apk package

wolfi/firefox

pkg:apk/wolfi/firefox

Vulnerabilities (650)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-8967	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8966	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8965	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8964	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8963	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8962	Hig	8.1	< 140.11-r0	140.11-r0	May 19, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8961	Med	6.5	< 140.11-r0	140.11-r0	May 19, 2026	Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8960	Hig	7.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8959	Cri	9.6	< 140.11-r0	140.11-r0	May 19, 2026	Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8958	Hig	8.6	< 140.11-r0	140.11-r0	May 19, 2026	Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957	Hig	8.8	< 140.11-r0	140.11-r0	May 19, 2026	Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956	Cri	9.8	< 140.11-r0	140.11-r0	May 19, 2026	Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8955	Hig	8.8	< 140.11-r0	140.11-r0	May 19, 2026	Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954	Hig	7.5	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953	Cri	9.6	< 151.0.1-r0	151.0.1-r0	May 19, 2026	Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8952	Hig	8.8	< 151-r0	151-r0	May 19, 2026	Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8951	Med	6.5	< 151-r0	151-r0	May 19, 2026	Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950	Cri	9.3	< 140.11-r0	140.11-r0	May 19, 2026	Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8949	Hig	7.5	< 140.11-r0	140.11-r0	May 19, 2026	Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948	Cri	9.1	< 151-r0	151-r0	May 19, 2026	Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8967HigMay 19, 2026
affected < 151-r0fixed 151-r0
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8966HigMay 19, 2026
affected < 151-r0fixed 151-r0
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8965HigMay 19, 2026
affected < 151-r0fixed 151-r0
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8964HigMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8963HigMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8962HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8961MedMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8960HigMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8959CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8958HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8955HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954HigMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953CriMay 19, 2026
affected < 151.0.1-r0fixed 151.0.1-r0
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8952HigMay 19, 2026
affected < 151-r0fixed 151-r0
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8951MedMay 19, 2026
affected < 151-r0fixed 151-r0
Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950CriMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8949HigMay 19, 2026
affected < 140.11-r0fixed 140.11-r0
Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948CriMay 19, 2026
affected < 151-r0fixed 151-r0
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Page 7 of 33