apk package

wolfi/firefox

pkg:apk/wolfi/firefox

Vulnerabilities (685)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-8390	Hig	7.3	< 150.0.3-r0	150.0.3-r0	May 12, 2026	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
CVE-2026-8389	Hig	8.8	< 150.0.3-r0	150.0.3-r0	May 12, 2026	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
CVE-2026-8388	Med	6.5	< 150.0.3-r0	150.0.3-r0	May 12, 2026	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8094	Cri	9.8	< 140.10.2-r0	140.10.2-r0	May 7, 2026	Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
CVE-2026-8093	Hig	8.1	< 150.0.2-r0	150.0.2-r0	May 7, 2026	Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.
CVE-2026-8092	Hig	8.1	< 140.10.2-r0	140.10.2-r0	May 7, 2026	Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed
CVE-2026-8091	Cri	9.8	< 140.10.1-r0	140.10.1-r0	May 7, 2026	Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
CVE-2026-8090	Hig	7.3	< 140.10.2-r0	140.10.2-r0	May 7, 2026	Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.
CVE-2026-7324	Hig	7.3	< 150.0.1-r0	150.0.1-r0	Apr 28, 2026	Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1
CVE-2026-7323	Hig	7.3	< 140.10.1-r0	140.10.1-r0	Apr 28, 2026	Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7322	Hig	7.3	< 140.10.1-r0	140.10.1-r0	Apr 28, 2026	Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7321	Cri	9.6	< 140.10.1-r0	140.10.1-r0	Apr 28, 2026	Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
CVE-2026-7320	Hig	7.5	< 140.10.1-r0	140.10.1-r0	Apr 28, 2026	Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
CVE-2026-6786	Hig	7.5	< 140.10-r0	140.10-r0	Apr 26, 2026	Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2026-6785	Hig	7.5	< 140.10-r0	140.10-r0	Apr 26, 2026	Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod
CVE-2026-6784	Hig	7.5	< 150-r0	150-r0	Apr 21, 2026	Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150 and Thunderbird
CVE-2026-6783	Med	5.3	< 150-r0	150-r0	Apr 21, 2026	Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6782	Hig	7.5	< 150-r0	150-r0	Apr 21, 2026	Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6781	Hig	7.5	< 150-r0	150-r0	Apr 21, 2026	Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6780	Hig	7.5	< 150-r0	150-r0	Apr 21, 2026	Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-8390HigMay 12, 2026
affected < 150.0.3-r0fixed 150.0.3-r0
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.
CVE-2026-8389HigMay 12, 2026
affected < 150.0.3-r0fixed 150.0.3-r0
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
CVE-2026-8388MedMay 12, 2026
affected < 150.0.3-r0fixed 150.0.3-r0
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8094CriMay 7, 2026
affected < 140.10.2-r0fixed 140.10.2-r0
Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
CVE-2026-8093HigMay 7, 2026
affected < 150.0.2-r0fixed 150.0.2-r0
Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.
CVE-2026-8092HigMay 7, 2026
affected < 140.10.2-r0fixed 140.10.2-r0
Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed
CVE-2026-8091CriMay 7, 2026
affected < 140.10.1-r0fixed 140.10.1-r0
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
CVE-2026-8090HigMay 7, 2026
affected < 140.10.2-r0fixed 140.10.2-r0
Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.
CVE-2026-7324HigApr 28, 2026
affected < 150.0.1-r0fixed 150.0.1-r0
Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1
CVE-2026-7323HigApr 28, 2026
affected < 140.10.1-r0fixed 140.10.1-r0
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7322HigApr 28, 2026
affected < 140.10.1-r0fixed 140.10.1-r0
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 15
CVE-2026-7321CriApr 28, 2026
affected < 140.10.1-r0fixed 140.10.1-r0
Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, and Thunderbird 140.10.1.
CVE-2026-7320HigApr 28, 2026
affected < 140.10.1-r0fixed 140.10.1-r0
Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
CVE-2026-6786HigApr 26, 2026
affected < 140.10-r0fixed 140.10-r0
Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerabilit
CVE-2026-6785HigApr 26, 2026
affected < 140.10-r0fixed 140.10-r0
Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary cod
CVE-2026-6784HigApr 21, 2026
affected < 150-r0fixed 150-r0
Memory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150 and Thunderbird
CVE-2026-6783MedApr 21, 2026
affected < 150-r0fixed 150-r0
Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6782HigApr 21, 2026
affected < 150-r0fixed 150-r0
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6781HigApr 21, 2026
affected < 150-r0fixed 150-r0
Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.
CVE-2026-6780HigApr 21, 2026
affected < 150-r0fixed 150-r0
Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Page 10 of 35