apk package

wolfi/firefox

pkg:apk/wolfi/firefox

Vulnerabilities (650)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-18809	Med	6.5	< 153.0.4-r0	153.0.4-r0	Aug 4, 2026	Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
CVE-2026-16412	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR
CVE-2026-16411	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16410	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16409	Hig	7.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16408	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16407	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16406	Cri	9.1	< 153.0-r0	153.0-r0	Jul 21, 2026	Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16405	Hig	7.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16403	Med	6.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16402	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16401	Hig	8.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16400	Hig	7.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16399	Hig	7.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16398	Hig	7.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16397	Med	6.5	< 153.0-r0	153.0-r0	Jul 21, 2026	Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
CVE-2026-16396	Hig	8.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16395	Cri	9.8	< 153.0-r0	153.0-r0	Jul 21, 2026	Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16394	Cri	9.1	< 153.0-r0	153.0-r0	Jul 21, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16393	Cri	9.1	< 153.0-r0	153.0-r0	Jul 21, 2026	Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-18809MedAug 4, 2026
affected < 153.0.4-r0fixed 153.0.4-r0
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
CVE-2026-16412CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR
CVE-2026-16411CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Memory safety bugs present in Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16410CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16409HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16408CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16407CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16406CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16405HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16403MedJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16402CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16401HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16400HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16399HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16398HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16397MedJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
CVE-2026-16396HigJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16395CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16394CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16393CriJul 21, 2026
affected < 153.0-r0fixed 153.0-r0
Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

Page 1 of 33