Threat database

CVE-2026-16351 is a critical use-after-free vulnerability in the DOM Navigation component of Mozilla Firefox that allows sandbox escape. This vulnerability affects Firefox versions prior to 153, Firefox ESR versions prior to 115.38 and 140.13, and Thunderbird versions prior to 153 and 140.13. It was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of disclosure. Mozilla has published official security advisories detailing the fixes.

CVE-2026-16362 is a high-severity use-after-free vulnerability in the WebRTC Audio/Video component of Mozilla Firefox. This flaw allows potential memory corruption leading to high impact on confidentiality, integrity, and availability. The vulnerability affects Firefox versions prior to 153 and Firefox ESR versions prior to 140.13. Mozilla has released official fixes in Firefox 153 and Firefox ESR 140.13. There are no known exploits in the wild at the time of the advisory. The vulnerability is part of a broader set of security issues addressed in these releases.

CVE-2026-16350 is a critical vulnerability in Mozilla Firefox involving incorrect boundary conditions in the Audio/Video cubeb component. This flaw could lead to severe impacts including confidentiality, integrity, and availability compromises. The vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS score is 9.8, indicating a critical severity level. No known exploits in the wild have been reported. Mozilla has published official advisories confirming the fix.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

A vulnerability in Mozilla Firefox for iOS allowed pages with malicious titles to potentially overwrite saved PDF files or bundled PDF content within the app sandbox. This issue was addressed in Firefox for iOS version 152.4. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not require user interaction or privileges to exploit.

A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3.

An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.

CVE-2026-53900 is a medium severity vulnerability in Mozilla Firefox for iOS where cookies set on an initial PDF request are preserved across cross-origin HTTP redirects in TemporaryDocument. This behavior allows a malicious site to inject arbitrary cookies into requests to unrelated target domains. The issue was fixed in Firefox for iOS version 152.0.

CVE-2026-53899 is a vulnerability in Firefox for iOS where partial domain matching was used when attaching cookies to PDF requests. This flaw allowed a malicious site on a suffix domain to receive cookies belonging to the target site. The issue was fixed in Firefox for iOS version 152.0. The vulnerability has a CVSS score of 6.5 (medium severity) and does not require user interaction or privileges to exploit. It could lead to unauthorized cookie disclosure across origins.

Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Multiple memory safety vulnerabilities were identified in Mozilla Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. These bugs showed evidence of memory corruption and could potentially be exploited to execute arbitrary code. The issues were addressed and fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird ESR 140.12. The vulnerabilities are classified as high severity with a CVSS score of 8.1.

Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component of Mozilla Firefox. It affects Firefox versions prior to 152, Firefox ESR versions up to 140.11, and ESR 115.36 and earlier. The vulnerability was fixed in Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. The CVSS score is 6.5 (medium severity), indicating a network-exploitable issue that requires user interaction and results in denial of service without confidentiality or integrity impact.

CVE-2026-12324 is a vulnerability in Mozilla Firefox's Graphics: CanvasWebGL component caused by incorrect boundary conditions. This issue was fixed in Firefox 152 and Firefox ESR 140.12. The vulnerability has a CVSS score of 7.3, indicating high severity. It is part of a broader set of security fixes released in these versions addressing multiple memory safety and boundary condition issues. No known exploits are reported in the wild for this specific vulnerability.

CVE-2026-12323 is a spoofing vulnerability in the DOM: Core & HTML component of Mozilla Firefox. This issue was addressed and fixed in Firefox version 152. The vulnerability has a medium severity with a CVSS score of 5.4. It does not have known exploits in the wild. The fix is included in the Firefox 152 release, which also addresses multiple other security vulnerabilities across various components. Users running versions prior to 152 are affected.