Mozilla
Monthly
Memory corruption in the Graphics component of Mozilla Firefox stems from incorrect boundary conditions (a buffer overflow) that can be triggered when the browser processes maliciously crafted graphics content, potentially leading to arbitrary code execution in the content process. It affects Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13, and is fixed across those releases per Mozilla advisories MFSA2026-68/69/70. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile) despite the vendor-supplied CVSS of 9.8.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).
Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.
Sandbox escape in Mozilla Firefox before version 153 stems from an invalid pointer (CWE-119 memory-safety error) in the Disability Access (accessibility) APIs component, letting an attacker who can execute code in a constrained content process break out of the browser sandbox and reach the more privileged parent process with full confidentiality, integrity, and availability impact (CVSS 10.0, scope-changed). No public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), indicating no evidence of widespread exploitation despite the maximum CVSS score.
Information disclosure in Mozilla Firefox's ImageLib graphics component allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) when a victim renders attacker-controlled image content, per the CWE-200 classification and the C:H CVSS impact. Affected builds are Firefox before 153 and the ESR 115.x and 140.x branches, all fixed by Mozilla in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), consistent with a vendor-reported browser memory-disclosure issue rather than one under active exploitation.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Privilege escalation in Mozilla Firefox's DOM Navigation component (fixed in Firefox 153) allows an attacker to improperly gain elevated privileges within the browser, per Mozilla advisory MFSA2026-68. The flaw carries a CVSS 9.8 rating claiming full confidentiality, integrity, and availability impact with no privileges or user interaction, though this is atypical for a browser DOM bug. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Privilege escalation in Mozilla Firefox's DOM: Workers component lets remote attackers gain elevated privileges within the browser through web-facing content, potentially enabling sandbox/privilege boundary compromise. The flaw was resolved in Firefox 153 and is described in Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no evidence of active or imminent widespread exploitation.
Memory-corruption in Mozilla Firefox's Audio/Video Playback component allows a remote attacker to achieve confidentiality and integrity compromise (potentially arbitrary code execution) by delivering crafted media content to a victim's browser. Rooted in incorrect boundary conditions (buffer overflow, CWE-119), the flaw affects Firefox versions prior to 153 and carries a CVSS 9.1 rating, though EPSS exploitation probability is low (0.14%, 4th percentile) and no public exploit identified at time of analysis.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Memory corruption in the cubeb audio/video library used by Mozilla Firefox arises from incorrect boundary conditions (CWE-119), and Mozilla fixed it in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13 (advisories MFSA2026-68/69/70). The input CVSS rates it 9.8 (network, no privileges, no user interaction), implying an unauthenticated remote attacker could corrupt memory in the browser and potentially achieve code execution, though as a media-processing flaw real exploitation almost certainly requires a victim to render attacker-controlled audio/video content. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), and it is not in CISA KEV.
Same-origin policy bypass in Mozilla Firefox's DOM: Navigation component allows a malicious web page to read or manipulate content belonging to another origin, defeating the browser's core cross-origin isolation boundary. All Firefox users on affected pre-153 releases and unpatched ESR branches are exposed, and while Mozilla's vector maps to CVSS 9.8, EPSS estimates only a 0.16% exploitation probability (6th percentile). There is no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated remote code execution in Joro ≤ v1.1.0 (BishopFox's offensive-security tooling) allows an attacker to gain a shell as the operator's user when that operator merely visits a malicious web page. In the default proxy mode, Joro exposes an unauthenticated local API on 127.0.0.1:9090 with a wildcard CORS policy; because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript can upload a native Go plugin and trigger a restart through the operator's browser with no preflight or credentials, and the plugin's init() executes on load. No public exploit is identified at time of analysis, but the advisory documents a complete, reproducible attack chain, and the assigned CVSS is 9.6 (Critical).
Stored cross-site scripting in the lxml_html_clean Cleaner (≤ 0.4.4) and the bundled lxml legacy html.clean module (≤ 6.1.0) lets attackers smuggle javascript: URLs through HTML sanitization on the namespaced xlink:href attribute. When callers configure Cleaner with safe_attrs_only=False, the URL-scheme scrubber never inspects <a xlink:href="javascript:..."> inside SVG or MathML, so the payload survives and executes when a victim clicks the rendered anchor. Publicly available exploit code exists (a working reproducer ships with the advisory), but there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Path traversal in Goploy's `/deploy/fileDiff` endpoint (versions <=1.17.5) enables any authenticated low-privilege member to read arbitrary files on both the Goploy host and every SFTP-managed remote server registered in the system. The dual file read returns local content in the `srcText` response field and remote server content in `distText`, multiplying the blast radius across all managed deployment targets. Publicly available exploit code exists per the GitHub Security Advisory; this is not listed in CISA KEV, but exploitation conditions are trivially met under default Goploy configuration.
Memory-corruption weaknesses in Mozilla Firefox 152.0.3 could allow remote attackers to potentially execute arbitrary code within the browser process. Mozilla graded the collected memory-safety bugs as critical (MFSA2026-62) and states some showed evidence of memory corruption that, with sufficient effort, could be exploited for code execution; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). The issue is resolved in Firefox 152.0.4.
Unauthenticated denial-of-service in Langflow versions prior to 1.0.19 allows remote attackers to render the application unusable for all users indefinitely by sending a single crafted POST to /api/v1/files/upload/ with a malformed multipart boundary containing a very large run of hyphens. The upload endpoint processes the multipart body before performing authentication or flow-ID validation, so no token, cookie, or valid flow UUID is required. A public proof-of-concept is included in the GitHub Security Advisory GHSA-qwqc-p3q8-wcg9, though there is no public exploit identified beyond the PoC at time of analysis and the issue is not listed in CISA KEV.
TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.
Unauthenticated remote command execution in rclone's remote control daemon (rcd) affects versions 1.55.0 through 1.74.2 when started with `--rc-serve` and without HTTP authentication. A single GET or HEAD request to `/[remote:path]/object` triggers backend initialization with attacker-controlled inline remote options, executing commands as the rclone process user. No public exploit identified at time of analysis, though the GHSA advisory describes the technique in detail and notes the issue bypasses the earlier CVE-2026-41179 fix.
Memory corruption vulnerabilities in Mozilla Firefox 151, Firefox ESR 115.36/140.11, and Thunderbird 151/ESR 140.11 allow remote attackers to potentially execute arbitrary code by serving crafted web content that triggers internal memory safety bugs. Mozilla developers observed evidence of memory corruption in several of these bugs and assess that sufficient effort could yield arbitrary code execution in the browser process. No public exploit identified at time of analysis, and SSVC reports no observed exploitation, but the high CVSS (8.1) and total technical impact warrant prompt patching.
Memory-corruption flaws in Mozilla Firefox 151, Firefox ESR 140.11, Thunderbird 151 and Thunderbird ESR 140.11 allow remote attackers to potentially execute arbitrary code by having a victim load maliciously crafted web content. Mozilla's engineers reported evidence of memory corruption in several bundled bugs and presume that, with sufficient effort, at least some could be leveraged for code execution. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%), and the issue is not on CISA KEV; a fix is available in Firefox 152 and Firefox ESR 140.12.
Memory corruption in Mozilla Firefox 151 and Thunderbird 151 may allow remote attackers to achieve arbitrary code execution when a victim renders malicious web content, per Mozilla advisory MFSA2026-60. The flaw stems from multiple memory safety bugs that Mozilla assessed as potentially exploitable, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.22%, 13th percentile). It is fixed in Firefox 152, with no special privileges required but high attack complexity per the CVSS vector.
Memory safety flaw in the CanvasWebGL graphics component of Mozilla Firefox allows remote attackers to trigger incorrect boundary handling through crafted web content, leading to limited confidentiality, integrity, and availability impact. The issue affects Firefox prior to version 152 and Firefox ESR prior to 140.12, and no public exploit identified at time of analysis. Reported by Mozilla with low complexity and no authentication required (CVSS 7.3).
Memory corruption in the NSS (Network Security Services) Libraries component shipped with Mozilla Firefox allows remote attackers to trigger out-of-bounds memory access via incorrect boundary condition handling, with low impact across confidentiality, integrity, and availability. Mozilla addressed the issue in Firefox 152, with associated advisories MFSA2026-57 and MFSA2026-60. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Memory corruption in Mozilla Firefox versions prior to 152 allows remote unauthenticated attackers to crash the browser by serving crafted web content, resulting in denial of service. The CVSS 3.1 base score of 7.5 reflects high availability impact without confidentiality or integrity loss, and no public exploit identified at time of analysis. Mozilla disclosed the issue via advisories MFSA2026-57 and MFSA2026-60 with a fix shipped in Firefox 152.
Security mitigation bypass in the DOM: Security component of Mozilla Firefox prior to version 152 allows remote attackers to compromise confidentiality and integrity of browser-rendered content without user interaction. The flaw carries a critical CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N) and is tagged as an Authentication Bypass class issue, though no public exploit identified at time of analysis. The vulnerability has been patched by Mozilla in Firefox 152 per MFSA2026-57/MFSA2026-60.
Security mitigation bypass in the DOM: Security component of Mozilla Firefox allows remote attackers to circumvent browser security controls, with high impact to confidentiality and integrity. The flaw affects Firefox versions prior to 152 and Firefox ESR prior to 140.12, with no public exploit identified at time of analysis. Given the CVSS 9.1 rating and network-reachable attack vector, any user browsing a malicious page is potentially exposed.
Memory corruption in Mozilla Firefox prior to version 152 and Firefox ESR prior to 140.12 allows remote attackers to compromise browser memory integrity through crafted web content, with confidentiality impact rated High per the CVSS vector. The flaw stems from a buffer-handling defect (CWE-119) reported by Mozilla itself and addressed across multiple security advisories (MFSA2026-57, -58, -60, -61). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in Mozilla Firefox before version 152 (and Firefox ESR before 140.12) stems from a memory-safety flaw that a remote attacker can trigger without authentication or user interaction to read out-of-bounds memory (CVSS 7.5, C:H only). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with low EPSS (0.27%), so this is a browser-engine memory bug patched proactively by Mozilla rather than an actively exploited threat.
Memory-corruption in Mozilla Firefox before version 152 (and Firefox ESR before 140.12) allows a remote, unauthenticated attacker to trigger a memory safety bug via a malicious web page; the CVSS vector's confidentiality-only impact indicates likely out-of-bounds memory disclosure rather than full code execution. The flaw was reported and patched by Mozilla in advisories MFSA2026-57/58/60/61 and is fixed in Firefox 152 / ESR 140.12. There is no public exploit identified at time of analysis, EPSS is low (0.27%, 18th percentile), and CISA SSVC lists exploitation as 'none', though the bug is assessed as automatable.
Denial of service in Mozilla Firefox prior to version 152 and Firefox ESR prior to 140.12 stems from a memory safety bug (CWE-119) that remote attackers can trigger via crafted web content. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, consistent with a browser crash rather than reliable code execution. No public exploit identified at time of analysis, and Mozilla has shipped fixes across multiple advisories (MFSA2026-57, -58, -60, -61).
Same-origin policy bypass in Mozilla Firefox's Networking: Cookies component allows remote attackers to circumvent origin isolation and access or manipulate cross-origin cookie data without authentication or user interaction. The flaw (CWE-346 Origin Validation Error) is rated CVSS 9.1 and was reported and fixed by Mozilla in Firefox 152 and Firefox ESR 140.12; no public exploit identified at time of analysis, and EPSS probability is low at 0.19%.
Sandbox escape in Mozilla Firefox and Firefox ESR allows a remote attacker to break out of the browser's content sandbox by exploiting incorrect boundary conditions in the Networking component, leading to full compromise of confidentiality, integrity, and availability on the host. Exploitation requires user interaction (e.g., visiting a malicious page), but with CVSS 9.6 and a scope change, successful exploitation crosses the renderer/host trust boundary. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with the SSVC 'Exploitation: none' signal.
Sandbox escape in Mozilla Firefox's Process Sandboxing security component allows a remote attacker to break out of the content process isolation boundary, escalating from a compromised renderer to broader system access after a user visits a malicious page. Affects Firefox before version 152 and Firefox ESR before 140.12; the CVSS 3.1 base score is 9.6 (scope-changed, high impact across confidentiality, integrity, and availability). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Sandbox escape in Mozilla Firefox's DOM: Navigation component allows a remote attacker to break out of the content-process sandbox when a victim visits a malicious web page, gaining code execution and full data access at the browser-host boundary. The flaw affects Firefox before 152 and the ESR 140.x and 115.x branches and carries a critical 9.6 CVSS with a changed scope. There is no public exploit identified at time of analysis, and EPSS (0.16%, 5th percentile) plus SSVC 'Exploitation: none' indicate no observed exploitation yet.
Sandbox escape in Mozilla Firefox's DOM Workers component allows remote attackers to break out of the browser's content process sandbox when a user visits a malicious web page. The flaw affects Firefox prior to 152, Firefox ESR before 140.12, and Firefox ESR before 115.37, with no public exploit identified at time of analysis despite a critical 9.6 CVSS score. EPSS exploitation probability is low at 0.16% and CISA SSVC marks exploitation as 'none', suggesting no in-the-wild abuse has been observed yet.
Memory corruption in Mozilla Firefox's Graphics: WebGPU component (fixed in Firefox 152) allows an attacker who lures a victim to a malicious page to trigger a use-after-free (CWE-416), potentially leading to information disclosure or arbitrary code execution in the content process. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, though CISA's SSVC framework rates its technical impact as total and marks it automatable. EPSS is low at 0.15% (5th percentile), consistent with no observed in-the-wild exploitation.
Memory corruption in the Web Audio component of Mozilla Firefox allows a remote attacker to compromise confidentiality and integrity when a victim visits attacker-controlled web content. Incorrect boundary conditions (CWE-119) can be triggered through crafted audio processing, and the CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated network delivery that still requires the user to load a malicious page. No public exploit is identified at time of analysis, EPSS is low (0.15%, 5th percentile), and SSVC records exploitation status as none, though its technical impact is rated total.
Memory corruption via use-after-free in the Networking: HTTP component of Mozilla Firefox enables remote attackers to potentially execute arbitrary code or trigger crashes when a user visits a malicious page. The flaw affects Firefox prior to version 152, Firefox ESR before 140.12, and Firefox ESR before 115.37, and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability. With an EPSS of 0.16% (5th percentile) and no public exploit identified at time of analysis, opportunistic mass exploitation appears unlikely despite the high severity rating.
Memory corruption in Mozilla Firefox prior to version 152 allows remote attackers to compromise confidentiality and integrity via a crafted web page that triggers a buffer-related memory safety flaw. The issue also affects Firefox ESR before 140.12 and 115.37 and requires user interaction (e.g., visiting a malicious site). No public exploit identified at time of analysis and EPSS is low (0.16%), but SSVC rates technical impact as total.
Privilege escalation in the WebRender graphics component of Mozilla Firefox enables remote attackers to elevate privileges within the browser sandbox when a victim loads malicious web content. Mozilla has patched the issue in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, and no public exploit has been identified at time of analysis.
Cross-origin credential disclosure in Avira Password Manager's Firefox extension allows a malicious site embedding the targeted page in an iframe to harvest credentials that the extension autofills into the parent context. The flaw stems from incorrect autofill field selection and affects Windows, macOS, and Linux installations; no public exploit identified at time of analysis but the CVSS 7.4 (S:C/C:H) score reflects the cross-origin trust boundary violation.
Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior to 26.8.1) allows a remote attacker to abuse an authenticated user's browser session by luring them to a malicious page. Per CyberArk bulletin CA26-21, the extension's internal web-page verification routine fails to correctly enforce origin checks (CWE-346), enabling unauthorized application interaction in the victim's identity context. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high confidentiality impact and subsequent-system impact via the identity SaaS the extension brokers.
Universal cross-site scripting (UXSS) in Mozilla Focus and Klar for iOS allows remote attackers to inject script into the context of arbitrary web origins by abusing WebKit navigation handling in the browser. The flaw, reported by Mozilla and tracked as EUVD-2026-35837, was corrected in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 7.5 reflects the high confidentiality impact achievable with no privileges.
Information disclosure in Mozilla Firefox prior to 151.0.3 allows remote attackers to read out-of-bounds memory via the Graphics: Text component when processing crafted content. The flaw stems from incorrect boundary conditions (CWE-119) in text rendering and can be triggered without user authentication, though no public exploit has been identified and EPSS scores it at just 0.02% likelihood of exploitation.
Cross-site scripting via sanitizer bypass affects DOMPurify 3.4.4, the widely used npm HTML sanitization library maintained by cure53. The flaw stems from `<selectedcontent>` being permitted by default, allowing attackers to leverage browser re-cloning behavior so that an XSS payload is reinjected into a subtree DOMPurify has already walked. No public exploit identified at time of analysis in the form of in-the-wild attacks, but a fully working PoC is published in the GHSA advisory and active exploitation status is not listed in CISA KEV.
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config permission inject arbitrary SQL through the custom-report column-config endpoint, which concatenates user-supplied 'sql', 'from', and 'where' fields directly into a query executed via Doctrine's fetchAssociative(). Because the controller returns raw database error messages in its JSON response, attackers can perform error-based extraction (e.g. EXTRACTVALUE) to read credentials and arbitrary tables, and can bypass the keyword denylist using inline /**/ comments to reach UPDATE/INSERT/DELETE - compromising confidentiality and integrity. Publicly available exploit code exists (a full PoC is published in the GitHub advisory); no CISA KEV listing or EPSS score is present in the provided data.
Memory corruption in Mozilla Firefox 150 and Firefox ESR (115.35, 140.10) allows remote attackers to potentially execute arbitrary code when a user visits a crafted web page. The flaws stem from memory safety bugs reported by Mozilla developers, some showing evidence of exploitable memory corruption. No public exploit identified at time of analysis, and EPSS scoring (0.06%) suggests low near-term exploitation likelihood despite the high CVSS rating.
Memory corruption in Mozilla Firefox 150 and Firefox ESR 140.10 allows remote attackers to potentially execute arbitrary code when a victim visits a crafted web page. The flaw stems from multiple memory safety bugs reported by Mozilla developers, with some showing evidence of exploitable memory corruption; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.05%, 14th percentile). Mozilla has shipped fixes in Firefox 151 and Firefox ESR 140.11.
Memory corruption vulnerabilities in Mozilla Firefox 150 could enable remote code execution when a user visits a maliciously crafted web page, with Mozilla acknowledging that some of the bugs showed evidence of memory corruption potentially exploitable for arbitrary code execution. The issue is resolved in Firefox 151 per Mozilla advisory MFSA2026-46/MFSA2026-50. No public exploit identified at time of analysis and EPSS remains low (0.04%), but SSVC rates technical impact as total and automatable.
Privilege escalation in Mozilla Firefox's WebRTC Audio/Video component allows remote attackers to elevate privileges within the browser context when a user is lured into interacting with a malicious page. The flaw carries a CVSS 8.8 with required user interaction and was addressed in Firefox 151; no public exploit identified at time of analysis and EPSS exploitation probability sits at 0.03% (8th percentile).
Privilege escalation in Mozilla Firefox's Security component allows remote attackers to elevate privileges within the browser when a victim interacts with attacker-controlled content, affecting Firefox versions prior to 151 and Firefox ESR prior to 140.11. With CVSS 8.8 (high) and user interaction required, exploitation is plausible via malicious web content, though EPSS sits at just 0.04% (12th percentile) and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' but flags the issue as automatable with partial technical impact, suggesting concerning scalability if a working exploit emerges.
Protection-mechanism bypass in the DOM: Security component of Mozilla Firefox before version 151 lets a remote attacker circumvent a built-in security mitigation via a malicious web page, undermining a control designed to enforce web security boundaries. Exploitation requires the victim to interact with attacker-controlled content, and the flaw carries high confidentiality and integrity impact. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low (0.04%).
Denial-of-service in Mozilla Firefox's Web Codecs (Audio/Video) component allows a remote attacker to crash the browser via an invalid pointer, triggered by loading crafted media content with no authentication or user interaction. The flaw is fixed in Firefox 151 and Firefox ESR 140.11; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), consistent with SSVC rating exploitation as none.
Information disclosure in Mozilla Firefox's WebGPU graphics component allows remote attackers to access sensitive in-memory data from browser sessions via crafted web content rendered through the WebGPU API. The flaw affects Firefox versions prior to 151 and has been addressed by Mozilla in advisories MFSA2026-46 and MFSA2026-50. There is no public exploit identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low likelihood of near-term mass exploitation.
Information disclosure in Mozilla Firefox versions prior to 151 affects the IP Protection component, allowing remote unauthenticated attackers to obtain sensitive information over the network without user interaction. The flaw carries a CVSS score of 7.5 driven entirely by confidentiality impact (C:H/I:N/A:N), and while no public exploit is identified at time of analysis, the very low EPSS score of 0.02% (4th percentile) suggests minimal active exploitation interest. Mozilla addressed the issue in Firefox 151 via security advisories MFSA2026-46 and MFSA2026-50.
Information disclosure in Mozilla Firefox prior to version 151 allows remote attackers to leak sensitive data through a flaw in the DOM: Security component, exploitable without authentication or user interaction. The CVSS 7.5 rating reflects high confidentiality impact via network vector, though EPSS scoring at 0.02% (4th percentile) indicates very low predicted exploitation probability and no public exploit identified at time of analysis.
Content spoofing in Mozilla Firefox (versions prior to 151) lets a remote web page abuse the Popup Blocker component to misrepresent UI or origin information to the user, classified under CWE-451 (UI misrepresentation of critical information). No authentication is required (PR:N) and Mozilla has shipped a fix in Firefox 151. There is no public exploit identified at time of analysis, exploitation is rated 'none' by CISA SSVC, and EPSS is negligible at 0.02% (7th percentile).
Spoofing in the Firefox Web Speech component allows remote attackers to misrepresent content to users, undermining integrity of speech-driven interactions (CWE-290, spoofing/authentication-bypass class). It affects Firefox versions prior to 151 and is fixed in Firefox 151; no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Mitigation bypass in Mozilla Firefox's DOM: Security component allows remote attackers to circumvent built-in browser security protections when a user visits a maliciously crafted web page. The flaw affects Firefox versions prior to 151 and Firefox ESR prior to 140.11, with CVSS 8.1 reflecting high confidentiality and integrity impact contingent on user interaction. EPSS scoring is very low (0.02%, 5th percentile) and no public exploit identified at time of analysis, but the CWE-693 protection-mechanism-failure classification means defensive layers users rely on may not function as intended.
Spoofing in Mozilla Firefox WebExtensions (versions prior to 151) allows remote attackers to misrepresent extension-controlled content or UI, undermining the integrity of what a user believes they are seeing or interacting with. The CVSS 3.1 vector (7.5) reflects a high integrity impact with no confidentiality or availability loss, and Mozilla has shipped a fix in Firefox 151. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records no known exploitation.
Sandbox escape in Mozilla Firefox's Windows-specific Widget: Win32 component lets a content-process compromise break out of the browser sandbox onto the host due to incorrect boundary conditions (CWE-693, protection mechanism failure). All Firefox versions prior to 151 and ESR versions before 140.11 on Windows are affected, and a scope-changing chain can yield full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA's SSVC framework rates exploitation as none, indicating this is a high-severity but not yet actively exploited issue.
Sandbox escape and information disclosure in Mozilla Firefox's Process Sandboxing component allows a malicious web page to leak data across the security boundary that isolates content processes from the rest of the browser and host. All Firefox versions prior to 151 and ESR versions prior to 140.11 are affected. The scope-changed CVSS 3.1 score of 8.6 reflects that a successful attack crosses the sandbox boundary, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Privilege escalation in the Enterprise Policies component of Mozilla Firefox affects versions prior to Firefox 151 and Firefox ESR 140.11, allowing remote attackers who can convince a user to interact with crafted content to elevate privileges within the browser. No public exploit identified at time of analysis, and EPSS scoring places exploitation probability at just 0.03% (9th percentile). The vulnerability requires user interaction per the CVSS vector, which somewhat constrains real-world weaponization despite the high 8.8 CVSS score.
Memory corruption in Mozilla Firefox's Networking: JAR component (the handler for jar: URLs and JAR-packaged resources) arises from an integer overflow that can drive out-of-bounds heap access and potential remote code execution. All Firefox builds before Firefox 151 and Firefox ESR 140.11 are affected; the flaw was reported and fixed by Mozilla. No public exploit is identified at time of analysis and EPSS probability is very low (0.05%, 14th percentile), yet SSVC rates technical impact as total and the technique as automatable.
Privilege escalation in Mozilla Firefox's DOM Workers component allows remote attackers to elevate privileges within the browser when a victim interacts with a malicious web page. Affects Firefox versions prior to 151 and Firefox ESR prior to 140.11, with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS rates exploitation probability at only 0.03% (9th percentile).
Memory-safety corruption in the Audio/Video component of Mozilla Firefox stems from incorrect boundary conditions combined with an integer overflow, and is fixed in Firefox 151 and Firefox ESR 140.11. Remote attackers can trigger the flaw by serving crafted media to an affected browser, with NVD scoring a high confidentiality impact (CVSS 7.5, C:H/I:N/A:N); there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 10th percentile). CISA's SSVC framework marks exploitation status as none but flags the issue as automatable with partial technical impact.
Sandbox escape in Mozilla Firefox via a use-after-free (CWE-416) in the Disability Access (accessibility) APIs lets a remote attacker who lures a user to malicious web content break out of the content sandbox and gain total control over confidentiality, integrity, and availability. The flaw affects Firefox before 151, Firefox ESR before 115.36, and Firefox ESR before 140.11, and is fixed in those releases. No public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.6 rating and scope-changing sandbox escape make it a high-severity patch priority.
Privilege escalation in Mozilla Firefox via the Application Update component allows remote attackers to gain elevated privileges when a user interacts with malicious content, fixed in Firefox 151. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and is categorized under CWE-269 (Improper Privilege Management). There is no public exploit identified at time of analysis, and EPSS estimates only a 0.03% probability of exploitation in the next 30 days.
Same-origin policy bypass in Mozilla Firefox's Networking: HTTP component allows a malicious web page to read or interact with data belonging to another origin once a victim is lured into visiting it, defeating the browser's core cross-origin isolation boundary. It affects Firefox before 151 and Firefox ESR before 140.11 and carries a CVSS 9.3 rating driven by a scope change and high confidentiality impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is only 0.02% (4th percentile). Reported internally by Mozilla and shipped with a vendor patch, this is a browser-side flaw requiring user interaction rather than a server-side or unauthenticated-automation risk.
Denial of service in Mozilla Firefox (fixed in Firefox 151 and Firefox ESR 140.11) arises from an integer overflow (CWE-190) in the Windows-specific 'Widget: Win32' component, allowing remote attackers to crash the browser or corrupt memory state via crafted web content. The CVSS 3.1 vector scores availability-only impact (C:N/I:N/A:H), indicating a reliability/crash issue rather than confirmed code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 14th percentile).
Same-origin policy bypass in Mozilla Firefox's DOM: Networking component allows a malicious web page to read cross-origin responses that should be blocked, defeating a core browser isolation boundary. Rated CVSS 9.1 with high confidentiality and integrity impact, the flaw was fixed in Firefox 151 (MFSA2026-46/MFSA2026-50). There is no public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and CISA SSVC lists exploitation status as none, but the issue is assessed as automatable with total technical impact.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker to trigger a use-after-free (CWE-416) by serving crafted web content, potentially leading to information disclosure or memory-corruption-based control-flow effects. The flaw affects Firefox before 151 and the ESR 115.x and 140.x branches, and is patched in Firefox 151, ESR 115.36, and ESR 140.11. No public exploit identified at time of analysis; EPSS probability is very low (0.05%) and CISA SSVC records no known exploitation.
Out-of-bounds memory access in the Firefox Web Codecs (Audio/Video) component allows a remote attacker to disclose sensitive process memory by serving a specially crafted media stream to a victim's browser. Rated CVSS 7.5 with a confidentiality-only impact (C:H/I:N/A:N), it affects Firefox before 151 and the ESR 115.x and 140.x branches; a vendor patch is available and it carries no public exploit and a negligible EPSS score (0.04%), with CISA SSVC recording no observed exploitation.
Sandbox escape in Mozilla Firefox and Firefox Focus for Android lets a malicious web page break out of the content-process sandbox after luring a victim to attacker-controlled content, gaining full confidentiality, integrity, and availability impact on the affected process. Mozilla addressed it in Firefox 151 (advisory MFSA2026-46); there is no public exploit identified at time of analysis, and EPSS rates near-term exploitation at just 0.05% (16th percentile). CISA SSVC records exploitation status as none with a total technical impact, indicating a serious-but-not-yet-exploited browser flaw.
Session persistence after credential change in SillyTavern before 1.18.0 lets an attacker holding a stolen session cookie retain full account access even after the victim resets their password. Because sessions are stateless and stored entirely in a signed client-side cookie with a default 400-day lifespan, the change-password and account-recovery endpoints update the password hash but never revoke outstanding tokens, defeating the standard remediation for cookie theft. No active exploitation is recorded (not in CISA KEV) and EPSS is very low at 0.02%, but public proof-of-concept reproduction steps are documented in the GHSA advisory.
Sandbox escape in Mozilla Firefox's Profile Backup component allows an attacker to break out of the browser's content-process isolation and gain broader access to the host, affecting versions prior to 150.0.3. There is no public exploit identified at time of analysis and EPSS estimates only a 0.02% exploitation probability, but SSVC rates the technical impact as total and the flaw automatable, so it warrants prompt patching. Not listed in CISA KEV.
Memory corruption in Mozilla Firefox's WebAssembly JavaScript engine component allows remote attackers to trigger a use-after-free condition via crafted web content, with limited impact across confidentiality, integrity, and availability. The flaw affects Firefox versions prior to 150.0.3 and has no public exploit identified at time of analysis, though SSVC indicates the issue is automatable. EPSS scoring (0.02%, 5th percentile) suggests very low near-term exploitation probability despite the network-reachable attack vector.
Memory corruption in Mozilla Firefox versions prior to 150.0.3 stems from a JIT (Just-In-Time) compiler miscompilation in the JavaScript engine, allowing remote attackers to trigger high-impact compromise of confidentiality, integrity, and availability when a user visits a malicious web page. The flaw carries a CVSS score of 8.8 and requires user interaction (loading attacker-controlled JavaScript), but no authentication. There is no public exploit identified at time of analysis, though a GitHub repository referenced from NVD suggests early proof-of-concept research, and EPSS scores the exploitation probability at only 0.02% despite the high CVSS severity.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Cross-origin WebSocket hijacking in the Cline `kanban` server (npm `kanban`, shipped via the `cline` CLI ≤ 2.13.0) lets any website a developer visits silently connect to the loopback server on 127.0.0.1:3484 and leak workspace paths, task content, git branches, and AI-agent chat, then inject prompts into a running agent's terminal for remote code execution and kill active tasks. Because browsers do not apply CORS to WebSocket handshakes and the three endpoints perform no Origin validation or authentication (CWE-306), exploitation needs only that the victim run kanban and browse to an attacker page. A full interactive proof-of-concept exists (publicly available exploit code exists); it is not listed in CISA KEV and EPSS is very low at 0.02%, indicating no observed mass exploitation to date.
Remote code execution in ai-scanner versions 1.0.0 through 1.4.0 allows authenticated attackers to inject and execute arbitrary JavaScript code via the BrowserAutomation::PlaywrightService component. The vulnerability has a Critical CVSS score of 9.9 with scope change, enabling cross-boundary compromise of confidentiality, integrity, and availability. Vendor-released patch available in version 1.4.1 as of April 13, 2026, with GitHub Security Advisory GHSA-r27j-xxgx-f5vr confirming the fix.
Remote code execution in Firefox ESR's WebRTC component allows unauthenticated network attackers to achieve arbitrary code execution with complete system compromise. The vulnerability affects Firefox ESR versions prior to 140.10.2 and carries a critical CVSS score of 9.8 with network attack vector requiring no authentication or user interaction. Despite the critical severity, EPSS probability remains exceptionally low at 0.01% (0th percentile) with no evidence of active exploitation, suggesting limited awareness or exploitation complexity despite the automatable nature assessed by CISA SSVC framework.
Multiple memory corruption vulnerabilities in Firefox 150.0.1 enable potential remote code execution through memory safety flaws in the browser engine. Mozilla's advisory references 10 distinct bugs demonstrating memory corruption, which with sufficient exploitation effort could allow arbitrary code execution. Firefox 150.0.2 addresses these vulnerabilities. CVSS rates this 7.5 High (network-exploitable, no authentication required), though the vector indicates only availability impact, contradicting the RCE assessment in Mozilla's advisory. SSVC framework confirms no active exploitation and partial technical impact.
Multiple memory corruption vulnerabilities in Mozilla Firefox allow remote code execution through browser rendering engine flaws. Firefox ESR 115.35.1, Firefox ESR 140.10.1, and Firefox 150.0.1 contain memory safety bugs with evidence of memory corruption that could enable arbitrary code execution. Fixed versions are available (Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2). EPSS score of 0.01% indicates very low exploitation probability in the wild, and SSVC framework shows no confirmed exploitation and non-automatable attacks. Despite high CVSS 8.1, real-world exploitation requires significant complexity (AC:H), reducing immediate risk for most environments.
Memory corruption in the Graphics component of Mozilla Firefox stems from incorrect boundary conditions (a buffer overflow) that can be triggered when the browser processes maliciously crafted graphics content, potentially leading to arbitrary code execution in the content process. It affects Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13, and is fixed across those releases per Mozilla advisories MFSA2026-68/69/70. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile) despite the vendor-supplied CVSS of 9.8.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).
Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.
Sandbox escape in Mozilla Firefox before version 153 stems from an invalid pointer (CWE-119 memory-safety error) in the Disability Access (accessibility) APIs component, letting an attacker who can execute code in a constrained content process break out of the browser sandbox and reach the more privileged parent process with full confidentiality, integrity, and availability impact (CVSS 10.0, scope-changed). No public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), indicating no evidence of widespread exploitation despite the maximum CVSS score.
Information disclosure in Mozilla Firefox's ImageLib graphics component allows remote attackers to read sensitive data (likely uninitialized or out-of-bounds process memory) when a victim renders attacker-controlled image content, per the CWE-200 classification and the C:H CVSS impact. Affected builds are Firefox before 153 and the ESR 115.x and 140.x branches, all fixed by Mozilla in Firefox 153, ESR 115.38, and ESR 140.13. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), consistent with a vendor-reported browser memory-disclosure issue rather than one under active exploitation.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Privilege escalation in Mozilla Firefox's DOM Navigation component (fixed in Firefox 153) allows an attacker to improperly gain elevated privileges within the browser, per Mozilla advisory MFSA2026-68. The flaw carries a CVSS 9.8 rating claiming full confidentiality, integrity, and availability impact with no privileges or user interaction, though this is atypical for a browser DOM bug. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Privilege escalation in Mozilla Firefox's DOM: Workers component lets remote attackers gain elevated privileges within the browser through web-facing content, potentially enabling sandbox/privilege boundary compromise. The flaw was resolved in Firefox 153 and is described in Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no evidence of active or imminent widespread exploitation.
Memory-corruption in Mozilla Firefox's Audio/Video Playback component allows a remote attacker to achieve confidentiality and integrity compromise (potentially arbitrary code execution) by delivering crafted media content to a victim's browser. Rooted in incorrect boundary conditions (buffer overflow, CWE-119), the flaw affects Firefox versions prior to 153 and carries a CVSS 9.1 rating, though EPSS exploitation probability is low (0.14%, 4th percentile) and no public exploit identified at time of analysis.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Use-after-free in the WebRTC Audio/Video component of Mozilla Firefox allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious page or joins a crafted WebRTC session. All Firefox builds prior to 153 and ESR builds prior to 140.13 are affected, with high impact to confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the EPSS probability is low (0.15%), but browser memory-corruption bugs of this class are historically attractive exploitation targets.
Memory corruption in the cubeb audio/video library used by Mozilla Firefox arises from incorrect boundary conditions (CWE-119), and Mozilla fixed it in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13 (advisories MFSA2026-68/69/70). The input CVSS rates it 9.8 (network, no privileges, no user interaction), implying an unauthenticated remote attacker could corrupt memory in the browser and potentially achieve code execution, though as a media-processing flaw real exploitation almost certainly requires a victim to render attacker-controlled audio/video content. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), and it is not in CISA KEV.
Same-origin policy bypass in Mozilla Firefox's DOM: Navigation component allows a malicious web page to read or manipulate content belonging to another origin, defeating the browser's core cross-origin isolation boundary. All Firefox users on affected pre-153 releases and unpatched ESR branches are exposed, and while Mozilla's vector maps to CVSS 9.8, EPSS estimates only a 0.16% exploitation probability (6th percentile). There is no public exploit identified at time of analysis and it is not in CISA KEV.
Unauthenticated remote code execution in Joro ≤ v1.1.0 (BishopFox's offensive-security tooling) allows an attacker to gain a shell as the operator's user when that operator merely visits a malicious web page. In the default proxy mode, Joro exposes an unauthenticated local API on 127.0.0.1:9090 with a wildcard CORS policy; because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript can upload a native Go plugin and trigger a restart through the operator's browser with no preflight or credentials, and the plugin's init() executes on load. No public exploit is identified at time of analysis, but the advisory documents a complete, reproducible attack chain, and the assigned CVSS is 9.6 (Critical).
Stored cross-site scripting in the lxml_html_clean Cleaner (≤ 0.4.4) and the bundled lxml legacy html.clean module (≤ 6.1.0) lets attackers smuggle javascript: URLs through HTML sanitization on the namespaced xlink:href attribute. When callers configure Cleaner with safe_attrs_only=False, the URL-scheme scrubber never inspects <a xlink:href="javascript:..."> inside SVG or MathML, so the payload survives and executes when a victim clicks the rendered anchor. Publicly available exploit code exists (a working reproducer ships with the advisory), but there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Path traversal in Goploy's `/deploy/fileDiff` endpoint (versions <=1.17.5) enables any authenticated low-privilege member to read arbitrary files on both the Goploy host and every SFTP-managed remote server registered in the system. The dual file read returns local content in the `srcText` response field and remote server content in `distText`, multiplying the blast radius across all managed deployment targets. Publicly available exploit code exists per the GitHub Security Advisory; this is not listed in CISA KEV, but exploitation conditions are trivially met under default Goploy configuration.
Memory-corruption weaknesses in Mozilla Firefox 152.0.3 could allow remote attackers to potentially execute arbitrary code within the browser process. Mozilla graded the collected memory-safety bugs as critical (MFSA2026-62) and states some showed evidence of memory corruption that, with sufficient effort, could be exploited for code execution; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). The issue is resolved in Firefox 152.0.4.
Unauthenticated denial-of-service in Langflow versions prior to 1.0.19 allows remote attackers to render the application unusable for all users indefinitely by sending a single crafted POST to /api/v1/files/upload/ with a malformed multipart boundary containing a very large run of hyphens. The upload endpoint processes the multipart body before performing authentication or flow-ID validation, so no token, cookie, or valid flow UUID is required. A public proof-of-concept is included in the GitHub Security Advisory GHSA-qwqc-p3q8-wcg9, though there is no public exploit identified beyond the PoC at time of analysis and the issue is not listed in CISA KEV.
TLS pinning bypass in undici 7.23.0 through 7.27.x and 8.x prior to 8.5.0 allows network-positioned attackers to perform man-in-the-middle attacks on HTTPS traffic routed through SOCKS5 proxies. The ProxyAgent silently drops the requestTls option (including ca, cert, key, rejectUnauthorized, and servername) when the proxy URI uses socks5:// or socks://, causing connections to fall back to Node.js's default Mozilla CA bundle instead of the application-configured trust anchor. No public exploit identified at time of analysis, but the CWE-295 improper certificate validation flaw directly defeats corporate CA pinning controls.
Unauthenticated remote command execution in rclone's remote control daemon (rcd) affects versions 1.55.0 through 1.74.2 when started with `--rc-serve` and without HTTP authentication. A single GET or HEAD request to `/[remote:path]/object` triggers backend initialization with attacker-controlled inline remote options, executing commands as the rclone process user. No public exploit identified at time of analysis, though the GHSA advisory describes the technique in detail and notes the issue bypasses the earlier CVE-2026-41179 fix.
Memory corruption vulnerabilities in Mozilla Firefox 151, Firefox ESR 115.36/140.11, and Thunderbird 151/ESR 140.11 allow remote attackers to potentially execute arbitrary code by serving crafted web content that triggers internal memory safety bugs. Mozilla developers observed evidence of memory corruption in several of these bugs and assess that sufficient effort could yield arbitrary code execution in the browser process. No public exploit identified at time of analysis, and SSVC reports no observed exploitation, but the high CVSS (8.1) and total technical impact warrant prompt patching.
Memory-corruption flaws in Mozilla Firefox 151, Firefox ESR 140.11, Thunderbird 151 and Thunderbird ESR 140.11 allow remote attackers to potentially execute arbitrary code by having a victim load maliciously crafted web content. Mozilla's engineers reported evidence of memory corruption in several bundled bugs and presume that, with sufficient effort, at least some could be leveraged for code execution. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%), and the issue is not on CISA KEV; a fix is available in Firefox 152 and Firefox ESR 140.12.
Memory corruption in Mozilla Firefox 151 and Thunderbird 151 may allow remote attackers to achieve arbitrary code execution when a victim renders malicious web content, per Mozilla advisory MFSA2026-60. The flaw stems from multiple memory safety bugs that Mozilla assessed as potentially exploitable, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.22%, 13th percentile). It is fixed in Firefox 152, with no special privileges required but high attack complexity per the CVSS vector.
Memory safety flaw in the CanvasWebGL graphics component of Mozilla Firefox allows remote attackers to trigger incorrect boundary handling through crafted web content, leading to limited confidentiality, integrity, and availability impact. The issue affects Firefox prior to version 152 and Firefox ESR prior to 140.12, and no public exploit identified at time of analysis. Reported by Mozilla with low complexity and no authentication required (CVSS 7.3).
Memory corruption in the NSS (Network Security Services) Libraries component shipped with Mozilla Firefox allows remote attackers to trigger out-of-bounds memory access via incorrect boundary condition handling, with low impact across confidentiality, integrity, and availability. Mozilla addressed the issue in Firefox 152, with associated advisories MFSA2026-57 and MFSA2026-60. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Memory corruption in Mozilla Firefox versions prior to 152 allows remote unauthenticated attackers to crash the browser by serving crafted web content, resulting in denial of service. The CVSS 3.1 base score of 7.5 reflects high availability impact without confidentiality or integrity loss, and no public exploit identified at time of analysis. Mozilla disclosed the issue via advisories MFSA2026-57 and MFSA2026-60 with a fix shipped in Firefox 152.
Security mitigation bypass in the DOM: Security component of Mozilla Firefox prior to version 152 allows remote attackers to compromise confidentiality and integrity of browser-rendered content without user interaction. The flaw carries a critical CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N) and is tagged as an Authentication Bypass class issue, though no public exploit identified at time of analysis. The vulnerability has been patched by Mozilla in Firefox 152 per MFSA2026-57/MFSA2026-60.
Security mitigation bypass in the DOM: Security component of Mozilla Firefox allows remote attackers to circumvent browser security controls, with high impact to confidentiality and integrity. The flaw affects Firefox versions prior to 152 and Firefox ESR prior to 140.12, with no public exploit identified at time of analysis. Given the CVSS 9.1 rating and network-reachable attack vector, any user browsing a malicious page is potentially exposed.
Memory corruption in Mozilla Firefox prior to version 152 and Firefox ESR prior to 140.12 allows remote attackers to compromise browser memory integrity through crafted web content, with confidentiality impact rated High per the CVSS vector. The flaw stems from a buffer-handling defect (CWE-119) reported by Mozilla itself and addressed across multiple security advisories (MFSA2026-57, -58, -60, -61). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in Mozilla Firefox before version 152 (and Firefox ESR before 140.12) stems from a memory-safety flaw that a remote attacker can trigger without authentication or user interaction to read out-of-bounds memory (CVSS 7.5, C:H only). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with low EPSS (0.27%), so this is a browser-engine memory bug patched proactively by Mozilla rather than an actively exploited threat.
Memory-corruption in Mozilla Firefox before version 152 (and Firefox ESR before 140.12) allows a remote, unauthenticated attacker to trigger a memory safety bug via a malicious web page; the CVSS vector's confidentiality-only impact indicates likely out-of-bounds memory disclosure rather than full code execution. The flaw was reported and patched by Mozilla in advisories MFSA2026-57/58/60/61 and is fixed in Firefox 152 / ESR 140.12. There is no public exploit identified at time of analysis, EPSS is low (0.27%, 18th percentile), and CISA SSVC lists exploitation as 'none', though the bug is assessed as automatable.
Denial of service in Mozilla Firefox prior to version 152 and Firefox ESR prior to 140.12 stems from a memory safety bug (CWE-119) that remote attackers can trigger via crafted web content. The CVSS 7.5 score reflects high availability impact with no confidentiality or integrity loss, consistent with a browser crash rather than reliable code execution. No public exploit identified at time of analysis, and Mozilla has shipped fixes across multiple advisories (MFSA2026-57, -58, -60, -61).
Same-origin policy bypass in Mozilla Firefox's Networking: Cookies component allows remote attackers to circumvent origin isolation and access or manipulate cross-origin cookie data without authentication or user interaction. The flaw (CWE-346 Origin Validation Error) is rated CVSS 9.1 and was reported and fixed by Mozilla in Firefox 152 and Firefox ESR 140.12; no public exploit identified at time of analysis, and EPSS probability is low at 0.19%.
Sandbox escape in Mozilla Firefox and Firefox ESR allows a remote attacker to break out of the browser's content sandbox by exploiting incorrect boundary conditions in the Networking component, leading to full compromise of confidentiality, integrity, and availability on the host. Exploitation requires user interaction (e.g., visiting a malicious page), but with CVSS 9.6 and a scope change, successful exploitation crosses the renderer/host trust boundary. No public exploit identified at time of analysis, and EPSS is low (0.16%), consistent with the SSVC 'Exploitation: none' signal.
Sandbox escape in Mozilla Firefox's Process Sandboxing security component allows a remote attacker to break out of the content process isolation boundary, escalating from a compromised renderer to broader system access after a user visits a malicious page. Affects Firefox before version 152 and Firefox ESR before 140.12; the CVSS 3.1 base score is 9.6 (scope-changed, high impact across confidentiality, integrity, and availability). There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Sandbox escape in Mozilla Firefox's DOM: Navigation component allows a remote attacker to break out of the content-process sandbox when a victim visits a malicious web page, gaining code execution and full data access at the browser-host boundary. The flaw affects Firefox before 152 and the ESR 140.x and 115.x branches and carries a critical 9.6 CVSS with a changed scope. There is no public exploit identified at time of analysis, and EPSS (0.16%, 5th percentile) plus SSVC 'Exploitation: none' indicate no observed exploitation yet.
Sandbox escape in Mozilla Firefox's DOM Workers component allows remote attackers to break out of the browser's content process sandbox when a user visits a malicious web page. The flaw affects Firefox prior to 152, Firefox ESR before 140.12, and Firefox ESR before 115.37, with no public exploit identified at time of analysis despite a critical 9.6 CVSS score. EPSS exploitation probability is low at 0.16% and CISA SSVC marks exploitation as 'none', suggesting no in-the-wild abuse has been observed yet.
Memory corruption in Mozilla Firefox's Graphics: WebGPU component (fixed in Firefox 152) allows an attacker who lures a victim to a malicious page to trigger a use-after-free (CWE-416), potentially leading to information disclosure or arbitrary code execution in the content process. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, though CISA's SSVC framework rates its technical impact as total and marks it automatable. EPSS is low at 0.15% (5th percentile), consistent with no observed in-the-wild exploitation.
Memory corruption in the Web Audio component of Mozilla Firefox allows a remote attacker to compromise confidentiality and integrity when a victim visits attacker-controlled web content. Incorrect boundary conditions (CWE-119) can be triggered through crafted audio processing, and the CVSS 8.1 vector (AV:N/AC:L/PR:N/UI:R) reflects unauthenticated network delivery that still requires the user to load a malicious page. No public exploit is identified at time of analysis, EPSS is low (0.15%, 5th percentile), and SSVC records exploitation status as none, though its technical impact is rated total.
Memory corruption via use-after-free in the Networking: HTTP component of Mozilla Firefox enables remote attackers to potentially execute arbitrary code or trigger crashes when a user visits a malicious page. The flaw affects Firefox prior to version 152, Firefox ESR before 140.12, and Firefox ESR before 115.37, and carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability. With an EPSS of 0.16% (5th percentile) and no public exploit identified at time of analysis, opportunistic mass exploitation appears unlikely despite the high severity rating.
Memory corruption in Mozilla Firefox prior to version 152 allows remote attackers to compromise confidentiality and integrity via a crafted web page that triggers a buffer-related memory safety flaw. The issue also affects Firefox ESR before 140.12 and 115.37 and requires user interaction (e.g., visiting a malicious site). No public exploit identified at time of analysis and EPSS is low (0.16%), but SSVC rates technical impact as total.
Privilege escalation in the WebRender graphics component of Mozilla Firefox enables remote attackers to elevate privileges within the browser sandbox when a victim loads malicious web content. Mozilla has patched the issue in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37, and no public exploit has been identified at time of analysis.
Cross-origin credential disclosure in Avira Password Manager's Firefox extension allows a malicious site embedding the targeted page in an iframe to harvest credentials that the extension autofills into the parent context. The flaw stems from incorrect autofill field selection and affects Windows, macOS, and Linux installations; no public exploit identified at time of analysis but the CVSS 7.4 (S:C/C:H) score reflects the cross-origin trust boundary violation.
Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior to 26.8.1) allows a remote attacker to abuse an authenticated user's browser session by luring them to a malicious page. Per CyberArk bulletin CA26-21, the extension's internal web-page verification routine fails to correctly enforce origin checks (CWE-346), enabling unauthorized application interaction in the victim's identity context. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high confidentiality impact and subsequent-system impact via the identity SaaS the extension brokers.
Universal cross-site scripting (UXSS) in Mozilla Focus and Klar for iOS allows remote attackers to inject script into the context of arbitrary web origins by abusing WebKit navigation handling in the browser. The flaw, reported by Mozilla and tracked as EUVD-2026-35837, was corrected in Focus for iOS 151.3.1 and Klar for iOS 151.3.1. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 7.5 reflects the high confidentiality impact achievable with no privileges.
Information disclosure in Mozilla Firefox prior to 151.0.3 allows remote attackers to read out-of-bounds memory via the Graphics: Text component when processing crafted content. The flaw stems from incorrect boundary conditions (CWE-119) in text rendering and can be triggered without user authentication, though no public exploit has been identified and EPSS scores it at just 0.02% likelihood of exploitation.
Cross-site scripting via sanitizer bypass affects DOMPurify 3.4.4, the widely used npm HTML sanitization library maintained by cure53. The flaw stems from `<selectedcontent>` being permitted by default, allowing attackers to leverage browser re-cloning behavior so that an XSS payload is reinjected into a subtree DOMPurify has already walked. No public exploit identified at time of analysis in the form of in-the-wild attacks, but a fully working PoC is published in the GHSA advisory and active exploitation status is not listed in CISA KEV.
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config permission inject arbitrary SQL through the custom-report column-config endpoint, which concatenates user-supplied 'sql', 'from', and 'where' fields directly into a query executed via Doctrine's fetchAssociative(). Because the controller returns raw database error messages in its JSON response, attackers can perform error-based extraction (e.g. EXTRACTVALUE) to read credentials and arbitrary tables, and can bypass the keyword denylist using inline /**/ comments to reach UPDATE/INSERT/DELETE - compromising confidentiality and integrity. Publicly available exploit code exists (a full PoC is published in the GitHub advisory); no CISA KEV listing or EPSS score is present in the provided data.
Memory corruption in Mozilla Firefox 150 and Firefox ESR (115.35, 140.10) allows remote attackers to potentially execute arbitrary code when a user visits a crafted web page. The flaws stem from memory safety bugs reported by Mozilla developers, some showing evidence of exploitable memory corruption. No public exploit identified at time of analysis, and EPSS scoring (0.06%) suggests low near-term exploitation likelihood despite the high CVSS rating.
Memory corruption in Mozilla Firefox 150 and Firefox ESR 140.10 allows remote attackers to potentially execute arbitrary code when a victim visits a crafted web page. The flaw stems from multiple memory safety bugs reported by Mozilla developers, with some showing evidence of exploitable memory corruption; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.05%, 14th percentile). Mozilla has shipped fixes in Firefox 151 and Firefox ESR 140.11.
Memory corruption vulnerabilities in Mozilla Firefox 150 could enable remote code execution when a user visits a maliciously crafted web page, with Mozilla acknowledging that some of the bugs showed evidence of memory corruption potentially exploitable for arbitrary code execution. The issue is resolved in Firefox 151 per Mozilla advisory MFSA2026-46/MFSA2026-50. No public exploit identified at time of analysis and EPSS remains low (0.04%), but SSVC rates technical impact as total and automatable.
Privilege escalation in Mozilla Firefox's WebRTC Audio/Video component allows remote attackers to elevate privileges within the browser context when a user is lured into interacting with a malicious page. The flaw carries a CVSS 8.8 with required user interaction and was addressed in Firefox 151; no public exploit identified at time of analysis and EPSS exploitation probability sits at 0.03% (8th percentile).
Privilege escalation in Mozilla Firefox's Security component allows remote attackers to elevate privileges within the browser when a victim interacts with attacker-controlled content, affecting Firefox versions prior to 151 and Firefox ESR prior to 140.11. With CVSS 8.8 (high) and user interaction required, exploitation is plausible via malicious web content, though EPSS sits at just 0.04% (12th percentile) and no public exploit identified at time of analysis. SSVC rates exploitation as 'none' but flags the issue as automatable with partial technical impact, suggesting concerning scalability if a working exploit emerges.
Protection-mechanism bypass in the DOM: Security component of Mozilla Firefox before version 151 lets a remote attacker circumvent a built-in security mitigation via a malicious web page, undermining a control designed to enforce web security boundaries. Exploitation requires the victim to interact with attacker-controlled content, and the flaw carries high confidentiality and integrity impact. No public exploit has been identified at time of analysis, and EPSS exploitation probability is very low (0.04%).
Denial-of-service in Mozilla Firefox's Web Codecs (Audio/Video) component allows a remote attacker to crash the browser via an invalid pointer, triggered by loading crafted media content with no authentication or user interaction. The flaw is fixed in Firefox 151 and Firefox ESR 140.11; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), consistent with SSVC rating exploitation as none.
Information disclosure in Mozilla Firefox's WebGPU graphics component allows remote attackers to access sensitive in-memory data from browser sessions via crafted web content rendered through the WebGPU API. The flaw affects Firefox versions prior to 151 and has been addressed by Mozilla in advisories MFSA2026-46 and MFSA2026-50. There is no public exploit identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low likelihood of near-term mass exploitation.
Information disclosure in Mozilla Firefox versions prior to 151 affects the IP Protection component, allowing remote unauthenticated attackers to obtain sensitive information over the network without user interaction. The flaw carries a CVSS score of 7.5 driven entirely by confidentiality impact (C:H/I:N/A:N), and while no public exploit is identified at time of analysis, the very low EPSS score of 0.02% (4th percentile) suggests minimal active exploitation interest. Mozilla addressed the issue in Firefox 151 via security advisories MFSA2026-46 and MFSA2026-50.
Information disclosure in Mozilla Firefox prior to version 151 allows remote attackers to leak sensitive data through a flaw in the DOM: Security component, exploitable without authentication or user interaction. The CVSS 7.5 rating reflects high confidentiality impact via network vector, though EPSS scoring at 0.02% (4th percentile) indicates very low predicted exploitation probability and no public exploit identified at time of analysis.
Content spoofing in Mozilla Firefox (versions prior to 151) lets a remote web page abuse the Popup Blocker component to misrepresent UI or origin information to the user, classified under CWE-451 (UI misrepresentation of critical information). No authentication is required (PR:N) and Mozilla has shipped a fix in Firefox 151. There is no public exploit identified at time of analysis, exploitation is rated 'none' by CISA SSVC, and EPSS is negligible at 0.02% (7th percentile).
Spoofing in the Firefox Web Speech component allows remote attackers to misrepresent content to users, undermining integrity of speech-driven interactions (CWE-290, spoofing/authentication-bypass class). It affects Firefox versions prior to 151 and is fixed in Firefox 151; no public exploit identified at time of analysis, and EPSS is very low at 0.03%.
Mitigation bypass in Mozilla Firefox's DOM: Security component allows remote attackers to circumvent built-in browser security protections when a user visits a maliciously crafted web page. The flaw affects Firefox versions prior to 151 and Firefox ESR prior to 140.11, with CVSS 8.1 reflecting high confidentiality and integrity impact contingent on user interaction. EPSS scoring is very low (0.02%, 5th percentile) and no public exploit identified at time of analysis, but the CWE-693 protection-mechanism-failure classification means defensive layers users rely on may not function as intended.
Spoofing in Mozilla Firefox WebExtensions (versions prior to 151) allows remote attackers to misrepresent extension-controlled content or UI, undermining the integrity of what a user believes they are seeing or interacting with. The CVSS 3.1 vector (7.5) reflects a high integrity impact with no confidentiality or availability loss, and Mozilla has shipped a fix in Firefox 151. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC records no known exploitation.
Sandbox escape in Mozilla Firefox's Windows-specific Widget: Win32 component lets a content-process compromise break out of the browser sandbox onto the host due to incorrect boundary conditions (CWE-693, protection mechanism failure). All Firefox versions prior to 151 and ESR versions before 140.11 on Windows are affected, and a scope-changing chain can yield full confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA's SSVC framework rates exploitation as none, indicating this is a high-severity but not yet actively exploited issue.
Sandbox escape and information disclosure in Mozilla Firefox's Process Sandboxing component allows a malicious web page to leak data across the security boundary that isolates content processes from the rest of the browser and host. All Firefox versions prior to 151 and ESR versions prior to 140.11 are affected. The scope-changed CVSS 3.1 score of 8.6 reflects that a successful attack crosses the sandbox boundary, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Privilege escalation in the Enterprise Policies component of Mozilla Firefox affects versions prior to Firefox 151 and Firefox ESR 140.11, allowing remote attackers who can convince a user to interact with crafted content to elevate privileges within the browser. No public exploit identified at time of analysis, and EPSS scoring places exploitation probability at just 0.03% (9th percentile). The vulnerability requires user interaction per the CVSS vector, which somewhat constrains real-world weaponization despite the high 8.8 CVSS score.
Memory corruption in Mozilla Firefox's Networking: JAR component (the handler for jar: URLs and JAR-packaged resources) arises from an integer overflow that can drive out-of-bounds heap access and potential remote code execution. All Firefox builds before Firefox 151 and Firefox ESR 140.11 are affected; the flaw was reported and fixed by Mozilla. No public exploit is identified at time of analysis and EPSS probability is very low (0.05%, 14th percentile), yet SSVC rates technical impact as total and the technique as automatable.
Privilege escalation in Mozilla Firefox's DOM Workers component allows remote attackers to elevate privileges within the browser when a victim interacts with a malicious web page. Affects Firefox versions prior to 151 and Firefox ESR prior to 140.11, with high impact to confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS rates exploitation probability at only 0.03% (9th percentile).
Memory-safety corruption in the Audio/Video component of Mozilla Firefox stems from incorrect boundary conditions combined with an integer overflow, and is fixed in Firefox 151 and Firefox ESR 140.11. Remote attackers can trigger the flaw by serving crafted media to an affected browser, with NVD scoring a high confidentiality impact (CVSS 7.5, C:H/I:N/A:N); there is no public exploit identified at time of analysis and EPSS is very low (0.03%, 10th percentile). CISA's SSVC framework marks exploitation status as none but flags the issue as automatable with partial technical impact.
Sandbox escape in Mozilla Firefox via a use-after-free (CWE-416) in the Disability Access (accessibility) APIs lets a remote attacker who lures a user to malicious web content break out of the content sandbox and gain total control over confidentiality, integrity, and availability. The flaw affects Firefox before 151, Firefox ESR before 115.36, and Firefox ESR before 140.11, and is fixed in those releases. No public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 9.6 rating and scope-changing sandbox escape make it a high-severity patch priority.
Privilege escalation in Mozilla Firefox via the Application Update component allows remote attackers to gain elevated privileges when a user interacts with malicious content, fixed in Firefox 151. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R) and is categorized under CWE-269 (Improper Privilege Management). There is no public exploit identified at time of analysis, and EPSS estimates only a 0.03% probability of exploitation in the next 30 days.
Same-origin policy bypass in Mozilla Firefox's Networking: HTTP component allows a malicious web page to read or interact with data belonging to another origin once a victim is lured into visiting it, defeating the browser's core cross-origin isolation boundary. It affects Firefox before 151 and Firefox ESR before 140.11 and carries a CVSS 9.3 rating driven by a scope change and high confidentiality impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is only 0.02% (4th percentile). Reported internally by Mozilla and shipped with a vendor patch, this is a browser-side flaw requiring user interaction rather than a server-side or unauthenticated-automation risk.
Denial of service in Mozilla Firefox (fixed in Firefox 151 and Firefox ESR 140.11) arises from an integer overflow (CWE-190) in the Windows-specific 'Widget: Win32' component, allowing remote attackers to crash the browser or corrupt memory state via crafted web content. The CVSS 3.1 vector scores availability-only impact (C:N/I:N/A:H), indicating a reliability/crash issue rather than confirmed code execution. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 14th percentile).
Same-origin policy bypass in Mozilla Firefox's DOM: Networking component allows a malicious web page to read cross-origin responses that should be blocked, defeating a core browser isolation boundary. Rated CVSS 9.1 with high confidentiality and integrity impact, the flaw was fixed in Firefox 151 (MFSA2026-46/MFSA2026-50). There is no public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and CISA SSVC lists exploitation status as none, but the issue is assessed as automatable with total technical impact.
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker to trigger a use-after-free (CWE-416) by serving crafted web content, potentially leading to information disclosure or memory-corruption-based control-flow effects. The flaw affects Firefox before 151 and the ESR 115.x and 140.x branches, and is patched in Firefox 151, ESR 115.36, and ESR 140.11. No public exploit identified at time of analysis; EPSS probability is very low (0.05%) and CISA SSVC records no known exploitation.
Out-of-bounds memory access in the Firefox Web Codecs (Audio/Video) component allows a remote attacker to disclose sensitive process memory by serving a specially crafted media stream to a victim's browser. Rated CVSS 7.5 with a confidentiality-only impact (C:H/I:N/A:N), it affects Firefox before 151 and the ESR 115.x and 140.x branches; a vendor patch is available and it carries no public exploit and a negligible EPSS score (0.04%), with CISA SSVC recording no observed exploitation.
Sandbox escape in Mozilla Firefox and Firefox Focus for Android lets a malicious web page break out of the content-process sandbox after luring a victim to attacker-controlled content, gaining full confidentiality, integrity, and availability impact on the affected process. Mozilla addressed it in Firefox 151 (advisory MFSA2026-46); there is no public exploit identified at time of analysis, and EPSS rates near-term exploitation at just 0.05% (16th percentile). CISA SSVC records exploitation status as none with a total technical impact, indicating a serious-but-not-yet-exploited browser flaw.
Session persistence after credential change in SillyTavern before 1.18.0 lets an attacker holding a stolen session cookie retain full account access even after the victim resets their password. Because sessions are stateless and stored entirely in a signed client-side cookie with a default 400-day lifespan, the change-password and account-recovery endpoints update the password hash but never revoke outstanding tokens, defeating the standard remediation for cookie theft. No active exploitation is recorded (not in CISA KEV) and EPSS is very low at 0.02%, but public proof-of-concept reproduction steps are documented in the GHSA advisory.
Sandbox escape in Mozilla Firefox's Profile Backup component allows an attacker to break out of the browser's content-process isolation and gain broader access to the host, affecting versions prior to 150.0.3. There is no public exploit identified at time of analysis and EPSS estimates only a 0.02% exploitation probability, but SSVC rates the technical impact as total and the flaw automatable, so it warrants prompt patching. Not listed in CISA KEV.
Memory corruption in Mozilla Firefox's WebAssembly JavaScript engine component allows remote attackers to trigger a use-after-free condition via crafted web content, with limited impact across confidentiality, integrity, and availability. The flaw affects Firefox versions prior to 150.0.3 and has no public exploit identified at time of analysis, though SSVC indicates the issue is automatable. EPSS scoring (0.02%, 5th percentile) suggests very low near-term exploitation probability despite the network-reachable attack vector.
Memory corruption in Mozilla Firefox versions prior to 150.0.3 stems from a JIT (Just-In-Time) compiler miscompilation in the JavaScript engine, allowing remote attackers to trigger high-impact compromise of confidentiality, integrity, and availability when a user visits a malicious web page. The flaw carries a CVSS score of 8.8 and requires user interaction (loading attacker-controlled JavaScript), but no authentication. There is no public exploit identified at time of analysis, though a GitHub repository referenced from NVD suggests early proof-of-concept research, and EPSS scores the exploitation probability at only 0.02% despite the high CVSS severity.
Zen Browser's auto-update mechanism delivered unsigned code to all users due to deliberately removed MAR signature verification inherited from Firefox. The browser shipped with Mozilla's updater binary stripped of all cryptographic verification code and served update packages containing zero cryptographic signatures. Compromise of the update server or GitHub Actions pipeline allowed arbitrary code execution on all Zen installations without cryptographic chain-of-trust protection. Version 1.19.9b restores MAR signing with RSA-4096 keys and certificate verification in the updater binary.
Cross-origin WebSocket hijacking in the Cline `kanban` server (npm `kanban`, shipped via the `cline` CLI ≤ 2.13.0) lets any website a developer visits silently connect to the loopback server on 127.0.0.1:3484 and leak workspace paths, task content, git branches, and AI-agent chat, then inject prompts into a running agent's terminal for remote code execution and kill active tasks. Because browsers do not apply CORS to WebSocket handshakes and the three endpoints perform no Origin validation or authentication (CWE-306), exploitation needs only that the victim run kanban and browse to an attacker page. A full interactive proof-of-concept exists (publicly available exploit code exists); it is not listed in CISA KEV and EPSS is very low at 0.02%, indicating no observed mass exploitation to date.
Remote code execution in ai-scanner versions 1.0.0 through 1.4.0 allows authenticated attackers to inject and execute arbitrary JavaScript code via the BrowserAutomation::PlaywrightService component. The vulnerability has a Critical CVSS score of 9.9 with scope change, enabling cross-boundary compromise of confidentiality, integrity, and availability. Vendor-released patch available in version 1.4.1 as of April 13, 2026, with GitHub Security Advisory GHSA-r27j-xxgx-f5vr confirming the fix.
Remote code execution in Firefox ESR's WebRTC component allows unauthenticated network attackers to achieve arbitrary code execution with complete system compromise. The vulnerability affects Firefox ESR versions prior to 140.10.2 and carries a critical CVSS score of 9.8 with network attack vector requiring no authentication or user interaction. Despite the critical severity, EPSS probability remains exceptionally low at 0.01% (0th percentile) with no evidence of active exploitation, suggesting limited awareness or exploitation complexity despite the automatable nature assessed by CISA SSVC framework.
Multiple memory corruption vulnerabilities in Firefox 150.0.1 enable potential remote code execution through memory safety flaws in the browser engine. Mozilla's advisory references 10 distinct bugs demonstrating memory corruption, which with sufficient exploitation effort could allow arbitrary code execution. Firefox 150.0.2 addresses these vulnerabilities. CVSS rates this 7.5 High (network-exploitable, no authentication required), though the vector indicates only availability impact, contradicting the RCE assessment in Mozilla's advisory. SSVC framework confirms no active exploitation and partial technical impact.
Multiple memory corruption vulnerabilities in Mozilla Firefox allow remote code execution through browser rendering engine flaws. Firefox ESR 115.35.1, Firefox ESR 140.10.1, and Firefox 150.0.1 contain memory safety bugs with evidence of memory corruption that could enable arbitrary code execution. Fixed versions are available (Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2). EPSS score of 0.01% indicates very low exploitation probability in the wild, and SSVC framework shows no confirmed exploitation and non-automatable attacks. Despite high CVSS 8.1, real-world exploitation requires significant complexity (AC:H), reducing immediate risk for most environments.