apk package

chainguard/firefox

pkg:apk/chainguard/firefox

Vulnerabilities (490)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-8972	Hig	8.8	< 151-r0	151-r0	May 19, 2026	Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8971	Med	6.5	< 151-r0	151-r0	May 19, 2026	Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8970	Hig	8.8	< 140.11-r0	140.11-r0	May 19, 2026	Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8969	Hig	8.1	< 151-r0	151-r0	May 19, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8968	Hig	7.5	< 140.11-r0	140.11-r0	May 19, 2026	Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8966	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8962	Hig	8.1	< 140.11-r0	140.11-r0	May 19, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8961	Med	6.5	< 140.11-r0	140.11-r0	May 19, 2026	Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8960	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8959	Cri	9.6	< 140.11-r0	140.11-r0	May 19, 2026	Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8958	Hig	8.6	< 140.11-r0	140.11-r0	May 19, 2026	Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957	Hig	8.8	< 140.11-r0	140.11-r0	May 19, 2026	Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956	Cri	9.8	< 140.11-r0	140.11-r0	May 19, 2026	Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954	Hig	7.5	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953	Cri	9.6	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8951	Med	6.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950	Cri	9.3	< 140.11-r0	140.11-r0	May 19, 2026	Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948	Cri	9.1	< 151-r0	151-r0	May 19, 2026	Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8947	Hig	7.3	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946	Hig	7.5	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-8972HigMay 19, 2026
affected < 151-r0fixed 151-r0
Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8971MedMay 19, 2026
affected < 151-r0fixed 151-r0
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8970HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8969HigMay 19, 2026
affected < 151-r0fixed 151-r0
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8968HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8966HigMay 19, 2026
affected < 151-r0fixed 151-r0
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8962HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8961MedMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8960HigMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8959CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8958HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954HigMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953CriMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8951MedMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948CriMay 19, 2026
affected < 151-r0fixed 151-r0
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8947HigMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946HigMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Page 3 of 25