Threat database

Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0.

Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Memory safety bugs present in Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Privilege escalation in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8970 is a privilege escalation vulnerability in the Security component of Mozilla Firefox. It was addressed and fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. The vulnerability has a high CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. Mozilla's official advisories confirm the fix is included in these versions. There are no known exploits in the wild at this time.

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVE-2026-8967 is an information disclosure vulnerability in the Graphics: WebGPU component of Mozilla Firefox. It was addressed in Firefox 151 and Thunderbird 151. The vulnerability has a high CVSS score of 7.5, indicating a significant impact on confidentiality without affecting integrity or availability. Mozilla has released official fixes in Firefox 151 and Thunderbird 151 to remediate this issue. There are no known exploits in the wild at this time. Users are advised to update to the fixed versions to mitigate the risk.

CVE-2026-8966 is an information disclosure vulnerability in the IP Protection component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 151 and Thunderbird version 151. The CVSS score is 7.5, indicating a high severity level, with the impact limited to confidentiality (information disclosure) and no impact on integrity or availability. The vendor advisory confirms the fix is included in Firefox 151 and Thunderbird 151 releases. There are no known exploits in the wild for this vulnerability at the time of publication.

CVE-2026-8965 is an information disclosure vulnerability in the DOM security component of Mozilla Firefox. It was addressed in Firefox version 151 and Thunderbird version 151. The vulnerability has a high CVSS score of 7.5, indicating a significant risk of sensitive information exposure without requiring user interaction or privileges. Mozilla has officially fixed this issue as part of a broader security update that addressed multiple vulnerabilities, including memory safety bugs. There are no known exploits in the wild for this specific vulnerability. Users are advised to update to Firefox 151 or Thunderbird 151 to mitigate the risk.

Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

CVE-2026-8962 is a mitigation bypass vulnerability in the DOM security component of Mozilla Firefox. It was addressed in Firefox 151 and Firefox ESR 140.11. The vulnerability has a high severity with a CVSS score of 8.1, indicating it could lead to significant confidentiality and integrity impacts. Mozilla has released official fixes for this and related vulnerabilities in these Firefox versions. There are no known exploits in the wild at this time. Users are advised to update to the fixed versions to mitigate the risk.

CVE-2026-8961 is a spoofing vulnerability in the Form Autofill component of Mozilla Firefox. This issue could allow an attacker to present deceptive information to users via the autofill feature. The vulnerability has been fixed in Firefox 151 and Firefox ESR 140.11. The CVSS score is 6.5, indicating a medium severity level. No known exploits are reported in the wild. The vendor advisories confirm that the issue is resolved in the specified Firefox versions.

Spoofing issue in WebExtensions. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.