Threat database

CVE-2026-109715 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine component of mozjs52. This issue was addressed and fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 8.1, indicating a high severity impact primarily affecting confidentiality and integrity. No known exploits in the wild have been reported. Multiple specific versions of mozjs52 are affected.

CVE-2026-109716 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine component of mozjs52. This flaw was addressed and fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS 3.1 score of 8.1, indicating a high impact on confidentiality and integrity, but no impact on availability. No known exploits are reported in the wild.

CVE-2026-109721 is a vulnerability involving incorrect boundary conditions in the JavaScript Engine's JIT component. This flaw was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a medium severity rating with a CVSS score of 5.4. It does not have known exploits in the wild. Multiple specific affected versions of the mozjs52 package are identified.

CVE-2026-109731 is a medium severity vulnerability involving incorrect boundary conditions in the Graphics: Canvas2D component of mozjs52. This flaw was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability could potentially lead to limited confidentiality and integrity impacts but does not affect availability. No known exploits are reported in the wild.

CVE-2026-109754 is a vulnerability involving incorrect boundary conditions in the DOM Editor component of mozjs52. This issue was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a CVSS score of 8.1, indicating a high severity level with potential for high confidentiality and integrity impact. No known exploits in the wild have been reported. A comprehensive vendor advisory from Mozilla confirms the fix availability.

CVE-2026-109762 is a vulnerability involving incorrect boundary conditions in the SVG component of mozjs52. This flaw was addressed and fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The vulnerability has a high CVSS score of 8.8, indicating a serious security impact. It allows for potential high impact on confidentiality, integrity, and availability. Multiple specific affected versions of mozjs52 are identified. No known exploits in the wild have been reported.

CVE-2026-92240 is an out-of-bounds read vulnerability in the IMAP response parser of Thunderbird's mozjs52 component. A malicious or compromised IMAP server can send an untagged '* ID' response to trigger this vulnerability, causing Thunderbird to crash. The vulnerable code path is reachable before user authentication. This issue was fixed in Thunderbird versions 156, 140.16, and 153.3.

CVE-2026-92006 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. It arises from incorrect boundary conditions that could allow an attacker to escalate privileges. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92007 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. The issue arises from incorrect boundary conditions that could allow an attacker to escalate privileges. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92008 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. The issue arises from incorrect boundary conditions, allowing an attacker to escalate privileges. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92009 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. It arises from incorrect boundary conditions and was fixed in Firefox 156 and corresponding ESR and Thunderbird versions. The vulnerability has a high impact with a CVSS score of 8.8, indicating potential for significant confidentiality, integrity, and availability impact. Multiple specific vulnerable versions are identified, primarily various builds of mozjs52 and related Firefox and Thunderbird versions. No known exploits in the wild have been reported.

CVE-2026-92010 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. The issue arises from incorrect boundary conditions that could allow an attacker to escalate privileges. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92011 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. The issue arises from incorrect boundary conditions that could allow an attacker to escalate privileges. This vulnerability has been fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92012 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. It arises from incorrect boundary conditions and was fixed in Firefox 156 and corresponding ESR and Thunderbird versions. The vulnerability has a high impact and a CVSS score of 8.8. Multiple specific versions of mozjs52 are affected. No known exploits in the wild have been reported.

CVE-2026-92013 is a privilege escalation vulnerability in the Graphics: CanvasWebGL component of mozjs52. It arises from incorrect boundary conditions and was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact and a CVSS score of 8.8. Multiple specific vulnerable versions are identified. No known exploits in the wild have been reported.

CVE-2026-92014 is a privilege escalation vulnerability in the Graphics component of mozjs52. It arises from incorrect boundary conditions, allowing an attacker to escalate privileges. The issue was fixed in Firefox ESR versions 115.41 and 140.16, as well as Thunderbird 140.16. The vulnerability has a high CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability. Multiple specific versions of mozjs52 are affected, primarily those prior to the fixed versions. No known exploits are reported in the wild.

CVE-2026-92025 is a use-after-free vulnerability in the DOM Navigation component of mozjs52. This security flaw was addressed and fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact and a CVSS score of 8.8, indicating it can lead to significant confidentiality, integrity, and availability issues if exploited.

CVE-2026-92026 is a use-after-free vulnerability in the Networking component of mozjs52. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. It has a high impact with a CVSS score of 8.8, affecting confidentiality, integrity, and availability. No known exploits in the wild have been reported. The vendor has released official fixes in the stated versions.

CVE-2026-92031 is an information disclosure vulnerability in the Graphics: ImageLib component of mozjs52. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The CVSS score is 6.5, indicating a medium severity issue. The vulnerability allows unauthorized disclosure of information but does not impact integrity or availability. Multiple specific affected versions are identified, including various Ubuntu package versions. No known exploits in the wild have been reported.

CVE-2026-92016 is a use-after-free vulnerability in the Disability Access APIs component of mozjs52. This security flaw was addressed and fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. The vulnerability has a high impact rating with a CVSS score of 8.8, indicating potential for significant confidentiality, integrity, and availability impacts if exploited.