Threat database

CVE-2026-100761 is a high-severity privilege escalation vulnerability in Mozilla Thunderbird caused by a use-after-free flaw in the Graphics: WebGPU component. This memory mismanagement issue allows an attacker to escalate privileges. The vulnerability was fixed in Thunderbird version 157.

CVE-2026-100760 is a critical sandbox escape vulnerability in Mozilla Firefox's process sandboxing component. It allows an attacker to break out of the sandbox, potentially leading to full system compromise. The flaw was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.

CVE-2026-100759 is a high-severity vulnerability in Mozilla Firefox and Thunderbird involving uninitialized memory in the Storage: Quota Manager component. This flaw could allow an attacker to cause confidentiality and integrity impacts. The issue has been fixed in multiple versions of Firefox ESR and Thunderbird.

CVE-2026-100758 is a critical sandbox escape vulnerability in the DOM navigation component of Mozilla Firefox and Thunderbird. It allows an attacker to bypass sandbox restrictions, potentially leading to full compromise of confidentiality, integrity, and availability. The issue has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157.

Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVE-2026-100756 is a high-severity vulnerability in Mozilla Firefox and Thunderbird related to incorrect boundary conditions in the Audio/Video playback component. This flaw could lead to high impact on confidentiality and integrity. The issue has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92052 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by uninitialized memory in the Graphics: CanvasWebGL component. This flaw allows an attacker to escalate privileges due to improper memory handling. The issue was fixed in Firefox 156 and Firefox ESR 153.3, as well as Thunderbird 156 and Thunderbird 153.3.

CVE-2026-92043 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by incorrect boundary conditions in the Audio/Video component. This flaw allows an attacker to escalate privileges within the affected software. The issue was fixed in Firefox version 156 and Firefox ESR 153.3, as well as Thunderbird 156 and Thunderbird 153.3.

CVE-2026-92033 is a high-severity privilege escalation vulnerability affecting Firefox for Android. The issue allows an attacker to gain elevated privileges within the affected application. Mozilla fixed this vulnerability in Firefox version 156. No known exploits are reported in the wild at this time.

CVE-2026-92020 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by incorrect boundary conditions in the Graphics: WebRender component. This flaw allows an attacker to escalate privileges within the affected software. The vulnerability has been fixed in Firefox 156 and corresponding ESR and Thunderbird versions. No known exploits in the wild have been reported.

Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-92073 is a high-severity privilege escalation vulnerability in the Enterprise Policies component of mozjs52 used by Mozilla Firefox and Thunderbird. It allows an attacker to escalate privileges, impacting confidentiality, integrity, and availability. The vulnerability affects multiple specific versions of Firefox, Thunderbird, and mozjs52 packages, including various Ubuntu package versions. It was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. No known exploits in the wild have been reported.