Threat database

CVE-2026-100825 is a use-after-free vulnerability in the JavaScript Engine's JIT component of Mozilla Firefox. It affects Firefox versions prior to 153.4 and was fixed in Firefox ESR 153.4 and Firefox 157. The vulnerability allows for potential high-impact consequences including confidentiality, integrity, and availability compromises. The issue was addressed by Mozilla in official security advisories.

CVE-2026-100824 is a high-severity privilege escalation vulnerability in the Places component of Mozilla Firefox. It allows an attacker to escalate privileges, potentially leading to full compromise of the affected system. The vulnerability has been fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-100823 is a medium severity spoofing vulnerability in the Downloads component of Firefox for Android. The issue could allow an attacker to misrepresent download information. This vulnerability was fixed in Firefox version 157.

CVE-2026-100822 is a medium severity spoofing vulnerability in the Networking: HTTP component of Mozilla Firefox. The issue allows an attacker to spoof content or network responses. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. Users running versions prior to these should update to the fixed versions to mitigate the risk.

A site isolation vulnerability was identified in the Panning and Zooming component of Mozilla Firefox and Thunderbird. This issue could allow limited information disclosure due to improper site isolation. The vulnerability has a medium severity rating with a CVSS score of 4.7. It affects multiple versions of Firefox and Thunderbird prior to their respective fixed releases. Official fixes have been released in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

CVE-2026-100820 is a high-severity privilege escalation vulnerability in the Address Bar component of Mozilla Thunderbird. It allows an attacker to escalate privileges, potentially leading to full compromise of the affected system. The issue affects multiple Thunderbird versions prior to their respective fixed releases. Official patches have been released in Thunderbird versions 140.17, 153.4, and 157.1, as well as corresponding Firefox ESR and Firefox versions.

CVE-2026-100819 is a critical vulnerability in Mozilla Firefox and Thunderbird involving a sandbox escape due to incorrect boundary conditions in the XPCOM component. This flaw allows an attacker to potentially bypass sandbox restrictions, impacting confidentiality, integrity, and availability. The issue has been fixed in multiple versions of Firefox ESR, Firefox, and Thunderbird.

CVE-2026-100818 is a critical use-after-free vulnerability in the Widget: Gtk component of Mozilla Thunderbird that allows sandbox escape. This flaw was fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox ESR versions. The vulnerability has a high CVSS score of 9.6, indicating it can lead to complete system compromise if exploited. No known exploits are reported in the wild at this time.

CVE-2026-100817 is a medium severity vulnerability in Mozilla Thunderbird related to the JavaScript WebAssembly component. It allows limited impact on confidentiality and integrity but does not affect availability. The issue was fixed in Thunderbird version 157.

CVE-2026-100816 is a high-severity vulnerability in Mozilla Firefox related to a site isolation issue in the DOM networking component. It allows potential compromise of confidentiality and integrity but does not affect availability. The flaw was fixed in Firefox ESR 153.4 and Firefox 157, as well as Thunderbird 153.4 and 157.

CVE-2026-100815 is a use-after-free vulnerability in the CSS Parsing and Computation component of Mozilla Firefox. It allows for potential high impact on confidentiality, integrity, and availability. The issue was fixed in Firefox ESR 153.4 and Firefox 157, as well as Thunderbird 153.4 and 157.

CVE-2026-100814 is a high-severity vulnerability in Mozilla Firefox's JavaScript Engine JIT component caused by incorrect boundary conditions. It allows potential high impact on confidentiality, integrity, and availability. The issue is fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-100813 is a high-severity vulnerability in Mozilla Thunderbird involving an invalid pointer in the JavaScript Engine's JIT component. This flaw allows potential high impact on confidentiality, integrity, and availability. The issue was fixed in Thunderbird version 157.

A denial-of-service vulnerability exists in the Graphics component of Mozilla Firefox. This issue allows an attacker to cause an application crash, impacting availability. The vulnerability has been addressed and fixed in Firefox ESR 153.4 and Firefox 157, as well as Thunderbird 153.4 and Thunderbird 157.

CVE-2026-100811 is a critical use-after-free vulnerability in the DOM Core & HTML component of Mozilla Thunderbird that allows sandbox escape. This flaw has been fixed in Thunderbird versions 140.17, 153.4, and 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.

A critical vulnerability (CVE-2026-100810) was identified in the DevTools component of Mozilla Thunderbird. This issue allows for high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Thunderbird version 157.

CVE-2026-100809 is a same-origin policy bypass vulnerability in the DevTools component of Mozilla Firefox. This security flaw allows an attacker to bypass the browser's same-origin policy, potentially leading to unauthorized access to sensitive information. The vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Thunderbird 153.4, and Thunderbird 157. It has a high severity rating with a CVSS score of 8.1. No known exploits are reported in the wild at this time.

CVE-2026-100808 is a high-severity vulnerability in Mozilla Firefox affecting the DOM: Service Workers component that allows mitigation bypass. This flaw was addressed in Firefox ESR 153.4 and Firefox 157, as well as Thunderbird versions 153.4 and 157. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild.

CVE-2026-100807 is a high-severity privilege escalation vulnerability in the DOM Service Workers component of Mozilla Thunderbird and Firefox. It allows an attacker to escalate privileges, impacting confidentiality, integrity, and availability. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as Firefox ESR 140.17, ESR 153.4, and Firefox 157.

CVE-2026-100805 is a high-severity vulnerability in Mozilla Thunderbird involving a race condition and use-after-free in the Audio/Video component. It allows potential high impact on confidentiality, integrity, and availability. The issue was fixed in Thunderbird version 157.