Firefox Esr
CVEs (299)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-109777 | Med | 0.28 | 4.3 | 0.00 | Oct 13, 2026 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-109767 | Med | 0.28 | 4.3 | 0.00 | Oct 13, 2026 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-109751 | Med | 0.28 | 4.3 | 0.00 | Oct 13, 2026 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-109742 | Med | 0.28 | 4.3 | 0.00 | Oct 13, 2026 | Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-96869 | Med | 0.28 | 4.3 | 0.00 | Sep 29, 2026 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | ||
| CVE-2026-100806 | Med | 0.28 | 4.3 | 0.00 | Sep 29, 2026 | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | ||
| CVE-2026-100783 | Med | 0.28 | 4.3 | 0.00 | Sep 29, 2026 | Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||
| CVE-2026-100766 | Med | 0.28 | 4.3 | 0.00 | Sep 29, 2026 | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||
| CVE-2026-92070 | Med | 0.28 | 4.3 | 0.00 | Sep 15, 2026 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||
| CVE-2026-109776 | Med | 0.27 | 4.2 | 0.00 | Oct 13, 2026 | Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-109765 | Med | 0.27 | 4.2 | 0.00 | Oct 13, 2026 | Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2026-109719 | Med | 0.27 | 4.2 | 0.00 | Oct 13, 2026 | Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||
| CVE-2025-0240 | Med | 0.26 | 4.0 | 0.01 | Jan 7, 2025 | Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6. | ||
| CVE-2025-6425 | Med | 0.21 | 4.3 | 0.00 | Jun 24, 2025 | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR… | ||
| CVE-2026-118027 | 0.00 | — | 0.00 | Oct 27, 2026 | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | |||
| CVE-2026-118002 | 0.00 | — | 0.00 | Oct 27, 2026 | Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | |||
| CVE-2026-117999 | 0.00 | — | 0.00 | Oct 27, 2026 | Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | |||
| CVE-2026-117997 | 0.00 | — | 0.00 | Oct 27, 2026 | Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | |||
| CVE-2026-117996 | 0.00 | — | 0.00 | Oct 27, 2026 | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | |||
| CVE-2026-117991 | 0.00 | — | 0.00 | Oct 27, 2026 | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. |
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
- risk 0.28cvss 4.3epss 0.00
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
- risk 0.28cvss 4.3epss 0.00
Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
- risk 0.28cvss 4.3epss 0.00
Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
- risk 0.27cvss 4.2epss 0.00
Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.27cvss 4.2epss 0.00
Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.27cvss 4.2epss 0.00
Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
- risk 0.26cvss 4.0epss 0.01
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
- risk 0.21cvss 4.3epss 0.00
An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR…
- CVE-2026-118027Oct 27, 2026risk 0.00cvss —epss 0.00
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
- CVE-2026-118002Oct 27, 2026risk 0.00cvss —epss 0.00
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117999Oct 27, 2026risk 0.00cvss —epss 0.00
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117997Oct 27, 2026risk 0.00cvss —epss 0.00
Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117996Oct 27, 2026risk 0.00cvss —epss 0.00
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
- CVE-2026-117991Oct 27, 2026risk 0.00cvss —epss 0.00
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Page 11 of 15