Mozilla
Monthly
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.
A denial-of-service condition in the Firefox Printing: Output component lets attacker-controlled content crash or hang the browser when a victim prints or renders it, and Mozilla has fixed the issue in Firefox 158 and Firefox ESR 153.5. Exploitation requires the victim to trigger the printing code path with attacker-supplied content, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H vector: network-delivered and unauthenticated, but gated by mandatory user interaction and limited to availability-only impact with no code execution, data exposure, or persistence. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with automatable set to no, so this is a moderate-severity availability bug rather than a top-tier priority.
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158.
Limited information disclosure and limited integrity tampering in Mozilla Firefox versions prior to 158 arise from a race condition (CWE-362) in the browser's Networking: DNS component, fixed by Mozilla in Firefox 158. Winning the race is non-deterministic and requires the victim to interact with attacker-influenced web content (UI:R) that drives the DNS resolution code path, which is why the high attack complexity (AC:H), the modest CVSS 3.1 base score of 4.2, and CISA's SSVC 'Automatable: no' rating all point to a constrained, opportunistic issue rather than a reliable remote compromise; no public exploit identified at time of analysis, and no KEV listing. Impact is bounded to partial confidentiality and integrity loss with no availability effect, so this is a genuinely low-to-moderate priority issue rather than a high-severity emergency.
Information disclosure in the Mozilla Firefox Storage: IndexedDB component allows attacker-controlled web content to read data it should not be able to access, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires the victim to browse to or interact with a malicious or compromised page that exercises IndexedDB, as reflected by the UI:R flag in the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N vector; the attacker needs no authentication, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability effect, making this a low-to-moderate severity issue rather than a top remediation priority.
A non-deterministic timing race in Mozilla Firefox's XPCOM component can be won by attacker-controlled web content to yield limited information disclosure and a small integrity impact inside the browser, affecting Firefox builds prior to 158 and Firefox ESR builds prior to 153.5. Exploitation requires the victim to load or interact with attacker-supplied content (UI:R) and to hit a narrow, hard-to-reproduce race window (AC:H); no credentials are required (PR:N), and impact stays at low confidentiality and integrity with no scope change and no availability effect. Risk is low across every signal available: EPSS 0.19% (8th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, while vendor-released patches (Firefox 158 and Firefox ESR 153.5) are already available.
A denial-of-service vulnerability in Mozilla Firefox's WebRTC component can cause the browser to hang or crash when a user opens a malicious web page that triggers resource exhaustion. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes released in Firefox 158 and Firefox ESR 153.5. No public exploit code or active exploitation has been identified, and the CVSS score is 6.5 (medium).
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158.
Denial of service in Mozilla Firefox's Sync component can be triggered by crafted synced data, causing uncontrolled resource consumption and a browser crash or hang (CWE-400). The issue affects Firefox before the vendor fix in Firefox 158, and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates it is network-reachable without privileges but requires victim user interaction. No public exploit was identified at time of analysis, and CISA SSVC rates it non-automatable with partial technical impact.
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158.
Information disclosure in the WebRTC: Networking component of Mozilla Firefox lets attacker-controlled web content coax limited data out of the browser, affecting all builds prior to Firefox 158. Exploitation is remote and requires no attacker credentials, but it mandates user interaction (CVSS UI:R) and yields only a partial confidentiality leak (C:L with no integrity or availability impact), which keeps realistic risk low despite the Medium 4.3 score. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and upgrading to Firefox 158 fully removes the condition.
Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Information disclosure in the Networking: Cache component of Mozilla Firefox allows remote attackers to expose a limited amount of browser-cached data when a victim interacts with attacker-controlled web content; the issue is fixed in Firefox 158, and installations prior to that version are affected. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms this is unauthenticated but requires user interaction, with only low confidentiality impact and no integrity or availability effect. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no, making this a genuinely low-priority issue despite the ubiquity of the browser.
Denial of service in Mozilla Firefox allows a remote attacker to crash or hang the browser by getting a victim to load crafted content processed by the Site Reports component; versions prior to Firefox 158 are affected. Exploitation requires user interaction (the victim must navigate to or open the attacker-controlled content, per the UI:R metric) and no authentication is required (PR:N), but the SSVC assessment marks the issue as non-automatable, and no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to client-side availability (A:H with no confidentiality or integrity loss and no scope change), so the realistic worst case is a crashed or unresponsive browser session for the targeted user.
Information disclosure in Firefox's Networking component allows a remote attacker to expose a limited amount of confidential data through a crafted web page, provided the victim interacts with that content (UI:R); no authentication or user privileges are required (PR:N) and default Firefox configurations are affected. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, and carries a moderate CVSS score of 4.3 with only partial technical impact per CISA's SSVC assessment. There is no indication that the issue is being actively exploited and no public exploit code has been identified at the time of analysis.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free triggered by a race condition in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to achieve limited confidentiality and integrity impact (CVSS 4.2) when a victim loads attacker-controlled web content. The vulnerability affects Firefox builds before 158 and Firefox ESR before 153.5, and is mitigated in practice by a high attack complexity (AC:H) - exploitation depends on winning a non-deterministic timing window, cannot be automated at scale (CISA SSVC Automatable: no), and requires the victim to actively navigate to crafted content (UI:R, PR:N). There is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis; the issue is rated low-to-moderate priority, with independent assessment and vendor data in agreement.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's JavaScript/WebAssembly engine can be triggered when a user loads attacker-controlled web content containing crafted WebAssembly, allowing the attacker to corrupt memory and potentially read or alter data in the browser process. Affected are Firefox releases prior to 158; exploitation is remote and requires no authentication (PR:N) but does require user interaction (UI:R), since the victim must navigate to or render the malicious page, and WebAssembly is enabled by default so no non-default configuration is needed. Impact is scoped to partial confidentiality and integrity loss (C:L/I:L, A:N) rather than confirmed code execution, and no public exploit has been identified at time of analysis; Mozilla addressed the flaw in Firefox 158 and the issue is rated moderate priority rather than an emergency.
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM: Workers component allows remote attackers to trigger memory corruption and potential information disclosure in Firefox versions before 158 and Firefox ESR before 153.5 when a victim loads attacker-controlled web content that exercises the Workers API. This moderate-severity issue requires user interaction (UI:R) but no authentication (PR:N), and no public exploit code has been identified at time of analysis per CISA SSVC. The assessed vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating limited confidentiality and integrity impact and no availability impact.
Information disclosure in the Networking component of Mozilla Firefox can leak some confidential information to remote, unauthenticated attackers who persuade a victim to load attacker-controlled web content, as successful exploitation depends on user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw affects Firefox builds prior to 158 and Firefox ESR builds prior to 153.5, and its impact is capped at partial confidentiality loss with no integrity or availability effect (CVSS 4.3). There is no public exploit identified at time of analysis, CISA's SSVC framework rates exploitation as 'none' and automatable as 'no', and the issue is not listed in CISA KEV, making this a low-to-moderate priority item best resolved through routine browser updating.
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158.
Firefox builds prior to version 158 carry a use-after-free in the JavaScript/WebAssembly (WASM) component that lets attacker-supplied web content corrupt memory inside the browser process, producing limited confidentiality and integrity effects (CVSS 5.4, C:L/I:L/A:N, S:U). Exploitation is unauthenticated (PR:N) but requires the victim to actively load attacker-controlled content that reaches the WASM code path (UI:R), so an idle or abandoned browser cannot be attacked and the flaw is not automatable for worm-style mass exploitation (SSVC Automatable=no). Independent signals rate real-world priority as low: CISA SSVC records Exploitation=none, and no public exploit code has been identified at time of analysis, leaving this a moderate-severity memory-safety bug best addressed by routine patching rather than emergency response.
A use-after-free (CWE-416) in Firefox's JavaScript WebAssembly component lets remote, unauthenticated attackers trigger memory corruption with low confidentiality and integrity impact (CVSS 5.4) when a victim loads attacker-supplied WASM/JS content in any build prior to Firefox 158. Exploitation is constrained by a mandatory user-interaction requirement - the target must open or render a malicious page or document - and by the absence of any availability impact, indicating a bounded disclosure/corruption primitive rather than full system compromise. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis; Mozilla fixed the flaw in Firefox 158.
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158.
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Information disclosure in Mozilla Firefox's built-in PDF Viewer (pdf.js) allows a remote, unauthenticated attacker to expose limited browser-context data by convincing a victim to open and render a crafted PDF document; the attack succeeds only through the required user interaction of loading the malicious file. The issue is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) with scope-unchanged, confidentiality-only impact, and is tracked as EUVD-2026-98504 under CWE-200; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and the affected population is Firefox releases prior to 158 and Firefox ESR prior to 153.5.
A use-after-free in Mozilla Firefox's Storage Bucket File System allows an unauthenticated remote attacker to corrupt memory or disclose information by convincing a victim to load crafted web content that exercises the Origin Private File System (OPFS) API. The flaw affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5, and exploitation requires user interaction while being complicated by heap state and timing, resulting in only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation as none with partial technical impact, making this a moderate-severity, low-priority issue despite the underlying memory-corruption class.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's Audio/Video Playback component allows unauthenticated remote attackers to cause partial memory disclosure and memory corruption when a victim loads crafted media content, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires user interaction - the victim must visit a malicious or compromised page whose crafted media is processed by the playback pipeline - so this is best suited to targeted or opportunistic drive-by delivery rather than automated mass exploitation (CISA SSVC Automatable=no, Technical Impact=partial). Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5, and no public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) with no availability impact and no confirmed path to full code execution from the available data.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM Animation component allows remote attackers to corrupt memory by getting a victim to render attacker-controlled web content in a browser build prior to Firefox 158. The flaw is unauthenticated (PR:N) but requires user interaction (UI:R), since the victim must visit or render the crafted page and let it exercise animation handling; there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation=none with Automatable=no, so mass or automated exploitation is not expected. Impact is capped at partial confidentiality and integrity loss (CVSS 5.4, C:L/I:L/A:N), typically leaking data from freed memory or corrupting it, rather than a guaranteed full compromise.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, yielding limited confidentiality and integrity impact. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes available in Firefox 158 and Firefox ESR 153.5. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none, automatable as no, and technical impact as partial, consistent with a moderate-severity memory-safety issue rather than reliable code execution.
An integer overflow (CWE-190) in Firefox's Layout: Text and Fonts component can be triggered when a user renders attacker-controlled web content containing malformed text or font data, potentially causing memory-safety corruption in the browser process. The vulnerability affects Firefox builds prior to version 158 and Firefox ESR builds prior to 153.5, is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but requires the victim to load the crafted page, and its assessed impact is bounded to low confidentiality and integrity effects with no availability impact (score 5.4). Exploitation is not confirmed in the field: there is no CISA KEV listing and no public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates a low predicted likelihood of exploitation activity.
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Firefox's DOM WebIDL bindings (CVE-2026-109717) lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled or attacker-influenced web content that reaches the affected binding code path; the CVSS UI:R metric means the user must visit a malicious or compromised page, and no special browser configuration is required. Impact is bounded to low confidentiality and low integrity with no availability impact per the vendor-rated vector, and there is no public exploit identified at time of analysis - CISA's SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, making this a routine browser update-cycle item rather than an emergency patch.
Incorrect boundary conditions in Mozilla Firefox's Layout component prior to version 158 allow remote, unauthenticated attackers to cause low-severity confidentiality and integrity impact by enticing a user to render attacker-controlled web content; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms that user interaction is mandatory and that availability is not affected. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, while the EPSS score is low at 0.15% (4th percentile), consistent with a moderate, not urgent, priority. The flaw is a memory-buffer boundary error (CWE-119) fixed in Firefox 158.
Use-after-free in Mozilla Firefox's Crash Reporting component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing the low confidentiality and integrity impact captured by the assessed CVSS 5.4 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Only Firefox builds before 158 and Firefox ESR builds before 153.5 are affected, and the flaw is fixed in those releases. There is no public exploit identified at time of analysis (SSVC exploitation: none; not automatable), and the mandatory user-interaction requirement keeps realistic risk moderate, making this a normal-patch-cycle item rather than an emergency.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially disclose information when a victim loads attacker-controlled web content, requiring user interaction (UI:R) but no credentials (PR:N). The flaw affects Firefox builds before 158 and Firefox ESR builds before 153.5 and carries a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), with partial confidentiality and integrity impact but no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as 'none' and Automatable as 'no'.
Use-after-free in Mozilla Firefox's DOM Streams component allows a remote, unauthenticated attacker to corrupt memory in the content process when a victim renders attacker-controlled web content, yielding limited information disclosure and limited data integrity impact (CVSS 5.4, C:L/I:L/A:N). All builds prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are affected, and exploitation is gated by mandatory user interaction (UI:R) plus the heap-timing precision needed to win a use-after-free race. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is not an active-exploitation priority despite the memory-corruption class.
Use-after-free in Mozilla Firefox's JavaScript JIT compiler allows remote, unauthenticated attackers to corrupt browser memory by enticing a victim into loading attacker-controlled web content, producing limited information disclosure and limited integrity impact with no availability effect (CVSS 5.4, UI:R, S:U). Exploitation requires the target to visit or be redirected to a malicious page while JIT compilation is enabled, which is the default configuration, and the impact stays confined to the browser process. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and vendor-released fixes ship in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM Animation component lets a remote attacker corrupt memory by having a victim load attacker-controlled web content, yielding limited information disclosure and limited integrity impact rather than code execution. Exploitation requires user interaction (UI:R) but no authentication and no non-default browser configuration, so default installations below the fixed builds are affected; the attack is not automatable per CISA SSVC (Automatable=no, Exploitation=none), and no public exploit identified at time of analysis. Vendor-released patch: Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 - only versions below those builds remain exposed.
Use-after-free in Mozilla Firefox's Audio/Video component (CWE-416) permits unauthenticated remote attackers to trigger memory corruption, leading to limited information disclosure or low-integrity effects (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), when a victim loads crafted media in an unpatched browser. Affected versions are Firefox before 158 and Firefox ESR before 115.43 and 153.5; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment notes exploitation has not been observed and the flaw is not reliably automatable. The required user interaction and partial impact keep real-world urgency low, making this a moderate patch-management item rather than an emergency.
Use-after-free in Mozilla Firefox's SVG rendering component allows remote attackers to cause memory corruption leading to partial information disclosure or limited integrity impact when a user opens a crafted SVG document. Affected versions include Firefox prior to 158 and Firefox ESR prior to 115.43 and 153.5. Exploitation requires user interaction (UI:R), is not automatable, and no public exploit code has been identified; vendor patches are available.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, requiring user interaction (UI:R) with no authentication or prior privileges needed (PR:N). Any default Firefox installation that browses to a malicious or compromised page is in scope, but the impact ceiling is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N), and Mozilla has already shipped fixes in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. There is no public exploit identified at time of analysis, exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and this is a moderate-severity, low-real-world-priority issue despite belonging to the memory-corruption class (CWE-416).
Use-after-free in Mozilla Firefox's Graphics: CanvasWebGL component - triggered by a race condition (CWE-362) in the WebGL/canvas rendering path - allows a remote attacker who convinces a victim to load crafted web content to win a non-deterministic timing window and achieve limited information disclosure or limited data modification (CVSS 3.1: 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Only unpatched installations below Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are exposed; the issues were remediated in the Mozilla Foundation Security Advisories mfsa2026-106, mfsa2026-107, and mfsa2026-108. Exploitation is not observed by CISA's SSVC assessment (Exploitation: none) and no public exploit code has been identified at time of analysis; the high attack-complexity rating, mandatory user interaction, and lack of availability or code-execution impact keep this a genuinely low-priority memory-safety issue.
Use-after-free in Mozilla Firefox's XML component can be triggered by unauthenticated remote attackers when a victim loads attacker-controlled web content containing crafted XML, leading to limited information disclosure or integrity impact. This moderate-severity flaw (CVSS 5.4) requires user interaction (UI:R) and does not allow full code execution or denial of service per the assessed vector; no public exploit has been identified and CISA SSVC rates exploitation as none. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Memory-safety flaws in Mozilla Firefox's Graphics: Text component allow remote attackers who convince a user to load crafted web content to trigger a use-after-free, potentially exposing or corrupting data in the browser's process memory. Impact is bounded to limited confidentiality and integrity effects with no availability loss (CVSS 5.4, C:L/I:L/A:N), and exploitation is limited to unpatched builds (versions before Firefox 158, ESR before 115.43, and ESR before 153.5) that render the malicious payload during normal browsing. No public exploit code has been identified at time of analysis and the CISA SSVC assessment rates exploitation as 'none', making this a moderate memory-safety fix to fold into routine browser patching rather than an emergency action.
Use-after-free in Mozilla Firefox's Storage: IndexedDB component (CWE-416) allows a remote, unauthenticated attacker to corrupt browser memory when a victim loads attacker-controlled web content that drives the IndexedDB API, yielding partial confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The mandatory user interaction (UI:R) is the controlling barrier: the flaw cannot be triggered against a passive or idle target, and IndexedDB is enabled by default so no special configuration is required once a victim visits or interacts with a malicious or compromised page. Only Firefox builds prior to 158 and ESR builds prior to 115.43 and 153.5 are affected; no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' with non-automatable, partial technical impact, and the independent assessment keeps this at low real-world priority rather than an urgent threat.
Information disclosure in Mozilla Firefox for iOS (releases prior to 157.1) can leak saved credentials to a different origin: if a cross-origin navigation occurs while the saved-login/autofill UI is open, the browser may still fill the stored username and password into the newly loaded page, because the autofill action was never bound to the page that originally requested it and was not re-validated when the origin changed (CWE-346). Exploitation requires the user to have triggered the login prompt (UI:R) and depends on a narrow race between that prompt being open and the navigation occurring, so our independent assessment rates it as a network-reachable but high-complexity, unauthenticated issue with confidentiality-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, CISA's SSVC framework records exploitation as 'none' and the issue as not automatable, and Mozilla shipped the fix in Firefox for iOS 157.1.
A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.
Denial-of-service in Mozilla Firefox's Storage: StorageManager component allows an unauthenticated remote attacker to crash or hang the browser by persuading a victim to render attacker-controlled web content, requiring user interaction and no special privileges. The flaw is a CWE-770 resource-exhaustion issue fixed in Firefox 157 and Firefox ESR 153.4; all earlier Firefox versions are affected, and there is no public exploit identified at time of analysis. Exploitation is not automatable per CISA SSVC, and the impact is availability-only with no data compromise, making real-world urgency low once patched.
Firefox for Android before 157 can be tricked by a malicious web page into misrepresenting download information in its Downloads component, a spoofing flaw rated CVSS 5.4 (Medium, AV:N/AC:L/PR:N/UI:R). Only the Android builds are affected - desktop Firefox is not implicated - and Mozilla shipped the fix in Firefox 157. Exploitation requires the victim to visit an attacker-controlled page and interact with a download prompt, no public exploit code has been identified at time of analysis, and CISA SSVC records exploitation as 'none', so this is a low-to-moderate priority fix rather than an urgent one.
A spoofing flaw in Firefox's Networking: HTTP component allows a malicious web page to misrepresent UI content to the user, potentially tricking them into trusting a spoofed page element. The issue affects Firefox versions prior to ESR 153.4 and Firefox 157; it requires the victim to actively load or interact with attacker-controlled web content (UI:R), means no authentication on the attacker's side (PR:N), and yields only limited confidentiality impact. No public exploit code has been identified at time of analysis, CISA KEV does not list it, and SSVC scores exploitation as 'none' with automatable 'no' - overall risk is consistently LOW.
Cross-origin information disclosure in Mozilla Firefox's panning and zooming component lets attacker-controlled web content defeat the browser's site-isolation boundary and leak a limited amount of data from another origin. The issue affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires the victim to load a malicious page (UI:R) with no authentication or special privileges (PR:N); impact is confined to confidentiality (C:L) with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.16% (4th percentile) indicates very low predicted exploitation activity, making this a defense-in-depth fix rather than an urgent threat.
Mozilla Firefox versions prior to 157 contain a flaw in the WebAssembly component that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted webpage, resulting in limited information disclosure and integrity impact. No public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world exploitation likelihood. Because the bug is scope-unchanged, it does not grant sandbox escape on its own; a full host compromise would require chaining with a separate sandbox-escape vulnerability.
Loading attacker-controlled graphics content in Mozilla Firefox can trigger a denial of service in the Graphics component, crashing or hanging the browser or tab. Affected versions are Firefox before 157 and Firefox ESR before 153.4, with fixes available in Firefox 157 and Firefox ESR 153.4. No public exploit code was identified at time of analysis, and SSVC records no active exploitation.
Uninitialized memory reads in the WebGPU component of Mozilla Firefox before 157 (and ESR before 153.4) can cause availability impacts such as browser crashes when a remote attacker convinces a user to load crafted content that exercises WebGPU. Exploitation requires user interaction (UI:R) and the WebGPU code path to be reachable, and the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) limits impact to low availability with no confirmed confidentiality or integrity effect. No public exploit has been identified at time of analysis; the issue is considered low priority and was fixed in Firefox 157 and Firefox ESR 153.4 per Mozilla advisories mfsa2026-100 and mfsa2026-97.
Uninitialized memory handling in Firefox's WebGPU implementation (Graphics: WebGPU component) lets a remote attacker crash or destabilize the browser process when a victim loads a crafted page that exercises WebGPU rendering or compute paths, affecting Firefox versions prior to 157. Per Mozilla's assessed CVSS 3.1 vector (4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), the impact is availability-only, requires user interaction, and requires no authentication; no public exploit code and no confirmed active exploitation were identified at time of analysis. The flaw is fixed in Firefox 157 via advisory MFSA2026-97 (Bugzilla 2057833), and pre-157 installations remain vulnerable until updated.
Uninitialized memory handling in Mozilla Firefox's WebGPU graphics component can crash the browser process, giving a remote attacker a low-impact denial-of-service condition against users running builds prior to Firefox 157. Exploitation requires the victim to actively browse attacker-controlled web content and for that content to drive the vulnerable WebGPU rendering path, so no authentication is required (PR:N) but user interaction is (UI:R); the vendor vector rates impact as availability-only (A:L) with no integrity or confidentiality effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; the issue is considered a genuinely low-priority defect despite Mozilla Firefox being a ubiquitous target.
Denial of service in Mozilla Firefox's Networking component allows a remote attacker to crash or hang the browser by convincing a victim to load attacker-controlled web content - no authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Only availability is impacted: the flaw does not enable code execution, sandbox escape, or data disclosure, and it is fully addressed by upgrading to Firefox 157. At time of analysis there is no public exploit identified, no CISA KEV listing, and the practical risk is comparatively low against the other fixes shipped in the same Firefox 157 batch - the main limiting factor is the UI:R requirement that the user actually load the crafted content.
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Mozilla Firefox before 157 can disclose sensitive process memory to a remote, unauthenticated attacker who persuades a user to load a crafted JavaScript page, because the browser's JavaScript JIT compiler can miscompile code and trigger a type-confusion condition. Exploitation requires user interaction (the victim must visit or be redirected to attacker-controlled content), and impact is limited to confidentiality within the content process; Mozilla fixed the issue in Firefox 157, and no public exploit code has been identified at the time of analysis, with EPSS at 0.15% (4th percentile).
Uninitialized memory handling in Firefox's Audio/Video (media playback) component can crash the browser or leak small amounts of stale process memory when a victim loads attacker-controlled media content on an unpatched build. The issue is reachable by unauthenticated attackers (CVSS PR:N) but requires user interaction (UI:R) to render the malicious content, and the underlying uninitialized-memory read is non-deterministic, so reliable weaponization is unlikely and the realistic outcome is a crash or incidental minor memory exposure rather than targeted data theft. No public exploit code has been identified at time of analysis, and this is a genuinely low-priority issue despite Firefox's ubiquity; vendor patches are available in Firefox 157 and in the ESR branches 153.4, 140.17, and 115.42.
Information disclosure in Mozilla Firefox's Networking: JAR component allows remote, unauthenticated attackers to leak a limited amount of data when a victim loads attacker-controlled web content in an unpatched browser, with no integrity or availability impact. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3), the practical limiter is the required user interaction and the low value/volume of the exposed information. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied, so this is a low-severity client-side disclosure rather than an active-threat priority.
Information disclosure in the Dark Reader browser extension allows an attacker-controlled website to trigger the extension's image-inversion pipeline into fetching an unauthenticated icon-like bitmap from a server on the victim's local network or localhost, leaking limited information about that resource. Affected users are those running Dark Reader in Firefox before 4.9.126, or in other browsers before 4.9.128 - the issue is unauthenticated (CVSS PR:N) but requires the victim to visit a malicious page (UI:R) and depends on a locally reachable server actually listening, with high attack complexity given the need for the resource to sit at a known public-like HTTPS URL and be classified as requiring inversion. Vendor-released patches are available as version 4.9.126 (Firefox) and 4.9.128 (other browsers), and no public exploit code was identified at time of analysis; EPSS-style exploitation likelihood was not provided, and the overall risk is low (CVSS 3.4).
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.
Resource exhaustion in the Security component of Mozilla Firefox before 156 and Firefox ESR before 153.3 lets a remote, unauthenticated attacker cause a denial-of-service against the browser, provided the victim renders attacker-controlled web content in an affected build (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is availability-only: confidentiality and integrity are unaffected and there is no sandbox or scope escape, so at worst the tab or browser becomes unresponsive or crashes. The issue is fixed in Firefox 156 and Firefox ESR 153.3, EPSS is low at 0.14% (4th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in Mozilla Firefox's SVG rendering component allows a remote, unauthenticated attacker to crash or hang the browser process by convincing a victim to load a crafted SVG document. The flaw is an unbounded resource allocation issue (CWE-770) that affects Firefox versions before 156 and Firefox ESR versions before 153.3 on default configurations; exploitation requires user interaction (UI:R), and impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), while EPSS is very low at 0.15% (5th percentile), consistent with a genuine but low-priority availability issue that Firefox's multiprocess architecture typically confines and recovers from.
Information disclosure in the Networking component of Mozilla Firefox allows a remote, unauthenticated attacker to obtain a limited amount of sensitive data when a victim loads attacker-controlled web content; the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Exploitation demands user interaction (UI:R) - the victim must visit or render malicious content in an unpatched build - and the assessed impact is confined to low confidentiality loss, with no code execution, integrity, or availability effect. Risk signals are low: EPSS is just 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Spoofing in Firefox's DOM Navigation component allows attacker-controlled web content to misrepresent navigation or origin information in the browser UI, deceiving users about where they actually are or where a link leads; the flaw affects Firefox versions before 156 and Firefox ESR versions before 153.3. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to actively load the malicious page (UI:R), and the resulting impact is deception-based rather than code execution or bulk data theft. Rated CVSS 5.4 with an EPSS score of 0.14% (4th percentile), this is a moderate-severity UI-misrepresentation issue with no public exploit identified at time of analysis and no evidence of active exploitation (not listed in CISA KEV).
Site isolation bypass in Mozilla Firefox's Reader Mode component allows attacker-controlled web content to escape its intended origin boundary, producing limited confidentiality and integrity impact; it is fixed in Firefox 156 and Firefox ESR 153.3, so all earlier builds on those channels are affected. Exploitation is neither automatic nor trivial: the victim must first open the crafted page in Firefox and then explicitly activate Reader Mode on it (CVSS UI:R), although no authentication or elevated privileges are required (PR:N) and default configurations are exposed. No public exploit code and no confirmed active exploitation have been identified, EPSS is only 0.14% (4th percentile), and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - this is a moderate-severity, low-urgency browser issue that should be handled through a routine browser patch cycle.
Denial of service in the Mozilla Firefox Audio/Video component lets a remote attacker crash or hang the browser by having a victim load crafted media content in a version prior to Firefox 156. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so exploitation is unauthenticated by vector but depends entirely on convincing the target to render attacker-controlled audio or video; impact is limited to availability with no confidentiality or integrity loss. This is a moderate, availability-only issue that is unlikely to be a high priority for most organizations; no public exploit has been identified at time of analysis and EPSS is 0.14% (4th percentile), and the vendor-released fix is Firefox 156.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5.
A denial-of-service condition in the Firefox Printing: Output component lets attacker-controlled content crash or hang the browser when a victim prints or renders it, and Mozilla has fixed the issue in Firefox 158 and Firefox ESR 153.5. Exploitation requires the victim to trigger the printing code path with attacker-supplied content, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H vector: network-delivered and unauthenticated, but gated by mandatory user interaction and limited to availability-only impact with no code execution, data exposure, or persistence. There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none with automatable set to no, so this is a moderate-severity availability bug rather than a top-tier priority.
Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158.
Limited information disclosure and limited integrity tampering in Mozilla Firefox versions prior to 158 arise from a race condition (CWE-362) in the browser's Networking: DNS component, fixed by Mozilla in Firefox 158. Winning the race is non-deterministic and requires the victim to interact with attacker-influenced web content (UI:R) that drives the DNS resolution code path, which is why the high attack complexity (AC:H), the modest CVSS 3.1 base score of 4.2, and CISA's SSVC 'Automatable: no' rating all point to a constrained, opportunistic issue rather than a reliable remote compromise; no public exploit identified at time of analysis, and no KEV listing. Impact is bounded to partial confidentiality and integrity loss with no availability effect, so this is a genuinely low-to-moderate priority issue rather than a high-severity emergency.
Information disclosure in the Mozilla Firefox Storage: IndexedDB component allows attacker-controlled web content to read data it should not be able to access, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires the victim to browse to or interact with a malicious or compromised page that exercises IndexedDB, as reflected by the UI:R flag in the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N vector; the attacker needs no authentication, but no public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none and the issue as non-automatable. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability effect, making this a low-to-moderate severity issue rather than a top remediation priority.
A non-deterministic timing race in Mozilla Firefox's XPCOM component can be won by attacker-controlled web content to yield limited information disclosure and a small integrity impact inside the browser, affecting Firefox builds prior to 158 and Firefox ESR builds prior to 153.5. Exploitation requires the victim to load or interact with attacker-supplied content (UI:R) and to hit a narrow, hard-to-reproduce race window (AC:H); no credentials are required (PR:N), and impact stays at low confidentiality and integrity with no scope change and no availability effect. Risk is low across every signal available: EPSS 0.19% (8th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, while vendor-released patches (Firefox 158 and Firefox ESR 153.5) are already available.
A denial-of-service vulnerability in Mozilla Firefox's WebRTC component can cause the browser to hang or crash when a user opens a malicious web page that triggers resource exhaustion. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes released in Firefox 158 and Firefox ESR 153.5. No public exploit code or active exploitation has been identified, and the CVSS score is 6.5 (medium).
Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158.
Denial of service in Mozilla Firefox's Sync component can be triggered by crafted synced data, causing uncontrolled resource consumption and a browser crash or hang (CWE-400). The issue affects Firefox before the vendor fix in Firefox 158, and the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates it is network-reachable without privileges but requires victim user interaction. No public exploit was identified at time of analysis, and CISA SSVC rates it non-automatable with partial technical impact.
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158.
Information disclosure in the WebRTC: Networking component of Mozilla Firefox lets attacker-controlled web content coax limited data out of the browser, affecting all builds prior to Firefox 158. Exploitation is remote and requires no attacker credentials, but it mandates user interaction (CVSS UI:R) and yields only a partial confidentiality leak (C:L with no integrity or availability impact), which keeps realistic risk low despite the Medium 4.3 score. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', and upgrading to Firefox 158 fully removes the condition.
Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Information disclosure in the Networking: Cache component of Mozilla Firefox allows remote attackers to expose a limited amount of browser-cached data when a victim interacts with attacker-controlled web content; the issue is fixed in Firefox 158, and installations prior to that version are affected. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms this is unauthenticated but requires user interaction, with only low confidentiality impact and no integrity or availability effect. There is no public exploit identified at time of analysis and CISA's SSVC assessment rates exploitation as none and automatable as no, making this a genuinely low-priority issue despite the ubiquity of the browser.
Denial of service in Mozilla Firefox allows a remote attacker to crash or hang the browser by getting a victim to load crafted content processed by the Site Reports component; versions prior to Firefox 158 are affected. Exploitation requires user interaction (the victim must navigate to or open the attacker-controlled content, per the UI:R metric) and no authentication is required (PR:N), but the SSVC assessment marks the issue as non-automatable, and no public exploit code or active exploitation has been identified at time of analysis. Impact is limited to client-side availability (A:H with no confidentiality or integrity loss and no scope change), so the realistic worst case is a crashed or unresponsive browser session for the targeted user.
Information disclosure in Firefox's Networking component allows a remote attacker to expose a limited amount of confidential data through a crafted web page, provided the victim interacts with that content (UI:R); no authentication or user privileges are required (PR:N) and default Firefox configurations are affected. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, and carries a moderate CVSS score of 4.3 with only partial technical impact per CISA's SSVC assessment. There is no indication that the issue is being actively exploited and no public exploit code has been identified at the time of analysis.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free triggered by a race condition in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to achieve limited confidentiality and integrity impact (CVSS 4.2) when a victim loads attacker-controlled web content. The vulnerability affects Firefox builds before 158 and Firefox ESR before 153.5, and is mitigated in practice by a high attack complexity (AC:H) - exploitation depends on winning a non-deterministic timing window, cannot be automated at scale (CISA SSVC Automatable: no), and requires the victim to actively navigate to crafted content (UI:R, PR:N). There is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis; the issue is rated low-to-moderate priority, with independent assessment and vendor data in agreement.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's JavaScript/WebAssembly engine can be triggered when a user loads attacker-controlled web content containing crafted WebAssembly, allowing the attacker to corrupt memory and potentially read or alter data in the browser process. Affected are Firefox releases prior to 158; exploitation is remote and requires no authentication (PR:N) but does require user interaction (UI:R), since the victim must navigate to or render the malicious page, and WebAssembly is enabled by default so no non-default configuration is needed. Impact is scoped to partial confidentiality and integrity loss (C:L/I:L, A:N) rather than confirmed code execution, and no public exploit has been identified at time of analysis; Mozilla addressed the flaw in Firefox 158 and the issue is rated moderate priority rather than an emergency.
Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM: Workers component allows remote attackers to trigger memory corruption and potential information disclosure in Firefox versions before 158 and Firefox ESR before 153.5 when a victim loads attacker-controlled web content that exercises the Workers API. This moderate-severity issue requires user interaction (UI:R) but no authentication (PR:N), and no public exploit code has been identified at time of analysis per CISA SSVC. The assessed vector is AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating limited confidentiality and integrity impact and no availability impact.
Information disclosure in the Networking component of Mozilla Firefox can leak some confidential information to remote, unauthenticated attackers who persuade a victim to load attacker-controlled web content, as successful exploitation depends on user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw affects Firefox builds prior to 158 and Firefox ESR builds prior to 153.5, and its impact is capped at partial confidentiality loss with no integrity or availability effect (CVSS 4.3). There is no public exploit identified at time of analysis, CISA's SSVC framework rates exploitation as 'none' and automatable as 'no', and the issue is not listed in CISA KEV, making this a low-to-moderate priority item best resolved through routine browser updating.
Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158.
Firefox builds prior to version 158 carry a use-after-free in the JavaScript/WebAssembly (WASM) component that lets attacker-supplied web content corrupt memory inside the browser process, producing limited confidentiality and integrity effects (CVSS 5.4, C:L/I:L/A:N, S:U). Exploitation is unauthenticated (PR:N) but requires the victim to actively load attacker-controlled content that reaches the WASM code path (UI:R), so an idle or abandoned browser cannot be attacked and the flaw is not automatable for worm-style mass exploitation (SSVC Automatable=no). Independent signals rate real-world priority as low: CISA SSVC records Exploitation=none, and no public exploit code has been identified at time of analysis, leaving this a moderate-severity memory-safety bug best addressed by routine patching rather than emergency response.
A use-after-free (CWE-416) in Firefox's JavaScript WebAssembly component lets remote, unauthenticated attackers trigger memory corruption with low confidentiality and integrity impact (CVSS 5.4) when a victim loads attacker-supplied WASM/JS content in any build prior to Firefox 158. Exploitation is constrained by a mandatory user-interaction requirement - the target must open or render a malicious page or document - and by the absence of any availability impact, indicating a bounded disclosure/corruption primitive rather than full system compromise. CISA's SSVC evaluation rates exploitation as none and automatable as no, and no public exploit code has been identified at time of analysis; Mozilla fixed the flaw in Firefox 158.
Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158.
Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Information disclosure in Mozilla Firefox's built-in PDF Viewer (pdf.js) allows a remote, unauthenticated attacker to expose limited browser-context data by convincing a victim to open and render a crafted PDF document; the attack succeeds only through the required user interaction of loading the malicious file. The issue is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) with scope-unchanged, confidentiality-only impact, and is tracked as EUVD-2026-98504 under CWE-200; there is no public exploit identified at time of analysis and CISA SSVC records no exploitation activity. Vendor-released patches are available in Firefox 158 and Firefox ESR 153.5, and the affected population is Firefox releases prior to 158 and Firefox ESR prior to 153.5.
A use-after-free in Mozilla Firefox's Storage Bucket File System allows an unauthenticated remote attacker to corrupt memory or disclose information by convincing a victim to load crafted web content that exercises the Origin Private File System (OPFS) API. The flaw affects Firefox versions prior to 158 and Firefox ESR versions prior to 153.5, and exploitation requires user interaction while being complicated by heap state and timing, resulting in only low confidentiality, integrity, and availability impact. No public exploit code has been identified, and CISA's SSVC assessment rates exploitation as none with partial technical impact, making this a moderate-severity, low-priority issue despite the underlying memory-corruption class.
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
A use-after-free in Mozilla Firefox's Audio/Video Playback component allows unauthenticated remote attackers to cause partial memory disclosure and memory corruption when a victim loads crafted media content, affecting Firefox versions prior to 158 and Firefox ESR versions prior to 153.5. Exploitation requires user interaction - the victim must visit a malicious or compromised page whose crafted media is processed by the playback pipeline - so this is best suited to targeted or opportunistic drive-by delivery rather than automated mass exploitation (CISA SSVC Automatable=no, Technical Impact=partial). Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5, and no public exploit code or confirmed active exploitation was identified at time of analysis; impact is bounded by the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) with no availability impact and no confirmed path to full code execution from the available data.
Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM Animation component allows remote attackers to corrupt memory by getting a victim to render attacker-controlled web content in a browser build prior to Firefox 158. The flaw is unauthenticated (PR:N) but requires user interaction (UI:R), since the victim must visit or render the crafted page and let it exercise animation handling; there is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation=none with Automatable=no, so mass or automated exploitation is not expected. Impact is capped at partial confidentiality and integrity loss (CVSS 5.4, C:L/I:L/A:N), typically leaking data from freed memory or corrupting it, rather than a guaranteed full compromise.
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, yielding limited confidentiality and integrity impact. Affected versions are Firefox before 158 and Firefox ESR before 153.5, with fixes available in Firefox 158 and Firefox ESR 153.5. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none, automatable as no, and technical impact as partial, consistent with a moderate-severity memory-safety issue rather than reliable code execution.
An integer overflow (CWE-190) in Firefox's Layout: Text and Fonts component can be triggered when a user renders attacker-controlled web content containing malformed text or font data, potentially causing memory-safety corruption in the browser process. The vulnerability affects Firefox builds prior to version 158 and Firefox ESR builds prior to 153.5, is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R), but requires the victim to load the crafted page, and its assessed impact is bounded to low confidentiality and integrity effects with no availability impact (score 5.4). Exploitation is not confirmed in the field: there is no CISA KEV listing and no public exploit identified at time of analysis, and the EPSS score of 0.15% (4th percentile) indicates a low predicted likelihood of exploitation activity.
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Use-after-free in Firefox's DOM WebIDL bindings (CVE-2026-109717) lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled or attacker-influenced web content that reaches the affected binding code path; the CVSS UI:R metric means the user must visit a malicious or compromised page, and no special browser configuration is required. Impact is bounded to low confidentiality and low integrity with no availability impact per the vendor-rated vector, and there is no public exploit identified at time of analysis - CISA's SSVC records Exploitation: none, Automatable: no, and Technical Impact: partial. The flaw is fixed in Firefox 158 and Firefox ESR 153.5, making this a routine browser update-cycle item rather than an emergency patch.
Incorrect boundary conditions in Mozilla Firefox's Layout component prior to version 158 allow remote, unauthenticated attackers to cause low-severity confidentiality and integrity impact by enticing a user to render attacker-controlled web content; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms that user interaction is mandatory and that availability is not affected. No public exploit code has been identified and there is no CISA KEV entry at time of analysis, while the EPSS score is low at 0.15% (4th percentile), consistent with a moderate, not urgent, priority. The flaw is a memory-buffer boundary error (CWE-119) fixed in Firefox 158.
Use-after-free in Mozilla Firefox's Crash Reporting component lets a remote, unauthenticated attacker corrupt memory when a victim loads attacker-controlled web content, producing the low confidentiality and integrity impact captured by the assessed CVSS 5.4 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). Only Firefox builds before 158 and Firefox ESR builds before 153.5 are affected, and the flaw is fixed in those releases. There is no public exploit identified at time of analysis (SSVC exploitation: none; not automatable), and the mandatory user-interaction requirement keeps realistic risk moderate, making this a normal-patch-cycle item rather than an emergency.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D component (CWE-416) allows a remote, unauthenticated attacker to corrupt memory and potentially disclose information when a victim loads attacker-controlled web content, requiring user interaction (UI:R) but no credentials (PR:N). The flaw affects Firefox builds before 158 and Firefox ESR builds before 153.5 and carries a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), with partial confidentiality and integrity impact but no availability impact. No public exploit code or active exploitation has been identified at time of analysis, and CISA's SSVC assessment rates Exploitation as 'none' and Automatable as 'no'.
Use-after-free in Mozilla Firefox's DOM Streams component allows a remote, unauthenticated attacker to corrupt memory in the content process when a victim renders attacker-controlled web content, yielding limited information disclosure and limited data integrity impact (CVSS 5.4, C:L/I:L/A:N). All builds prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are affected, and exploitation is gated by mandatory user interaction (UI:R) plus the heap-timing precision needed to win a use-after-free race. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and CISA's SSVC assessment records Exploitation: none with Automatable: no, so this is not an active-exploitation priority despite the memory-corruption class.
Use-after-free in Mozilla Firefox's JavaScript JIT compiler allows remote, unauthenticated attackers to corrupt browser memory by enticing a victim into loading attacker-controlled web content, producing limited information disclosure and limited integrity impact with no availability effect (CVSS 5.4, UI:R, S:U). Exploitation requires the target to visit or be redirected to a malicious page while JIT compilation is enabled, which is the default configuration, and the impact stays confined to the browser process. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and vendor-released fixes ship in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Use-after-free in Mozilla Firefox's DOM Animation component lets a remote attacker corrupt memory by having a victim load attacker-controlled web content, yielding limited information disclosure and limited integrity impact rather than code execution. Exploitation requires user interaction (UI:R) but no authentication and no non-default browser configuration, so default installations below the fixed builds are affected; the attack is not automatable per CISA SSVC (Automatable=no, Exploitation=none), and no public exploit identified at time of analysis. Vendor-released patch: Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 - only versions below those builds remain exposed.
Use-after-free in Mozilla Firefox's Audio/Video component (CWE-416) permits unauthenticated remote attackers to trigger memory corruption, leading to limited information disclosure or low-integrity effects (CVSS 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), when a victim loads crafted media in an unpatched browser. Affected versions are Firefox before 158 and Firefox ESR before 115.43 and 153.5; no public exploit code has been identified at time of analysis, and CISA's SSVC assessment notes exploitation has not been observed and the flaw is not reliably automatable. The required user interaction and partial impact keep real-world urgency low, making this a moderate patch-management item rather than an emergency.
Use-after-free in Mozilla Firefox's SVG rendering component allows remote attackers to cause memory corruption leading to partial information disclosure or limited integrity impact when a user opens a crafted SVG document. Affected versions include Firefox prior to 158 and Firefox ESR prior to 115.43 and 153.5. Exploitation requires user interaction (UI:R), is not automatable, and no public exploit code has been identified; vendor patches are available.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component allows remote attackers to trigger memory corruption when a victim loads attacker-controlled web content, requiring user interaction (UI:R) with no authentication or prior privileges needed (PR:N). Any default Firefox installation that browses to a malicious or compromised page is in scope, but the impact ceiling is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N), and Mozilla has already shipped fixes in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. There is no public exploit identified at time of analysis, exploitation is not automatable per SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), and this is a moderate-severity, low-real-world-priority issue despite belonging to the memory-corruption class (CWE-416).
Use-after-free in Mozilla Firefox's Graphics: CanvasWebGL component - triggered by a race condition (CWE-362) in the WebGL/canvas rendering path - allows a remote attacker who convinces a victim to load crafted web content to win a non-deterministic timing window and achieve limited information disclosure or limited data modification (CVSS 3.1: 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Only unpatched installations below Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are exposed; the issues were remediated in the Mozilla Foundation Security Advisories mfsa2026-106, mfsa2026-107, and mfsa2026-108. Exploitation is not observed by CISA's SSVC assessment (Exploitation: none) and no public exploit code has been identified at time of analysis; the high attack-complexity rating, mandatory user interaction, and lack of availability or code-execution impact keep this a genuinely low-priority memory-safety issue.
Use-after-free in Mozilla Firefox's XML component can be triggered by unauthenticated remote attackers when a victim loads attacker-controlled web content containing crafted XML, leading to limited information disclosure or integrity impact. This moderate-severity flaw (CVSS 5.4) requires user interaction (UI:R) and does not allow full code execution or denial of service per the assessed vector; no public exploit has been identified and CISA SSVC rates exploitation as none. The issue is fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Memory-safety flaws in Mozilla Firefox's Graphics: Text component allow remote attackers who convince a user to load crafted web content to trigger a use-after-free, potentially exposing or corrupting data in the browser's process memory. Impact is bounded to limited confidentiality and integrity effects with no availability loss (CVSS 5.4, C:L/I:L/A:N), and exploitation is limited to unpatched builds (versions before Firefox 158, ESR before 115.43, and ESR before 153.5) that render the malicious payload during normal browsing. No public exploit code has been identified at time of analysis and the CISA SSVC assessment rates exploitation as 'none', making this a moderate memory-safety fix to fold into routine browser patching rather than an emergency action.
Use-after-free in Mozilla Firefox's Storage: IndexedDB component (CWE-416) allows a remote, unauthenticated attacker to corrupt browser memory when a victim loads attacker-controlled web content that drives the IndexedDB API, yielding partial confidentiality and integrity impact (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The mandatory user interaction (UI:R) is the controlling barrier: the flaw cannot be triggered against a passive or idle target, and IndexedDB is enabled by default so no special configuration is required once a victim visits or interacts with a malicious or compromised page. Only Firefox builds prior to 158 and ESR builds prior to 115.43 and 153.5 are affected; no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' with non-automatable, partial technical impact, and the independent assessment keeps this at low real-world priority rather than an urgent threat.
Information disclosure in Mozilla Firefox for iOS (releases prior to 157.1) can leak saved credentials to a different origin: if a cross-origin navigation occurs while the saved-login/autofill UI is open, the browser may still fill the stored username and password into the newly loaded page, because the autofill action was never bound to the page that originally requested it and was not re-validated when the origin changed (CWE-346). Exploitation requires the user to have triggered the login prompt (UI:R) and depends on a narrow race between that prompt being open and the navigation occurring, so our independent assessment rates it as a network-reachable but high-complexity, unauthenticated issue with confidentiality-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, CISA's SSVC framework records exploitation as 'none' and the issue as not automatable, and Mozilla shipped the fix in Firefox for iOS 157.1.
A heap buffer overflow in Mozilla Thunderbird occurs when a user opens an email message of 2GB or larger in size, allowing the overflowing write to corrupt memory and crash the client. The assessed CVSS vector (6.1, AV:L/AC:L/PR:N/UI:R) shows the attack is local and requires the victim to actively open the oversized message, with impact limited to availability (crash) and low integrity, and no confidentiality loss; no public exploit code or confirmed active exploitation (CISA KEV) is associated with this issue, and EPSS is low at 0.19% (8th percentile). The flaw is fixed in Thunderbird 157, and the real-world risk is further constrained because mail servers and gateways typically reject or truncate messages of that size before they ever reach the client.
Denial-of-service in Mozilla Firefox's Storage: StorageManager component allows an unauthenticated remote attacker to crash or hang the browser by persuading a victim to render attacker-controlled web content, requiring user interaction and no special privileges. The flaw is a CWE-770 resource-exhaustion issue fixed in Firefox 157 and Firefox ESR 153.4; all earlier Firefox versions are affected, and there is no public exploit identified at time of analysis. Exploitation is not automatable per CISA SSVC, and the impact is availability-only with no data compromise, making real-world urgency low once patched.
Firefox for Android before 157 can be tricked by a malicious web page into misrepresenting download information in its Downloads component, a spoofing flaw rated CVSS 5.4 (Medium, AV:N/AC:L/PR:N/UI:R). Only the Android builds are affected - desktop Firefox is not implicated - and Mozilla shipped the fix in Firefox 157. Exploitation requires the victim to visit an attacker-controlled page and interact with a download prompt, no public exploit code has been identified at time of analysis, and CISA SSVC records exploitation as 'none', so this is a low-to-moderate priority fix rather than an urgent one.
A spoofing flaw in Firefox's Networking: HTTP component allows a malicious web page to misrepresent UI content to the user, potentially tricking them into trusting a spoofed page element. The issue affects Firefox versions prior to ESR 153.4 and Firefox 157; it requires the victim to actively load or interact with attacker-controlled web content (UI:R), means no authentication on the attacker's side (PR:N), and yields only limited confidentiality impact. No public exploit code has been identified at time of analysis, CISA KEV does not list it, and SSVC scores exploitation as 'none' with automatable 'no' - overall risk is consistently LOW.
Cross-origin information disclosure in Mozilla Firefox's panning and zooming component lets attacker-controlled web content defeat the browser's site-isolation boundary and leak a limited amount of data from another origin. The issue affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires the victim to load a malicious page (UI:R) with no authentication or special privileges (PR:N); impact is confined to confidentiality (C:L) with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.16% (4th percentile) indicates very low predicted exploitation activity, making this a defense-in-depth fix rather than an urgent threat.
Mozilla Firefox versions prior to 157 contain a flaw in the WebAssembly component that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted webpage, resulting in limited information disclosure and integrity impact. No public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world exploitation likelihood. Because the bug is scope-unchanged, it does not grant sandbox escape on its own; a full host compromise would require chaining with a separate sandbox-escape vulnerability.
Loading attacker-controlled graphics content in Mozilla Firefox can trigger a denial of service in the Graphics component, crashing or hanging the browser or tab. Affected versions are Firefox before 157 and Firefox ESR before 153.4, with fixes available in Firefox 157 and Firefox ESR 153.4. No public exploit code was identified at time of analysis, and SSVC records no active exploitation.
Uninitialized memory reads in the WebGPU component of Mozilla Firefox before 157 (and ESR before 153.4) can cause availability impacts such as browser crashes when a remote attacker convinces a user to load crafted content that exercises WebGPU. Exploitation requires user interaction (UI:R) and the WebGPU code path to be reachable, and the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) limits impact to low availability with no confirmed confidentiality or integrity effect. No public exploit has been identified at time of analysis; the issue is considered low priority and was fixed in Firefox 157 and Firefox ESR 153.4 per Mozilla advisories mfsa2026-100 and mfsa2026-97.
Uninitialized memory handling in Firefox's WebGPU implementation (Graphics: WebGPU component) lets a remote attacker crash or destabilize the browser process when a victim loads a crafted page that exercises WebGPU rendering or compute paths, affecting Firefox versions prior to 157. Per Mozilla's assessed CVSS 3.1 vector (4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), the impact is availability-only, requires user interaction, and requires no authentication; no public exploit code and no confirmed active exploitation were identified at time of analysis. The flaw is fixed in Firefox 157 via advisory MFSA2026-97 (Bugzilla 2057833), and pre-157 installations remain vulnerable until updated.
Uninitialized memory handling in Mozilla Firefox's WebGPU graphics component can crash the browser process, giving a remote attacker a low-impact denial-of-service condition against users running builds prior to Firefox 157. Exploitation requires the victim to actively browse attacker-controlled web content and for that content to drive the vulnerable WebGPU rendering path, so no authentication is required (PR:N) but user interaction is (UI:R); the vendor vector rates impact as availability-only (A:L) with no integrity or confidentiality effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; the issue is considered a genuinely low-priority defect despite Mozilla Firefox being a ubiquitous target.
Denial of service in Mozilla Firefox's Networking component allows a remote attacker to crash or hang the browser by convincing a victim to load attacker-controlled web content - no authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Only availability is impacted: the flaw does not enable code execution, sandbox escape, or data disclosure, and it is fully addressed by upgrading to Firefox 157. At time of analysis there is no public exploit identified, no CISA KEV listing, and the practical risk is comparatively low against the other fixes shipped in the same Firefox 157 batch - the main limiting factor is the UI:R requirement that the user actually load the crafted content.
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Mozilla Firefox before 157 can disclose sensitive process memory to a remote, unauthenticated attacker who persuades a user to load a crafted JavaScript page, because the browser's JavaScript JIT compiler can miscompile code and trigger a type-confusion condition. Exploitation requires user interaction (the victim must visit or be redirected to attacker-controlled content), and impact is limited to confidentiality within the content process; Mozilla fixed the issue in Firefox 157, and no public exploit code has been identified at the time of analysis, with EPSS at 0.15% (4th percentile).
Uninitialized memory handling in Firefox's Audio/Video (media playback) component can crash the browser or leak small amounts of stale process memory when a victim loads attacker-controlled media content on an unpatched build. The issue is reachable by unauthenticated attackers (CVSS PR:N) but requires user interaction (UI:R) to render the malicious content, and the underlying uninitialized-memory read is non-deterministic, so reliable weaponization is unlikely and the realistic outcome is a crash or incidental minor memory exposure rather than targeted data theft. No public exploit code has been identified at time of analysis, and this is a genuinely low-priority issue despite Firefox's ubiquity; vendor patches are available in Firefox 157 and in the ESR branches 153.4, 140.17, and 115.42.
Information disclosure in Mozilla Firefox's Networking: JAR component allows remote, unauthenticated attackers to leak a limited amount of data when a victim loads attacker-controlled web content in an unpatched browser, with no integrity or availability impact. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3), the practical limiter is the required user interaction and the low value/volume of the exposed information. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied, so this is a low-severity client-side disclosure rather than an active-threat priority.
Information disclosure in the Dark Reader browser extension allows an attacker-controlled website to trigger the extension's image-inversion pipeline into fetching an unauthenticated icon-like bitmap from a server on the victim's local network or localhost, leaking limited information about that resource. Affected users are those running Dark Reader in Firefox before 4.9.126, or in other browsers before 4.9.128 - the issue is unauthenticated (CVSS PR:N) but requires the victim to visit a malicious page (UI:R) and depends on a locally reachable server actually listening, with high attack complexity given the need for the resource to sit at a known public-like HTTPS URL and be classified as requiring inversion. Vendor-released patches are available as version 4.9.126 (Firefox) and 4.9.128 (other browsers), and no public exploit code was identified at time of analysis; EPSS-style exploitation likelihood was not provided, and the overall risk is low (CVSS 3.4).
The rhwp Chrome and Firefox extensions prior to 0.2.4 (with the rhwp core library prior to 0.7.15) ship a service-worker message path that never validates the message sender, the URL scheme, or the destination address, so any untrusted web page the victim visits can coerce the extension's fetch-file and extract-thumbnail handlers into requesting localhost, loopback, link-local, private-IP, or internal-hostname resources. This gives an attacker internal-resource existence and port probing plus extension presence/version fingerprinting, and when the targeted HWP/HWPX document contains an extractable PrvImage the preview is returned as a data URI that page script can read directly from the DOM. Exploitation requires the extension to be installed and enabled and the user to visit an attacker-controlled page; there is no confirmed active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis, with impact limited to low-value confidentiality loss. Vendor-released fixes are available in rhwp 0.7.15 and extension 0.2.4.
Resource exhaustion in the Security component of Mozilla Firefox before 156 and Firefox ESR before 153.3 lets a remote, unauthenticated attacker cause a denial-of-service against the browser, provided the victim renders attacker-controlled web content in an affected build (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Impact is availability-only: confidentiality and integrity are unaffected and there is no sandbox or scope escape, so at worst the tab or browser becomes unresponsive or crashes. The issue is fixed in Firefox 156 and Firefox ESR 153.3, EPSS is low at 0.14% (4th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in Mozilla Firefox's SVG rendering component allows a remote, unauthenticated attacker to crash or hang the browser process by convincing a victim to load a crafted SVG document. The flaw is an unbounded resource allocation issue (CWE-770) that affects Firefox versions before 156 and Firefox ESR versions before 153.3 on default configurations; exploitation requires user interaction (UI:R), and impact is limited to availability with no confidentiality or integrity effect. No public exploit code has been identified and the flaw is not confirmed as actively exploited (CISA KEV), while EPSS is very low at 0.15% (5th percentile), consistent with a genuine but low-priority availability issue that Firefox's multiprocess architecture typically confines and recovers from.
Information disclosure in the Networking component of Mozilla Firefox allows a remote, unauthenticated attacker to obtain a limited amount of sensitive data when a victim loads attacker-controlled web content; the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Exploitation demands user interaction (UI:R) - the victim must visit or render malicious content in an unpatched build - and the assessed impact is confined to low confidentiality loss, with no code execution, integrity, or availability effect. Risk signals are low: EPSS is just 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Spoofing in Firefox's DOM Navigation component allows attacker-controlled web content to misrepresent navigation or origin information in the browser UI, deceiving users about where they actually are or where a link leads; the flaw affects Firefox versions before 156 and Firefox ESR versions before 153.3. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to actively load the malicious page (UI:R), and the resulting impact is deception-based rather than code execution or bulk data theft. Rated CVSS 5.4 with an EPSS score of 0.14% (4th percentile), this is a moderate-severity UI-misrepresentation issue with no public exploit identified at time of analysis and no evidence of active exploitation (not listed in CISA KEV).
Site isolation bypass in Mozilla Firefox's Reader Mode component allows attacker-controlled web content to escape its intended origin boundary, producing limited confidentiality and integrity impact; it is fixed in Firefox 156 and Firefox ESR 153.3, so all earlier builds on those channels are affected. Exploitation is neither automatic nor trivial: the victim must first open the crafted page in Firefox and then explicitly activate Reader Mode on it (CVSS UI:R), although no authentication or elevated privileges are required (PR:N) and default configurations are exposed. No public exploit code and no confirmed active exploitation have been identified, EPSS is only 0.14% (4th percentile), and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - this is a moderate-severity, low-urgency browser issue that should be handled through a routine browser patch cycle.
Denial of service in the Mozilla Firefox Audio/Video component lets a remote attacker crash or hang the browser by having a victim load crafted media content in a version prior to Firefox 156. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), so exploitation is unauthenticated by vector but depends entirely on convincing the target to render attacker-controlled audio or video; impact is limited to availability with no confidentiality or integrity loss. This is a moderate, availability-only issue that is unlikely to be a high priority for most organizations; no public exploit has been identified at time of analysis and EPSS is 0.14% (4th percentile), and the vendor-released fix is Firefox 156.