrepresent trusted interface elements, undermining the integrity of what the user believes they are viewing or interacting with. The flaw is classified as an authentication-bypass-by-spoofing weakness (CWE-290) and requires user interaction. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.13%, 3rd percentile).
Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.
Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.
Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.
Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.
Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Protection mechanism failure in the DOM: Security component of Mozilla Firefox lets remote attackers bypass a browser security mitigation, undermining defenses that isolate web content and enforce origin/policy boundaries. Mozilla rates this Critical (CVSS 9.1) with high confidentiality and integrity impact and no authentication or user interaction required per the assigned vector; it is corrected in Firefox 153 (MFSA 2026-68). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in the Audio/Video Gecko Media Plugin (GMP) component of Mozilla Firefox lets remote attackers trigger a buffer overflow through crafted media content, which per CVSS can disclose sensitive process memory and corrupt process state (C:H/I:H). The flaw affects Firefox before 153 and the ESR 115.x and 140.x branches; Mozilla shipped fixes in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the 9.1 CVSS reflects an unauthenticated, network-reachable memory-safety bug in a core browser subsystem.
Memory corruption in Mozilla Firefox's WebGPU graphics component (fixed in Firefox 153) lets a remote attacker serving crafted web content trigger an out-of-bounds memory operation, enabling sensitive memory disclosure and browser crashes. The flaw is a CWE-119 boundary-condition error rated CVSS 9.1 (C:H/A:H, no integrity impact), consistent with an information-leak-plus-denial-of-service primitive rather than confirmed code execution. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile), indicating no evidence of active exploitation despite the high base score.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Information disclosure in Mozilla Firefox's Storage: IndexedDB component allows a remote attacker to leak sensitive data across origins or from other browsing contexts without authentication or user interaction. The flaw affects Firefox releases prior to 153 and ESR builds prior to 140.13; there is no public exploit identified at time of analysis, and its EPSS score (0.15%, 5th percentile) indicates low near-term exploitation likelihood despite a CVSS of 7.5. Mozilla has released fixed builds, so the practical priority is prompt browser updating rather than emergency response.
Protection-mechanism bypass in Mozilla Firefox's Enterprise Policies component allows attackers to circumvent security restrictions that administrators enforce through managed policy, undermining controls an organization relies on to lock down the browser. Mozilla rates the flaw CVSS 9.1 (network vector, low complexity, no privileges or user interaction) affecting Firefox before 153 and Firefox ESR before 140.13. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile).
Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a malicious web page to read uninitialized process memory, potentially leaking sensitive data such as heap contents, pointers, or cross-origin material, before the fix in Firefox 153. The flaw stems from WebGPU operating on memory that was never initialized (CWE-908), and while CVSS rates confidentiality impact High (7.5), EPSS is very low (0.14%, 4th percentile) with no public exploit and no CISA KEV listing. Exploitation is browser-based, requiring a victim to load attacker-controlled WebGPU content.
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a remote attacker to read leftover uninitialized memory, potentially exposing sensitive data such as other pages' content, GPU buffers, or process memory. The flaw stems from a WebGPU code path returning memory that was never zeroed, and is fixed in Firefox 153; there is no public exploit identified at time of analysis and the EPSS score is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to read uninitialized memory contents via crafted WebGPU operations, potentially leaking sensitive process memory such as heap data, addresses, or other page content. The flaw is network-reachable without authentication or user interaction beyond visiting a malicious page, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.14% exploitation probability.
Security-mitigation bypass in Mozilla Firefox's DOM: Networking component undermines a built-in protection mechanism (CWE-693), potentially allowing crafted web content to defeat network-layer defenses in versions prior to Firefox 153 and ESR 140.13. The issue was reported and patched by Mozilla with no public exploit identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and it is not listed in CISA KEV. The NVD-assigned CVSS of 9.8 (network, no auth, no user interaction) sits in tension with the sparse 'mitigation bypass' description, which typically describes a defense-defeating enabler rather than direct code execution.
Protection-mechanism bypass in Mozilla Firefox's DOM Service Workers component allows remote web content to circumvent a browser security mitigation, weakening defenses that normally contain untrusted script. The flaw affects Firefox versions prior to 153 and was reported and patched by Mozilla (MFSA2026-68). No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at only 0.15% (5th percentile), indicating no observed weaponization despite the high nominal CVSS score.
Same-origin policy bypass in Mozilla Firefox's Networking DNS component allows remote attackers to circumvent origin isolation and read or manipulate data belonging to other web origins. Affects Firefox before 153 and Firefox ESR before 140.13, exploitable over the network without authentication or user interaction (CVSS 9.1). No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile).
Protection mechanism bypass in the Networking component of Mozilla Firefox (versions prior to 153) allows remote attackers to circumvent a built-in security mitigation over the network without authentication or user interaction, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Mozilla (MFSA2026-68) tags this as an authentication/mitigation bypass with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox before version 153 stems from an input-validation flaw in the DOM Copy & Paste and Drag & Drop component, allowing remote content to potentially read data that should remain isolated. The provided CVSS vector rates confidentiality impact as High with no privileges or user interaction, and Mozilla has shipped a fix in Firefox 153. There is no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low near-term exploitation likelihood.
Mitigation bypass in the Mozilla Firefox PDF Viewer component undermines a built-in security control (CWE-693 Protection Mechanism Failure), weakening a defense-in-depth barrier that would otherwise contain malicious PDF content. Mozilla self-reported the issue and shipped fixes in Firefox 153 and Firefox ESR 140.13 via advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and EPSS is very low (0.16%, 6th percentile), so the headline CVSS 9.8 reflects worst-case potential rather than demonstrated mass exploitation.
Remote denial-of-service in Mozilla Firefox's Graphics: WebGPU component allows a malicious web page to exhaust browser resources and crash or hang the browser without any user credentials or interaction. The flaw affects Firefox versions prior to 153 and is triggered simply by loading attacker-controlled content that abuses the WebGPU API. There is no public exploit identified at time of analysis, and EPSS scores the exploitation likelihood at only 0.14%, indicating low near-term probability of widespread exploitation.
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Information disclosure in the Firefox DevTools Framework component allows an attacker to read data that should remain isolated, affecting Mozilla Firefox prior to 153 and Firefox ESR prior to 140.13. Reported by Mozilla and carrying a CVSS 7.5 (high) rating driven by high confidentiality impact, there is no public exploit identified at time of analysis and the EPSS probability is low at 0.15% (5th percentile). The issue is fixed and not listed in CISA KEV.
Information disclosure in the Privacy component of Mozilla Firefox for Android allows remote attackers to expose sensitive user data, with the flaw carrying a high confidentiality impact (CVSS 7.5). Mozilla self-reported and fixed the issue in Firefox 153 per advisory MFSA2026-68; there is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile). The Privacy component context suggests leakage of protected browsing state or user data that the browser is designed to isolate.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows attackers to escape or elevate beyond the sandboxed content process, gaining higher browser privileges on affected versions prior to Firefox 153. The flaw is a CWE-269 improper privilege management issue reported by Mozilla and patched in Firefox 153 (advisory MFSA2026-68). No public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no observed exploitation activity at time of analysis despite the high CVSS 9.8 rating.
Privilege escalation in Mozilla Firefox's DOM Navigation component allows remote attackers to elevate privileges, and given the CVSS network vector (AV:N/PR:N/UI:N) an attacker could compromise confidentiality, integrity, and availability without authentication or user interaction. The flaw affects Firefox before version 153 and Firefox ESR before 140.13, and was fixed by Mozilla in those releases. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Protection-mechanism bypass in the DOM: Networking component of Mozilla Firefox lets a remote, unauthenticated attacker circumvent a browser security mitigation, exposing confidential data and enabling integrity compromise (CVSS 9.1) without user interaction. Reported by Mozilla and fixed in Firefox 153, the flaw affects users browsing to attacker-controlled web content. No public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation is not yet widespread.
Cross-origin information disclosure in Mozilla Firefox's CSS Parsing and Computation component allows a malicious web page to bypass site isolation and read data it should not have access to, affecting Firefox before 154 and Firefox ESR before 153.1. The flaw is remotely reachable over the network with no privileges required per the supplied CVSS vector, though realistic exploitation hinges on a victim loading attacker-controlled web content. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), indicating no observed weaponization.
Privilege escalation in Mozilla Firefox's Enterprise Policies component allows an attacker to gain elevated privileges by subverting administrator-defined policy enforcement, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla (the reporter) assigned CWE-269 (Improper Privilege Management) and the record carries a CVSS 9.8 rating, though the low EPSS score (0.15%, 5th percentile) signals minimal predicted exploitation. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial-of-service in Mozilla Firefox's Widget component allows remote attackers to crash or hang the browser via specially crafted web content, exploiting uncontrolled resource consumption (CWE-400). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing patches across four security advisories (mfsa2026-74, -77, -78, -80). No public exploit has been identified and EPSS sits at the 5th percentile, indicating low real-world exploitation probability despite the high CVSS base score.
Site isolation bypass in Mozilla Firefox's Audio/Video Web Codecs component allows remote attackers to perform cross-origin data access, potentially reading or modifying content belonging to other origins within the browser. Rooted in CWE-346 (Origin Validation Error), the flaw affects all Firefox releases prior to 154 and all ESR releases prior to 153.1. No public exploit identified at time of analysis, and an EPSS score of 0.15% (5th percentile) signals low current exploitation probability despite the high CVSS base score of 8.1.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Integer overflow in Firefox's Graphics component crashes the browser for any user who loads attacker-controlled graphical content, resulting in a denial-of-service condition. All Firefox versions prior to 154 and all Firefox ESR versions prior to 153.1 are affected, covering effectively the entire unpatched Firefox install base globally. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the AV:N/AC:L/PR:N CVSS vector indicates a low-complexity, unauthenticated remote path, making this a high-priority patch target given Firefox's ubiquitous deployment footprint.
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation via the Application Update component in Mozilla Firefox allows a network-adjacent attacker, with user interaction, to gain elevated privileges with high impact to confidentiality, integrity, and availability. All Firefox versions prior to 154 are affected per Mozilla CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS score of 8.8 and the nature of the update mechanism - which on some platforms (e.g., Windows via the Mozilla Maintenance Service) operates with system-level privileges - make this a meaningful escalation risk.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Sandbox escape in the Remote Settings Client component of Mozilla Firefox lets attacker-controlled code break out of the isolated content process and reach the more privileged parent process, and was resolved in Firefox 154. The flaw is classed as a protection-mechanism failure (CWE-693) and carries a maximal CVSS 3.1 base score of 10.0 with a changed scope, reflecting cross-boundary impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a high-severity but not yet actively-exploited issue.
Memory-corruption defects in Mozilla Firefox and its ESR channels allow potential arbitrary code execution when a user renders attacker-controlled web content, per Mozilla advisories MFSA2026-74 through MFSA2026-80. The flaws were found internally by Mozilla across Firefox 153 and ESR 115.38/140.13/153.0, and Mozilla states some showed evidence of memory corruption that could plausibly be exploited. No public exploit identified at time of analysis; the issues are already fixed in Firefox 154, ESR 115.39, 140.14, and 153.1.
Memory corruption in Mozilla Firefox 153, Firefox ESR 153.0, and Firefox ESR 140.13 allows remote attackers to potentially execute arbitrary code within the browser process when a victim renders attacker-controlled web content. Mozilla internally discovered a batch of memory-safety defects (tracked across advisories MFSA2026-74 through MFSA2026-80) and states that some showed evidence of memory corruption presumed exploitable with sufficient effort. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Site isolation is broken in Firefox's WebExtensions component, allowing cross-origin access control boundaries to be violated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) places this as network-exploitable with high confidentiality and integrity impact, requiring only that a user visit an attacker-controlled page. Vendor-released patches are confirmed across all active Firefox release channels; no public exploit has been identified at time of analysis and EPSS at 0.16% (5th percentile) reflects low current exploitation probability.
Protection-mechanism bypass in the Storage: Cache API of Mozilla Firefox lets remote web content defeat a built-in security mitigation, exposing sensitive data and allowing unauthorized modification (CVSS 9.1, C:H/I:H). All Firefox builds prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. Reported by Mozilla with no public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile).
Safe Browsing mitigation bypass in Mozilla Firefox allows a remote unauthenticated attacker (with user interaction) to circumvent Firefox's phishing and malware URL-blocking protections, classified under CWE-693 (Protection Mechanism Failure). Affected versions span all Firefox releases prior to 154 and all ESR branches prior to 140.14 and 153.1, giving this a broad blast radius across consumer and enterprise deployments. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low observed exploitation activity despite the high CVSS score of 8.1.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Use-after-free memory corruption in Firefox's Canvas2D graphics component enables privilege escalation against any unpatched browser version. Remote unauthenticated attackers can achieve full confidentiality, integrity, and availability impact by delivering a malicious web page to a victim using Firefox prior to version 154 (stable) or the affected ESR releases. No public exploit identified at time of analysis, but the memory corruption class and low attack complexity make this a high-priority patch for both consumer and enterprise Firefox deployments.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Site isolation bypass in Firefox's Graphics: CanvasWebGL component allows a malicious web page to leak cross-origin data through the browser's graphics subsystem. All Firefox releases prior to version 154 are affected, along with ESR branches fixed in 115.39, 140.14, and 153.1. No public exploit code or active exploitation has been confirmed; EPSS places this in the 6th percentile, suggesting widespread automated exploitation is currently unlikely despite the High CVSS score.
Broken access control in Flowise's GET /api/v1/upsert-history API endpoint exposes the entire server-wide upsert history - exceeding 100MB per response - to any authenticated user, leaking sensitive infrastructure credentials including Qdrant server URLs, collection names, and vector pipeline configuration across all tenants and workspaces. The vulnerability is confirmed in flowise <= 3.1.2 and publicly documented in GHSA-fr6g-7cq8-fg82 with a working curl-based proof-of-concept, meaning any account holder on a multi-tenant deployment can harvest cross-tenant vector store configuration for reconnaissance or targeted follow-on attacks against exposed backends. Vendor-released patch flowise@3.1.3 is confirmed available and addresses missing workspace-scoping enforcement across multiple API controllers.
Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.
Server-side request forgery in PHPOffice PhpSpreadsheet (>= 4.0.0 through 5.8.0, plus older branches back to 2.0.0) lets an attacker bypass the WEBSERVICE() domain whitelist introduced in 5.4.0 by chaining through an HTTP 302/301 redirect. Because the whitelist only validates the initial URL host while file_get_contents() silently follows redirects without re-validation, an attacker who can upload a crafted XLSX to an app that calls setDomainWhiteList() and getCalculatedValue() can pivot to internal-only targets and read the full HTTP response (up to 32,767 bytes) as a cell value. Publicly available exploit code exists (a full PoC and lab reproduction are in the GitHub advisory); no public exploit identified as actively used in the wild and it is not in CISA KEV.
Buffer over-read when forwarding messages in Thunderbird allows remote attackers to crash the application by triggering an off-by-one error in MIME header parsing, with a possible but limited information leak of one byte. Affected versions are prior to 153 and 140.13; the user must have the non-default 'view all headers' option enabled while forwarding a specifically crafted email. At time of analysis, there is no evidence of active exploitation (not listed in CISA KEV) and EPSS indicates very low exploitation likelihood.
Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.
Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.
Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.
Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Denial of service in Mozilla Firefox before version 153 arises from an invalid pointer access (CWE-824) in the PSM (Personal Security Manager) security component, which brokers TLS/certificate and NSS cryptographic operations. Remote content processed by the browser can trigger the invalid pointer dereference, crashing the affected process; the assigned CVSS 3.1 vector scopes impact to availability only (A:H) with no confidentiality or integrity loss. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.13% (3rd percentile), consistent with a stability/crash bug rather than a code-execution primitive.
Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.
Access-control mitigation bypass in the DOM Service Workers component of Mozilla Firefox before version 153 allows remote content to circumvent a browser security mitigation, undermining protections intended to isolate web origins. Mozilla self-reported the flaw (MFSA2026-68/71) and shipped a fix in Firefox 153; there is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile). The NVD-assigned CVSS of 9.8 (full CIA impact, no user interaction) is notably higher than typical for a browser mitigation bypass, which warrants scrutiny.
Security mitigation bypass in the Networking component of Mozilla Firefox before version 153 lets remote attackers defeat a built-in protection mechanism, carrying high confidentiality and integrity impact per the CVSS 9.1 rating. The flaw was reported and fixed by Mozilla in Firefox 153 (advisory MFSA2026-68) and is classified under CWE-693 (Protection Mechanism Failure), with tags indicating an authentication/authorization bypass. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in Mozilla Firefox's Networking: WebSockets component allows remote attackers to read sensitive data across origin or trust boundaries without authentication or user interaction. The flaw affects Firefox releases prior to 153 and the ESR line prior to 140.13, and is corrected in those fixed builds. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the network-reachable, no-privilege CVSS 7.5 profile makes it a broad exposure across the very large Firefox install base.
UI/content spoofing in Mozilla Firefox for Android (fixed in version 153) lets a remote attacker who lures a user to attacker-controlled content misrepresent trusted interface elements, undermining the integrity of what the user believes they are viewing or interacting with. The flaw is classified as an authentication-bypass-by-spoofing weakness (CWE-290) and requires user interaction. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.13%, 3rd percentile).
Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.
Privilege escalation in Mozilla Firefox's Data Loss Prevention (DLP) component allows an attacker to gain elevated privileges beyond those intended for the affected process or policy context, with all confidentiality, integrity, and availability impacts rated high. Mozilla assigned a CVSS base score of 9.8, though the network/unauthenticated vector conflicts with the 'privilege escalation' framing typical of local flaws. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.13% exploitation probability (3rd percentile), indicating low near-term real-world weaponization despite the high CVSS.
Information disclosure in Mozilla Firefox's DOM: Security component allows remote attackers to read sensitive cross-origin or in-process data via crafted web content, undermining the browser's same-origin and security boundary enforcement. Any Firefox version prior to 153 is affected, and exploitation is remote and unauthenticated with no user interaction beyond visiting a malicious page. The issue was reported and fixed by Mozilla; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Cross-origin information disclosure in Mozilla Firefox's DOM: Navigation component allows a malicious web page to bypass site isolation (Fission) boundaries and read data belonging to another origin. The flaw affects Firefox versions prior to 153 and is remotely reachable over the network with no privileges required, though impact is limited to confidentiality. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.13%).
Information disclosure in Mozilla Firefox before version 153 stems from a site isolation weakness in the Graphics component, allowing a remote attacker to read cross-origin data that should be siloed between sites. The confidentiality-only flaw (CVSS 7.5, C:H) is network-reachable without authentication or user interaction, but carries no public exploit and a low EPSS score (0.13%, 3rd percentile), indicating theoretical rather than active risk. It is not listed in CISA KEV; no public exploit identified at time of analysis.
Privilege escalation in the WebExtensions subsystem of Mozilla Firefox lets a WebExtension gain capabilities beyond its granted permission set, corresponding to CWE-269 (Improper Privilege Management). Mozilla, the reporting vendor, fixed the issue in Firefox 153 and Firefox ESR 140.13 (advisories MFSA2026-68/70/71/72). No public exploit has been identified at time of analysis and the EPSS probability is low at 0.14% (4th percentile), despite the vendor-supplied 9.8 CVSS score.
Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Protection mechanism failure in the DOM: Security component of Mozilla Firefox lets remote attackers bypass a browser security mitigation, undermining defenses that isolate web content and enforce origin/policy boundaries. Mozilla rates this Critical (CVSS 9.1) with high confidentiality and integrity impact and no authentication or user interaction required per the assigned vector; it is corrected in Firefox 153 (MFSA 2026-68). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Memory corruption in the Audio/Video Gecko Media Plugin (GMP) component of Mozilla Firefox lets remote attackers trigger a buffer overflow through crafted media content, which per CVSS can disclose sensitive process memory and corrupt process state (C:H/I:H). The flaw affects Firefox before 153 and the ESR 115.x and 140.x branches; Mozilla shipped fixes in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the 9.1 CVSS reflects an unauthenticated, network-reachable memory-safety bug in a core browser subsystem.
Memory corruption in Mozilla Firefox's WebGPU graphics component (fixed in Firefox 153) lets a remote attacker serving crafted web content trigger an out-of-bounds memory operation, enabling sensitive memory disclosure and browser crashes. The flaw is a CWE-119 boundary-condition error rated CVSS 9.1 (C:H/A:H, no integrity impact), consistent with an information-leak-plus-denial-of-service primitive rather than confirmed code execution. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile), indicating no evidence of active exploitation despite the high base score.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Information disclosure in Mozilla Firefox's Storage: IndexedDB component allows a remote attacker to leak sensitive data across origins or from other browsing contexts without authentication or user interaction. The flaw affects Firefox releases prior to 153 and ESR builds prior to 140.13; there is no public exploit identified at time of analysis, and its EPSS score (0.15%, 5th percentile) indicates low near-term exploitation likelihood despite a CVSS of 7.5. Mozilla has released fixed builds, so the practical priority is prompt browser updating rather than emergency response.
Protection-mechanism bypass in Mozilla Firefox's Enterprise Policies component allows attackers to circumvent security restrictions that administrators enforce through managed policy, undermining controls an organization relies on to lock down the browser. Mozilla rates the flaw CVSS 9.1 (network vector, low complexity, no privileges or user interaction) affecting Firefox before 153 and Firefox ESR before 140.13. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile).
Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a malicious web page to read uninitialized process memory, potentially leaking sensitive data such as heap contents, pointers, or cross-origin material, before the fix in Firefox 153. The flaw stems from WebGPU operating on memory that was never initialized (CWE-908), and while CVSS rates confidentiality impact High (7.5), EPSS is very low (0.14%, 4th percentile) with no public exploit and no CISA KEV listing. Exploitation is browser-based, requiring a victim to load attacker-controlled WebGPU content.
Information disclosure in Mozilla Firefox's Graphics WebGPU component allows a remote attacker to read leftover uninitialized memory, potentially exposing sensitive data such as other pages' content, GPU buffers, or process memory. The flaw stems from a WebGPU code path returning memory that was never zeroed, and is fixed in Firefox 153; there is no public exploit identified at time of analysis and the EPSS score is low (0.14%, 4th percentile).
Information disclosure in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to read uninitialized memory contents via crafted WebGPU operations, potentially leaking sensitive process memory such as heap data, addresses, or other page content. The flaw is network-reachable without authentication or user interaction beyond visiting a malicious page, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS estimates a low 0.14% exploitation probability.
Security-mitigation bypass in Mozilla Firefox's DOM: Networking component undermines a built-in protection mechanism (CWE-693), potentially allowing crafted web content to defeat network-layer defenses in versions prior to Firefox 153 and ESR 140.13. The issue was reported and patched by Mozilla with no public exploit identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and it is not listed in CISA KEV. The NVD-assigned CVSS of 9.8 (network, no auth, no user interaction) sits in tension with the sparse 'mitigation bypass' description, which typically describes a defense-defeating enabler rather than direct code execution.
Protection-mechanism bypass in Mozilla Firefox's DOM Service Workers component allows remote web content to circumvent a browser security mitigation, weakening defenses that normally contain untrusted script. The flaw affects Firefox versions prior to 153 and was reported and patched by Mozilla (MFSA2026-68). No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at only 0.15% (5th percentile), indicating no observed weaponization despite the high nominal CVSS score.
Same-origin policy bypass in Mozilla Firefox's Networking DNS component allows remote attackers to circumvent origin isolation and read or manipulate data belonging to other web origins. Affects Firefox before 153 and Firefox ESR before 140.13, exploitable over the network without authentication or user interaction (CVSS 9.1). No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile).
Protection mechanism bypass in the Networking component of Mozilla Firefox (versions prior to 153) allows remote attackers to circumvent a built-in security mitigation over the network without authentication or user interaction, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Mozilla (MFSA2026-68) tags this as an authentication/mitigation bypass with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows an attacker who influences a sandboxed content process to break out of the renderer sandbox and gain elevated privileges on the host, affecting Firefox before 153 and Firefox ESR before 140.13. Mozilla assigns a critical CVSS of 9.8, though the 'content process' scope suggests the practical entry point is attacker-controlled web content rather than a fully unauthenticated network service. No public exploit is identified at time of analysis, and the EPSS exploitation probability is very low (0.15%, 5th percentile).
Information disclosure in Mozilla Firefox before version 153 stems from an input-validation flaw in the DOM Copy & Paste and Drag & Drop component, allowing remote content to potentially read data that should remain isolated. The provided CVSS vector rates confidentiality impact as High with no privileges or user interaction, and Mozilla has shipped a fix in Firefox 153. There is no public exploit identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates low near-term exploitation likelihood.
Mitigation bypass in the Mozilla Firefox PDF Viewer component undermines a built-in security control (CWE-693 Protection Mechanism Failure), weakening a defense-in-depth barrier that would otherwise contain malicious PDF content. Mozilla self-reported the issue and shipped fixes in Firefox 153 and Firefox ESR 140.13 via advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and EPSS is very low (0.16%, 6th percentile), so the headline CVSS 9.8 reflects worst-case potential rather than demonstrated mass exploitation.
Remote denial-of-service in Mozilla Firefox's Graphics: WebGPU component allows a malicious web page to exhaust browser resources and crash or hang the browser without any user credentials or interaction. The flaw affects Firefox versions prior to 153 and is triggered simply by loading attacker-controlled content that abuses the WebGPU API. There is no public exploit identified at time of analysis, and EPSS scores the exploitation likelihood at only 0.14%, indicating low near-term probability of widespread exploitation.
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Information disclosure in the Firefox DevTools Framework component allows an attacker to read data that should remain isolated, affecting Mozilla Firefox prior to 153 and Firefox ESR prior to 140.13. Reported by Mozilla and carrying a CVSS 7.5 (high) rating driven by high confidentiality impact, there is no public exploit identified at time of analysis and the EPSS probability is low at 0.15% (5th percentile). The issue is fixed and not listed in CISA KEV.
Information disclosure in the Privacy component of Mozilla Firefox for Android allows remote attackers to expose sensitive user data, with the flaw carrying a high confidentiality impact (CVSS 7.5). Mozilla self-reported and fixed the issue in Firefox 153 per advisory MFSA2026-68; there is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile). The Privacy component context suggests leakage of protected browsing state or user data that the browser is designed to isolate.
Privilege escalation in Mozilla Firefox's DOM Content Processes component allows attackers to escape or elevate beyond the sandboxed content process, gaining higher browser privileges on affected versions prior to Firefox 153. The flaw is a CWE-269 improper privilege management issue reported by Mozilla and patched in Firefox 153 (advisory MFSA2026-68). No public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no observed exploitation activity at time of analysis despite the high CVSS 9.8 rating.
Privilege escalation in Mozilla Firefox's DOM Navigation component allows remote attackers to elevate privileges, and given the CVSS network vector (AV:N/PR:N/UI:N) an attacker could compromise confidentiality, integrity, and availability without authentication or user interaction. The flaw affects Firefox before version 153 and Firefox ESR before 140.13, and was fixed by Mozilla in those releases. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.15%, 5th percentile).
Protection-mechanism bypass in the DOM: Networking component of Mozilla Firefox lets a remote, unauthenticated attacker circumvent a browser security mitigation, exposing confidential data and enabling integrity compromise (CVSS 9.1) without user interaction. Reported by Mozilla and fixed in Firefox 153, the flaw affects users browsing to attacker-controlled web content. No public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation is not yet widespread.