# Firefox Developer Edition (en-US) 156.0 Firefox Developer Edition (en-US) 156.0, released September 2, 2026, fixes 259 CVEs in Firefox Developer Edition (en-US). None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.developeredition-156.0 - Platform: Windows apps - Released: Sep 2, 2026 - Priority: Urgent (Closes CVE-2026-74943, rated Critical) - CVEs: 259, exploited: 0, on CISA KEV: 0 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Firefox Developer Edition (en-US)](https://patchblox.com/security/data/product/windows-app/firefox-developer-edition-en-us.md) | | 156.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-74943](https://patchblox.com/security/data/cve/CVE-2026-74943.md) | Urgent | Use-after-free in the Graphics: ImageLib component | 9.8 | 0.0096 | | | [CVE-2026-16357](https://patchblox.com/security/data/cve/CVE-2026-16357.md) | Urgent | Incorrect boundary conditions in the Graphics component | 9.8 | 0.0087 | | | [CVE-2026-16412](https://patchblox.com/security/data/cve/CVE-2026-16412.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0064 | | | [CVE-2026-16395](https://patchblox.com/security/data/cve/CVE-2026-16395.md) | Urgent | Integer overflow in the Audio/Video component | 9.8 | 0.0062 | | | [CVE-2026-16402](https://patchblox.com/security/data/cve/CVE-2026-16402.md) | Urgent | Integer overflow in the Graphics: ImageLib component | 9.8 | 0.0062 | | | [CVE-2026-16408](https://patchblox.com/security/data/cve/CVE-2026-16408.md) | Urgent | Integer overflow in the Audio/Video: Playback component | 9.8 | 0.0062 | | | [CVE-2026-74964](https://patchblox.com/security/data/cve/CVE-2026-74964.md) | Urgent | Integer overflow in the Graphics component | 9.8 | 0.0060 | | | [CVE-2026-74989](https://patchblox.com/security/data/cve/CVE-2026-74989.md) | Urgent | Internally found bugs fixed in Thunderbird 154 | 9.8 | 0.0057 | | | [CVE-2026-84134](https://patchblox.com/security/data/cve/CVE-2026-84134.md) | Urgent | Other issue in the Profile Backup component | 9.8 | 0.0057 | | | [CVE-2026-16389](https://patchblox.com/security/data/cve/CVE-2026-16389.md) | Urgent | Incorrect boundary conditions, integer overflow in the Libraries component in NSS | 9.8 | 0.0057 | | | [CVE-2026-84142](https://patchblox.com/security/data/cve/CVE-2026-84142.md) | Urgent | Internally found bugs fixed in Thunderbird 155 | 9.8 | 0.0056 | | | [CVE-2026-16382](https://patchblox.com/security/data/cve/CVE-2026-16382.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0056 | | | [CVE-2026-74986](https://patchblox.com/security/data/cve/CVE-2026-74986.md) | Urgent | Site isolation issue in the CSS Parsing and Computation component | 9.1 | 0.0056 | | | [CVE-2026-16388](https://patchblox.com/security/data/cve/CVE-2026-16388.md) | Urgent | Sandbox escape in the DOM: Networking component | 9.8 | 0.0055 | | | [CVE-2026-16410](https://patchblox.com/security/data/cve/CVE-2026-16410.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0055 | | | [CVE-2026-92036](https://patchblox.com/security/data/cve/CVE-2026-92036.md) | Urgent | Incorrect boundary conditions in the Networking: HTTP component | 9.8 | 0.0055 | | | [CVE-2026-92037](https://patchblox.com/security/data/cve/CVE-2026-92037.md) | Urgent | Incorrect boundary conditions in the DOM: Animation component | 9.8 | 0.0055 | | | [CVE-2026-92061](https://patchblox.com/security/data/cve/CVE-2026-92061.md) | Urgent | Incorrect boundary conditions in the Security: Process Sandboxing component | 9.8 | 0.0055 | | | [CVE-2026-92066](https://patchblox.com/security/data/cve/CVE-2026-92066.md) | Urgent | Sandbox escape in the Profile Backup component | 9.8 | 0.0055 | | | [CVE-2026-16393](https://patchblox.com/security/data/cve/CVE-2026-16393.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.1 | 0.0054 | | | [CVE-2026-16392](https://patchblox.com/security/data/cve/CVE-2026-16392.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.1 | 0.0053 | | | [CVE-2026-92051](https://patchblox.com/security/data/cve/CVE-2026-92051.md) | Urgent | Spoofing issue due to invalid pointer in the Graphics component | 9.1 | 0.0053 | | | [CVE-2026-74985](https://patchblox.com/security/data/cve/CVE-2026-74985.md) | Urgent | Privilege escalation in the Enterprise Policies component | 9.8 | 0.0053 | | | [CVE-2026-16353](https://patchblox.com/security/data/cve/CVE-2026-16353.md) | Urgent | Invalid pointer in the DOM: Bindings (WebIDL) component | 9.8 | 0.0052 | | | [CVE-2026-16407](https://patchblox.com/security/data/cve/CVE-2026-16407.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0051 | | | [CVE-2026-74956](https://patchblox.com/security/data/cve/CVE-2026-74956.md) | Urgent | Same-origin policy bypass in the DOM: Service Workers component | 9.1 | 0.0050 | | | [CVE-2026-16411](https://patchblox.com/security/data/cve/CVE-2026-16411.md) | Urgent | Memory safety bugs fixed in Thunderbird 153 | 9.8 | 0.0049 | | | [CVE-2026-16360](https://patchblox.com/security/data/cve/CVE-2026-16360.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0047 | | | [CVE-2026-75874](https://patchblox.com/security/data/cve/CVE-2026-75874.md) | Urgent | Sandbox escape in the Remote Settings Client component | 10.0 | 0.0046 | | | [CVE-2026-74961](https://patchblox.com/security/data/cve/CVE-2026-74961.md) | Urgent | Side-channel in the Web Audio component | 9.1 | 0.0044 | | | [CVE-2026-16363](https://patchblox.com/security/data/cve/CVE-2026-16363.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16369](https://patchblox.com/security/data/cve/CVE-2026-16369.md) | Urgent | Integer overflow in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16370](https://patchblox.com/security/data/cve/CVE-2026-16370.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.1 | 0.0043 | | | [CVE-2026-16394](https://patchblox.com/security/data/cve/CVE-2026-16394.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0043 | | | [CVE-2026-16406](https://patchblox.com/security/data/cve/CVE-2026-16406.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0043 | | | [CVE-2026-16364](https://patchblox.com/security/data/cve/CVE-2026-16364.md) | Urgent | Incorrect boundary conditions in the Audio/Video: Playback component | 9.1 | 0.0043 | | | [CVE-2026-74940](https://patchblox.com/security/data/cve/CVE-2026-74940.md) | Urgent | Use-after-free in the Graphics: Text component | 9.8 | 0.0041 | | | [CVE-2026-92050](https://patchblox.com/security/data/cve/CVE-2026-92050.md) | Urgent | Sandbox escape due to race condition in the XPConnect component | 9.1 | 0.0041 | | | [CVE-2026-16350](https://patchblox.com/security/data/cve/CVE-2026-16350.md) | Urgent | Incorrect boundary conditions in the Audio/Video: cubeb component | 9.8 | 0.0041 | | | [CVE-2026-16355](https://patchblox.com/security/data/cve/CVE-2026-16355.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0041 | | | [CVE-2026-74936](https://patchblox.com/security/data/cve/CVE-2026-74936.md) | Urgent | Use-after-free in the JavaScript: WebAssembly component | 9.8 | 0.0040 | | | [CVE-2026-74944](https://patchblox.com/security/data/cve/CVE-2026-74944.md) | Urgent | Use-after-free in the DOM: Core & HTML component | 9.8 | 0.0040 | | | [CVE-2026-16351](https://patchblox.com/security/data/cve/CVE-2026-16351.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Navigation component | 9.8 | 0.0039 | | | [CVE-2026-16352](https://patchblox.com/security/data/cve/CVE-2026-16352.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-16356](https://patchblox.com/security/data/cve/CVE-2026-16356.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-12295](https://patchblox.com/security/data/cve/CVE-2026-12295.md) | Urgent | Sandbox escape in the DOM: Navigation component | 9.6 | 0.0039 | | | [CVE-2026-12296](https://patchblox.com/security/data/cve/CVE-2026-12296.md) | Urgent | Sandbox escape in the Security: Process Sandboxing component | 9.6 | 0.0039 | | | [CVE-2026-12297](https://patchblox.com/security/data/cve/CVE-2026-12297.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Networking component | 9.6 | 0.0039 | | | [CVE-2026-16368](https://patchblox.com/security/data/cve/CVE-2026-16368.md) | Urgent | Incorrect boundary conditions in the JavaScript: WebAssembly component | 9.8 | 0.0039 | | | [CVE-2026-16377](https://patchblox.com/security/data/cve/CVE-2026-16377.md) | Urgent | Mitigation bypass in the PDF Viewer component | 9.8 | 0.0039 | | | [CVE-2026-16383](https://patchblox.com/security/data/cve/CVE-2026-16383.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.8 | 0.0039 | | | [CVE-2026-84143](https://patchblox.com/security/data/cve/CVE-2026-84143.md) | Urgent | Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 | 9.8 | 0.0038 | | | [CVE-2026-16367](https://patchblox.com/security/data/cve/CVE-2026-16367.md) | Urgent | Sandbox escape due to invalid pointer in the Disability Access APIs component | 10.0 | 0.0038 | | | [CVE-2026-12294](https://patchblox.com/security/data/cve/CVE-2026-12294.md) | Urgent | Sandbox escape in the DOM: Workers component | 9.6 | 0.0036 | | | [CVE-2026-74959](https://patchblox.com/security/data/cve/CVE-2026-74959.md) | Urgent | Mitigation bypass in the Storage: Cache API component | 9.1 | 0.0034 | | | [CVE-2026-92018](https://patchblox.com/security/data/cve/CVE-2026-92018.md) | Urgent | Sandbox escape in the DOM: Core & HTML component | 9.6 | 0.0033 | | | [CVE-2026-92032](https://patchblox.com/security/data/cve/CVE-2026-92032.md) | Urgent | Sandbox escape due to invalid pointer in the Graphics component | 9.6 | 0.0032 | | | [CVE-2026-84119](https://patchblox.com/security/data/cve/CVE-2026-84119.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Navigation component | 9.6 | 0.0032 | | | [CVE-2026-84121](https://patchblox.com/security/data/cve/CVE-2026-84121.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Security component | 9.6 | 0.0032 | | | [CVE-2026-16390](https://patchblox.com/security/data/cve/CVE-2026-16390.md) | Urgent | Mitigation bypass in the Enterprise Policies component | 9.1 | 0.0032 | | | [CVE-2026-92038](https://patchblox.com/security/data/cve/CVE-2026-92038.md) | Urgent | Mitigation bypass in the Remote Settings Client component | 9.1 | 0.0032 | | | [CVE-2026-92041](https://patchblox.com/security/data/cve/CVE-2026-92041.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.1 | 0.0032 | | | [CVE-2026-92075](https://patchblox.com/security/data/cve/CVE-2026-92075.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0032 | | | [CVE-2026-16380](https://patchblox.com/security/data/cve/CVE-2026-16380.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0031 | | | [CVE-2026-74979](https://patchblox.com/security/data/cve/CVE-2026-74979.md) | Urgent | Mitigation bypass in the Add-ons Manager component | 9.8 | 0.0031 | | | [CVE-2026-12293](https://patchblox.com/security/data/cve/CVE-2026-12293.md) | Urgent | Use-after-free in the Graphics: WebGPU component | 9.8 | 0.0030 | | | [CVE-2026-92045](https://patchblox.com/security/data/cve/CVE-2026-92045.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the WebRTC component | 9.6 | 0.0030 | | | [CVE-2026-92048](https://patchblox.com/security/data/cve/CVE-2026-92048.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 9.0 | 0.0028 | | | [CVE-2026-92034](https://patchblox.com/security/data/cve/CVE-2026-92034.md) | Urgent | Site isolation issue in the Graphics component | 9.1 | 0.0027 | | | [CVE-2026-16359](https://patchblox.com/security/data/cve/CVE-2026-16359.md) | Urgent | Incorrect boundary conditions in the Audio/Video: GMP component | 9.1 | 0.0026 | | | [CVE-2026-12315](https://patchblox.com/security/data/cve/CVE-2026-12315.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-92057](https://patchblox.com/security/data/cve/CVE-2026-92057.md) | Urgent | Mitigation bypass in the Enterprise Policies component | 9.1 | 0.0025 | | | [CVE-2026-92079](https://patchblox.com/security/data/cve/CVE-2026-92079.md) | Urgent | Mitigation bypass in the Widget: Win32 component | 9.1 | 0.0025 | | | [CVE-2026-12316](https://patchblox.com/security/data/cve/CVE-2026-12316.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-92071](https://patchblox.com/security/data/cve/CVE-2026-92071.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 9.6 | 0.0024 | | | [CVE-2026-16358](https://patchblox.com/security/data/cve/CVE-2026-16358.md) | Urgent | Site isolation issue in the Graphics: WebRender component | 9.8 | 0.0022 | | | [CVE-2026-16349](https://patchblox.com/security/data/cve/CVE-2026-16349.md) | Urgent | Same-origin policy bypass in the DOM: Navigation component | 9.8 | 0.0022 | | | [CVE-2026-16375](https://patchblox.com/security/data/cve/CVE-2026-16375.md) | Urgent | Site isolation issue in the Networking: HTTP component | 9.8 | 0.0021 | | | [CVE-2026-16387](https://patchblox.com/security/data/cve/CVE-2026-16387.md) | Urgent | Site isolation issue in the Networking component | 9.8 | 0.0020 | | | [CVE-2026-12304](https://patchblox.com/security/data/cve/CVE-2026-12304.md) | Urgent | Same-origin policy bypass in the Networking: Cookies component | 9.1 | 0.0019 | | | [CVE-2026-16381](https://patchblox.com/security/data/cve/CVE-2026-16381.md) | Urgent | Same-origin policy bypass in the Networking: DNS component | 9.1 | 0.0017 | | | [CVE-2026-92059](https://patchblox.com/security/data/cve/CVE-2026-92059.md) | Urgent | Incorrect boundary conditions in the DOM: Editor component | 9.3 | 0.0011 | | | [CVE-2026-74945](https://patchblox.com/security/data/cve/CVE-2026-74945.md) | High | Information disclosure in the Graphics: Text component | 7.5 | 0.0071 | | | [CVE-2026-74988](https://patchblox.com/security/data/cve/CVE-2026-74988.md) | High | Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154 | 9.8 | 0.0061 | | | [CVE-2026-74977](https://patchblox.com/security/data/cve/CVE-2026-74977.md) | High | Integer overflow in the Graphics component | 7.5 | 0.0060 | | | [CVE-2026-74990](https://patchblox.com/security/data/cve/CVE-2026-74990.md) | High | Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 | 9.8 | 0.0053 | | | [CVE-2026-74982](https://patchblox.com/security/data/cve/CVE-2026-74982.md) | High | Denial-of-service in the Widget component | 7.5 | 0.0053 | | | [CVE-2026-74987](https://patchblox.com/security/data/cve/CVE-2026-74987.md) | High | Internally found bugs fixed in Thunderbird ESR 140.14, Thunderbird ESR 153.1 and Thunderbird 154 | 9.8 | 0.0052 | | | [CVE-2026-16376](https://patchblox.com/security/data/cve/CVE-2026-16376.md) | High | Denial-of-service in the Graphics: WebGPU component | 7.5 | 0.0052 | | | [CVE-2026-16409](https://patchblox.com/security/data/cve/CVE-2026-16409.md) | High | Invalid pointer in the Security: PSM component | 7.5 | 0.0052 | | | [CVE-2026-12292](https://patchblox.com/security/data/cve/CVE-2026-12292.md) | High | Incorrect boundary conditions in the Web Audio component | 8.1 | 0.0049 | | | [CVE-2026-15718](https://patchblox.com/security/data/cve/CVE-2026-15718.md) | High | Invalid pointer in the JavaScript: WebAssembly component | 8.8 | 0.0049 | | | [CVE-2026-12328](https://patchblox.com/security/data/cve/CVE-2026-12328.md) | High | Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0048 | | | [CVE-2026-74958](https://patchblox.com/security/data/cve/CVE-2026-74958.md) | High | Information disclosure in the WebRTC component | 7.5 | 0.0045 | | | [CVE-2026-74947](https://patchblox.com/security/data/cve/CVE-2026-74947.md) | High | Privilege escalation due to invalid pointer in the Graphics component | 8.8 | 0.0045 | | | [CVE-2026-74938](https://patchblox.com/security/data/cve/CVE-2026-74938.md) | High | Mitigation bypass in the JavaScript: GC component | 9.1 | 0.0044 | | | [CVE-2026-74954](https://patchblox.com/security/data/cve/CVE-2026-74954.md) | High | Information disclosure due to side-channel in the Storage: Cache API component | 7.5 | 0.0044 | | | [CVE-2026-74966](https://patchblox.com/security/data/cve/CVE-2026-74966.md) | High | Information disclosure in the Form Autofill component | 7.5 | 0.0044 | | | [CVE-2026-84130](https://patchblox.com/security/data/cve/CVE-2026-84130.md) | High | Information disclosure in the Graphics: WebGPU component | 7.5 | 0.0044 | | | [CVE-2026-84128](https://patchblox.com/security/data/cve/CVE-2026-84128.md) | High | Privilege escalation in the WebDriver BiDi component | 8.8 | 0.0044 | | | [CVE-2026-74937](https://patchblox.com/security/data/cve/CVE-2026-74937.md) | High | Use-after-free in the JavaScript: GC component | 8.8 | 0.0044 | | | [CVE-2026-84123](https://patchblox.com/security/data/cve/CVE-2026-84123.md) | High | Privilege escalation due to use-after-free in the Graphics: WebGPU component | 8.8 | 0.0044 | | | [CVE-2026-16384](https://patchblox.com/security/data/cve/CVE-2026-16384.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16385](https://patchblox.com/security/data/cve/CVE-2026-16385.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16386](https://patchblox.com/security/data/cve/CVE-2026-16386.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16400](https://patchblox.com/security/data/cve/CVE-2026-16400.md) | High | Information disclosure in the DOM: Security component | 7.5 | 0.0043 | | | [CVE-2026-84144](https://patchblox.com/security/data/cve/CVE-2026-84144.md) | High | Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2 | 7.5 | 0.0043 | | | [CVE-2026-92040](https://patchblox.com/security/data/cve/CVE-2026-92040.md) | High | Use-after-free in the JavaScript: WebAssembly component | 8.8 | 0.0042 | | | [CVE-2026-16378](https://patchblox.com/security/data/cve/CVE-2026-16378.md) | High | Other issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0042 | | | [CVE-2026-74950](https://patchblox.com/security/data/cve/CVE-2026-74950.md) | High | Privilege escalation in the Downloads API component | 8.8 | 0.0042 | | | [CVE-2026-74952](https://patchblox.com/security/data/cve/CVE-2026-74952.md) | High | Privilege escalation in the Application Update component | 8.8 | 0.0042 | | | [CVE-2026-74955](https://patchblox.com/security/data/cve/CVE-2026-74955.md) | High | Privilege escalation in the Request Handling component | 8.8 | 0.0042 | | | [CVE-2026-12327](https://patchblox.com/security/data/cve/CVE-2026-12327.md) | High | Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0041 | | | [CVE-2026-16372](https://patchblox.com/security/data/cve/CVE-2026-16372.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0041 | | | [CVE-2026-16366](https://patchblox.com/security/data/cve/CVE-2026-16366.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0040 | | | [CVE-2026-16401](https://patchblox.com/security/data/cve/CVE-2026-16401.md) | High | Privilege escalation in the Data Loss Prevention component | 8.8 | 0.0040 | | | [CVE-2026-12290](https://patchblox.com/security/data/cve/CVE-2026-12290.md) | High | Memory safety bug fixed in Thunderbird 152 | 8.1 | 0.0040 | | | [CVE-2026-74969](https://patchblox.com/security/data/cve/CVE-2026-74969.md) | High | Use-after-free in the Layout: Text and Fonts component | 8.8 | 0.0040 | | | [CVE-2026-12289](https://patchblox.com/security/data/cve/CVE-2026-12289.md) | High | Privilege escalation in the Graphics: WebRender component | 8.8 | 0.0040 | | | [CVE-2026-12291](https://patchblox.com/security/data/cve/CVE-2026-12291.md) | High | Use-after-free in the Networking: HTTP component | 8.8 | 0.0038 | | | [CVE-2026-74978](https://patchblox.com/security/data/cve/CVE-2026-74978.md) | High | Clickjacking issue in the Widget component | 8.1 | 0.0038 | | | [CVE-2026-12305](https://patchblox.com/security/data/cve/CVE-2026-12305.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0037 | | | [CVE-2026-84145](https://patchblox.com/security/data/cve/CVE-2026-84145.md) | High | Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15 | 7.5 | 0.0037 | | | [CVE-2026-12326](https://patchblox.com/security/data/cve/CVE-2026-12326.md) | High | Memory safety bugs fixed in Firefox 152 and Thunderbird 152 | 8.1 | 0.0036 | | | [CVE-2026-92005](https://patchblox.com/security/data/cve/CVE-2026-92005.md) | High | Use-after-free in the Audio/Video: Web Codecs component | 7.5 | 0.0036 | | | [CVE-2026-84141](https://patchblox.com/security/data/cve/CVE-2026-84141.md) | High | Integer overflow in the Graphics: ImageLib component | 9.8 | 0.0034 | | | [CVE-2026-16354](https://patchblox.com/security/data/cve/CVE-2026-16354.md) | High | Information disclosure in the Graphics: ImageLib component | 8.8 | 0.0034 | | | [CVE-2026-15719](https://patchblox.com/security/data/cve/CVE-2026-15719.md) | High | Site isolation issue in the DOM: Navigation component | 8.8 | 0.0034 | | | [CVE-2026-74946](https://patchblox.com/security/data/cve/CVE-2026-74946.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0033 | | | [CVE-2026-92035](https://patchblox.com/security/data/cve/CVE-2026-92035.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics component | 9.6 | 0.0033 | | | [CVE-2026-84131](https://patchblox.com/security/data/cve/CVE-2026-84131.md) | High | Privilege escalation due to invalid pointer in the Graphics component | 8.8 | 0.0033 | | | [CVE-2026-92006](https://patchblox.com/security/data/cve/CVE-2026-92006.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0033 | | | [CVE-2026-74983](https://patchblox.com/security/data/cve/CVE-2026-74983.md) | High | Mitigation bypass in the Data Loss Prevention component | 8.1 | 0.0033 | | | [CVE-2026-74971](https://patchblox.com/security/data/cve/CVE-2026-74971.md) | High | Information disclosure in the DOM: UI Events & Focus Handling component | 7.5 | 0.0032 | | | [CVE-2026-74941](https://patchblox.com/security/data/cve/CVE-2026-74941.md) | High | Privilege escalation in the Graphics: CanvasWebGL component | 8.8 | 0.0032 | | | [CVE-2026-16374](https://patchblox.com/security/data/cve/CVE-2026-16374.md) | High | Information disclosure in the Framework component in DevTools | 8.8 | 0.0032 | | | [CVE-2026-16391](https://patchblox.com/security/data/cve/CVE-2026-16391.md) | High | Information disclosure in the Storage: IndexedDB component | 8.8 | 0.0032 | | | [CVE-2026-92044](https://patchblox.com/security/data/cve/CVE-2026-92044.md) | High | Information disclosure in the Networking: HTTP component | 7.5 | 0.0032 | | | [CVE-2026-74976](https://patchblox.com/security/data/cve/CVE-2026-74976.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0032 | | | [CVE-2026-92022](https://patchblox.com/security/data/cve/CVE-2026-92022.md) | High | Use-after-free in the DOM: HTML Parser component | 8.8 | 0.0032 | | | [CVE-2026-92023](https://patchblox.com/security/data/cve/CVE-2026-92023.md) | High | Use-after-free in the XML component | 8.8 | 0.0032 | | | [CVE-2026-92024](https://patchblox.com/security/data/cve/CVE-2026-92024.md) | High | Use-after-free in the SVG component | 8.8 | 0.0032 | | | [CVE-2026-92025](https://patchblox.com/security/data/cve/CVE-2026-92025.md) | High | Use-after-free in the DOM: Navigation component | 8.8 | 0.0032 | | | [CVE-2026-92027](https://patchblox.com/security/data/cve/CVE-2026-92027.md) | High | Use-after-free in the DOM: Streams component | 8.8 | 0.0032 | | | [CVE-2026-92028](https://patchblox.com/security/data/cve/CVE-2026-92028.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0032 | | | [CVE-2026-92029](https://patchblox.com/security/data/cve/CVE-2026-92029.md) | High | Use-after-free in the SVG component | 8.8 | 0.0032 | | | [CVE-2026-74949](https://patchblox.com/security/data/cve/CVE-2026-74949.md) | High | Privilege escalation due to use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0032 | | | [CVE-2026-74948](https://patchblox.com/security/data/cve/CVE-2026-74948.md) | High | Information disclosure in the Graphics component | 7.5 | 0.0031 | | | [CVE-2026-92016](https://patchblox.com/security/data/cve/CVE-2026-92016.md) | High | Use-after-free in the Disability Access APIs component | 8.8 | 0.0031 | | | [CVE-2026-92026](https://patchblox.com/security/data/cve/CVE-2026-92026.md) | High | Use-after-free in the Networking component | 8.8 | 0.0031 | | | [CVE-2026-74935](https://patchblox.com/security/data/cve/CVE-2026-74935.md) | High | Privilege escalation in the DOM: Networking component | 8.8 | 0.0031 | | | [CVE-2026-92019](https://patchblox.com/security/data/cve/CVE-2026-92019.md) | High | Mitigation bypass in the Remote Settings Client component | 8.1 | 0.0031 | | | [CVE-2026-12298](https://patchblox.com/security/data/cve/CVE-2026-12298.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0031 | | | [CVE-2026-12299](https://patchblox.com/security/data/cve/CVE-2026-12299.md) | High | JIT miscompilation in the DOM: Core & HTML component | 7.5 | 0.0031 | | | [CVE-2026-92031](https://patchblox.com/security/data/cve/CVE-2026-92031.md) | High | Information disclosure in the Graphics: ImageLib component | 7.5 | 0.0031 | | | [CVE-2026-74939](https://patchblox.com/security/data/cve/CVE-2026-74939.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0030 | | | [CVE-2026-74942](https://patchblox.com/security/data/cve/CVE-2026-74942.md) | High | Privilege escalation in the Remote Settings Client component | 8.8 | 0.0030 | | | [CVE-2026-74965](https://patchblox.com/security/data/cve/CVE-2026-74965.md) | High | Privilege escalation in the Shell Integration component | 8.8 | 0.0030 | | | [CVE-2026-10701](https://patchblox.com/security/data/cve/CVE-2026-10701.md) | High | Incorrect boundary conditions in the Graphics: Text component | 7.5 | 0.0030 | | | [CVE-2026-74957](https://patchblox.com/security/data/cve/CVE-2026-74957.md) | High | Mitigation bypass in the Safe Browsing component | 8.1 | 0.0030 | | | [CVE-2026-16371](https://patchblox.com/security/data/cve/CVE-2026-16371.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0030 | | | [CVE-2026-74953](https://patchblox.com/security/data/cve/CVE-2026-74953.md) | High | Privilege escalation in the Networking: Cookies component | 8.8 | 0.0030 | | | [CVE-2026-16362](https://patchblox.com/security/data/cve/CVE-2026-16362.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0029 | | | [CVE-2026-92046](https://patchblox.com/security/data/cve/CVE-2026-92046.md) | High | Use-after-free in the Graphics component | 8.8 | 0.0029 | | | [CVE-2026-12317](https://patchblox.com/security/data/cve/CVE-2026-12317.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0029 | | | [CVE-2026-16365](https://patchblox.com/security/data/cve/CVE-2026-16365.md) | High | Privilege escalation in the DOM: Workers component | 8.8 | 0.0028 | | | [CVE-2026-16379](https://patchblox.com/security/data/cve/CVE-2026-16379.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0028 | | | [CVE-2026-12318](https://patchblox.com/security/data/cve/CVE-2026-12318.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 7.3 | 0.0026 | | | [CVE-2026-12306](https://patchblox.com/security/data/cve/CVE-2026-12306.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12307](https://patchblox.com/security/data/cve/CVE-2026-12307.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12308](https://patchblox.com/security/data/cve/CVE-2026-12308.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-74972](https://patchblox.com/security/data/cve/CVE-2026-74972.md) | High | Information disclosure in the DOM: Push Subscriptions component | 7.5 | 0.0026 | | | [CVE-2026-92015](https://patchblox.com/security/data/cve/CVE-2026-92015.md) | High | Privilege escalation in the WebExtensions component | 8.8 | 0.0026 | | | [CVE-2026-92007](https://patchblox.com/security/data/cve/CVE-2026-92007.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92008](https://patchblox.com/security/data/cve/CVE-2026-92008.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92009](https://patchblox.com/security/data/cve/CVE-2026-92009.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92010](https://patchblox.com/security/data/cve/CVE-2026-92010.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92011](https://patchblox.com/security/data/cve/CVE-2026-92011.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92012](https://patchblox.com/security/data/cve/CVE-2026-92012.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92013](https://patchblox.com/security/data/cve/CVE-2026-92013.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.8 | 0.0026 | | | [CVE-2026-92020](https://patchblox.com/security/data/cve/CVE-2026-92020.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component | 8.8 | 0.0026 | | | [CVE-2026-16405](https://patchblox.com/security/data/cve/CVE-2026-16405.md) | High | Information disclosure in the Networking: WebSockets component | 8.8 | 0.0026 | | | [CVE-2026-84132](https://patchblox.com/security/data/cve/CVE-2026-84132.md) | High | Information disclosure in the Networking: HTTP component | 7.5 | 0.0026 | | | [CVE-2026-12310](https://patchblox.com/security/data/cve/CVE-2026-12310.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12312](https://patchblox.com/security/data/cve/CVE-2026-12312.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12314](https://patchblox.com/security/data/cve/CVE-2026-12314.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12302](https://patchblox.com/security/data/cve/CVE-2026-12302.md) | High | Mitigation bypass in the DOM: Security component | 7.5 | 0.0025 | | | [CVE-2026-92053](https://patchblox.com/security/data/cve/CVE-2026-92053.md) | High | Privilege escalation in the Graphics: CanvasWebGL component | 8.8 | 0.0025 | | | [CVE-2026-100832](https://patchblox.com/security/data/cve/CVE-2026-100832.md) | High | Use-after-free in the Graphics: Canvas2D component | 8.8 | 0.0025 | | | [CVE-2026-92054](https://patchblox.com/security/data/cve/CVE-2026-92054.md) | High | Privilege escalation in the Memory component | 8.8 | 0.0024 | | | [CVE-2026-16396](https://patchblox.com/security/data/cve/CVE-2026-16396.md) | High | Privilege escalation in WebExtensions | 8.8 | 0.0024 | | | [CVE-2026-92017](https://patchblox.com/security/data/cve/CVE-2026-92017.md) | High | Privilege escalation in the DOM: Service Workers component | 8.8 | 0.0024 | | | [CVE-2026-92043](https://patchblox.com/security/data/cve/CVE-2026-92043.md) | High | Privilege escalation due to incorrect boundary conditions in the Audio/Video component | 8.8 | 0.0024 | | | [CVE-2026-92052](https://patchblox.com/security/data/cve/CVE-2026-92052.md) | High | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component | 8.8 | 0.0024 | | | [CVE-2026-12309](https://patchblox.com/security/data/cve/CVE-2026-12309.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0024 | | | [CVE-2026-92049](https://patchblox.com/security/data/cve/CVE-2026-92049.md) | High | Use-after-free in the Widget: Win32 component | 8.8 | 0.0023 | | | [CVE-2026-92056](https://patchblox.com/security/data/cve/CVE-2026-92056.md) | High | Use-after-free in the Graphics: Text component | 8.8 | 0.0023 | | | [CVE-2026-92058](https://patchblox.com/security/data/cve/CVE-2026-92058.md) | High | Use-after-free in the Graphics component | 8.8 | 0.0023 | | | [CVE-2026-92060](https://patchblox.com/security/data/cve/CVE-2026-92060.md) | High | Use-after-free in the Internationalization component | 8.8 | 0.0023 | | | [CVE-2026-92067](https://patchblox.com/security/data/cve/CVE-2026-92067.md) | High | Use-after-free in the Widget: Gtk component | 8.8 | 0.0023 | | | [CVE-2026-12325](https://patchblox.com/security/data/cve/CVE-2026-12325.md) | High | Denial-of-service in the Graphics: ImageLib component | 7.5 | 0.0023 | | | [CVE-2026-92055](https://patchblox.com/security/data/cve/CVE-2026-92055.md) | High | Privilege escalation in the DevTools component | 8.8 | 0.0023 | | | [CVE-2026-92072](https://patchblox.com/security/data/cve/CVE-2026-92072.md) | High | Incorrect boundary conditions in the Safe Browsing component | 8.0 | 0.0023 | | | [CVE-2026-92042](https://patchblox.com/security/data/cve/CVE-2026-92042.md) | High | Race condition in the DOM: Content Processes component | 7.5 | 0.0022 | | | [CVE-2026-92047](https://patchblox.com/security/data/cve/CVE-2026-92047.md) | High | Privilege escalation in the Crash Reporting component | 8.8 | 0.0022 | | | [CVE-2026-92062](https://patchblox.com/security/data/cve/CVE-2026-92062.md) | High | Privilege escalation in the Session Restore component | 8.8 | 0.0022 | | | [CVE-2026-92073](https://patchblox.com/security/data/cve/CVE-2026-92073.md) | High | Privilege escalation in the Enterprise Policies component | 8.8 | 0.0022 | | | [CVE-2026-84120](https://patchblox.com/security/data/cve/CVE-2026-84120.md) | High | Use-after-free in the Audio/Video component | 7.5 | 0.0022 | | | [CVE-2026-92030](https://patchblox.com/security/data/cve/CVE-2026-92030.md) | High | Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0022 | | | [CVE-2026-16398](https://patchblox.com/security/data/cve/CVE-2026-16398.md) | High | Site isolation issue in the Graphics component | 7.5 | 0.0022 | | | [CVE-2026-16399](https://patchblox.com/security/data/cve/CVE-2026-16399.md) | High | Site isolation issue in the DOM: Navigation component | 7.5 | 0.0022 | | | [CVE-2026-84122](https://patchblox.com/security/data/cve/CVE-2026-84122.md) | High | Use-after-free in the Audio/Video component | 7.5 | 0.0021 | | | [CVE-2026-74981](https://patchblox.com/security/data/cve/CVE-2026-74981.md) | High | Site isolation issue in the Audio/Video: Web Codecs component | 8.1 | 0.0021 | | | [CVE-2026-12324](https://patchblox.com/security/data/cve/CVE-2026-12324.md) | High | Incorrect boundary conditions in the Graphics: CanvasWebGL component | 7.5 | 0.0021 | | | [CVE-2026-84129](https://patchblox.com/security/data/cve/CVE-2026-84129.md) | High | Site isolation issue in the DOM: Navigation component | 9.8 | 0.0019 | | | [CVE-2026-84133](https://patchblox.com/security/data/cve/CVE-2026-84133.md) | High | Site isolation issue in the DOM: Push Subscriptions component | 9.8 | 0.0019 | | | [CVE-2026-12311](https://patchblox.com/security/data/cve/CVE-2026-12311.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0019 | | | [CVE-2026-84140](https://patchblox.com/security/data/cve/CVE-2026-84140.md) | High | Site isolation issue in the DOM: Navigation component | 9.8 | 0.0018 | | | [CVE-2026-12313](https://patchblox.com/security/data/cve/CVE-2026-12313.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0018 | | | [CVE-2026-74973](https://patchblox.com/security/data/cve/CVE-2026-74973.md) | High | Race condition, use-after-free in the Graphics component | 7.5 | 0.0018 | | | [CVE-2026-84124](https://patchblox.com/security/data/cve/CVE-2026-84124.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0017 | | | [CVE-2026-74960](https://patchblox.com/security/data/cve/CVE-2026-74960.md) | High | Site isolation issue in the WebExtensions component | 8.1 | 0.0016 | | | [CVE-2026-74962](https://patchblox.com/security/data/cve/CVE-2026-74962.md) | High | Site isolation issue in the Networking: Cookies component | 8.1 | 0.0016 | | | [CVE-2026-74934](https://patchblox.com/security/data/cve/CVE-2026-74934.md) | High | Site isolation issue in the Graphics: CanvasWebGL component | 7.5 | 0.0016 | | | [CVE-2026-74974](https://patchblox.com/security/data/cve/CVE-2026-74974.md) | High | Same-origin policy bypass in the Graphics: ImageLib component | 7.5 | 0.0014 | | | [CVE-2026-74963](https://patchblox.com/security/data/cve/CVE-2026-74963.md) | High | Same-origin policy bypass in the Networking: Cookies component | 7.5 | 0.0012 | | | [CVE-2026-74967](https://patchblox.com/security/data/cve/CVE-2026-74967.md) | High | Same-origin policy bypass in the Audio/Video: Playback component | 7.5 | 0.0012 | | | [CVE-2026-92074](https://patchblox.com/security/data/cve/CVE-2026-92074.md) | High | Mitigation bypass in the Popup Blocker component | 8.8 | 0.0011 | | | [CVE-2026-92076](https://patchblox.com/security/data/cve/CVE-2026-92076.md) | High | Incorrect boundary conditions in the Networking component | 8.8 | 0.0011 | | | [CVE-2026-92064](https://patchblox.com/security/data/cve/CVE-2026-92064.md) | High | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 8.8 | 0.0010 | | | [CVE-2026-92065](https://patchblox.com/security/data/cve/CVE-2026-92065.md) | High | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 8.8 | 0.0010 | | | [CVE-2026-10702](https://patchblox.com/security/data/cve/CVE-2026-10702.md) | Routine | JIT miscompilation in the JavaScript Engine: JIT component | 4.3 | 0.0086 | | | [CVE-2026-92063](https://patchblox.com/security/data/cve/CVE-2026-92063.md) | Routine | Denial-of-service in the Audio/Video component | 6.5 | 0.0038 | | | [CVE-2026-84138](https://patchblox.com/security/data/cve/CVE-2026-84138.md) | Routine | Denial-of-service in the PDF Viewer component | 6.5 | 0.0037 | | | [CVE-2026-16403](https://patchblox.com/security/data/cve/CVE-2026-16403.md) | Routine | Spoofing issue in the Address Bar component | 6.5 | 0.0035 | | | [CVE-2026-84139](https://patchblox.com/security/data/cve/CVE-2026-84139.md) | Routine | Clickjacking issue in the DOM: Events component | 6.1 | 0.0034 | | | [CVE-2026-84126](https://patchblox.com/security/data/cve/CVE-2026-84126.md) | Routine | Incorrect boundary conditions in the Layout: Grid component | 4.3 | 0.0031 | | | [CVE-2026-16397](https://patchblox.com/security/data/cve/CVE-2026-16397.md) | Routine | Clickjacking issue in the WebExtensions component in Firefox for Android | 6.5 | 0.0030 | | | [CVE-2026-84118](https://patchblox.com/security/data/cve/CVE-2026-84118.md) | Routine | Use-after-free in the JavaScript: GC component | 5.4 | 0.0029 | | | [CVE-2026-84125](https://patchblox.com/security/data/cve/CVE-2026-84125.md) | Routine | Use-after-free in the DOM: Core & HTML component | 5.4 | 0.0029 | | | [CVE-2026-74984](https://patchblox.com/security/data/cve/CVE-2026-74984.md) | Routine | Race condition in the JavaScript Engine component | 6.8 | 0.0028 | | | [CVE-2026-92077](https://patchblox.com/security/data/cve/CVE-2026-92077.md) | Routine | Denial-of-service in the SVG component | 6.5 | 0.0027 | | | [CVE-2026-12300](https://patchblox.com/security/data/cve/CVE-2026-12300.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-12301](https://patchblox.com/security/data/cve/CVE-2026-12301.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-12303](https://patchblox.com/security/data/cve/CVE-2026-12303.md) | Routine | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component | 4.3 | 0.0022 | | | [CVE-2026-92078](https://patchblox.com/security/data/cve/CVE-2026-92078.md) | Routine | Denial-of-service in the Security component | 6.5 | 0.0022 | | | [CVE-2026-12319](https://patchblox.com/security/data/cve/CVE-2026-12319.md) | Routine | Denial-of-service in the Audio/Video: Playback component | 6.5 | 0.0021 | | | [CVE-2026-12322](https://patchblox.com/security/data/cve/CVE-2026-12322.md) | Routine | Clickjacking issue in the Widget: Gtk component | 5.4 | 0.0021 | | | [CVE-2026-84136](https://patchblox.com/security/data/cve/CVE-2026-84136.md) | Routine | Other issue in the DOM: Navigation component | 6.1 | 0.0020 | | | [CVE-2026-92039](https://patchblox.com/security/data/cve/CVE-2026-92039.md) | Routine | Mitigation bypass in the DOM: Notifications component | 6.3 | 0.0020 | | | [CVE-2026-92070](https://patchblox.com/security/data/cve/CVE-2026-92070.md) | Routine | Information disclosure in the Networking component | 4.3 | 0.0019 | | | [CVE-2026-92069](https://patchblox.com/security/data/cve/CVE-2026-92069.md) | Routine | Spoofing issue in the DOM: Navigation component | 5.4 | 0.0018 | | | [CVE-2026-12320](https://patchblox.com/security/data/cve/CVE-2026-12320.md) | Routine | Information disclosure in the Password Manager component | 4.3 | 0.0018 | | | [CVE-2026-12323](https://patchblox.com/security/data/cve/CVE-2026-12323.md) | Routine | Spoofing issue in the DOM: Core & HTML component | 5.4 | 0.0017 | | | [CVE-2026-12321](https://patchblox.com/security/data/cve/CVE-2026-12321.md) | Routine | JIT miscompilation in the JavaScript: WebAssembly component | 5.4 | 0.0016 | | | [CVE-2026-74968](https://patchblox.com/security/data/cve/CVE-2026-74968.md) | Routine | Site isolation issue in the Graphics: WebRender component | 5.4 | 0.0016 | | | [CVE-2026-74970](https://patchblox.com/security/data/cve/CVE-2026-74970.md) | Routine | Site isolation issue in the Graphics component | 5.4 | 0.0016 | | | [CVE-2026-84137](https://patchblox.com/security/data/cve/CVE-2026-84137.md) | Routine | Spoofing issue in the DOM: Core & HTML component | 4.3 | 0.0013 | | | [CVE-2026-92068](https://patchblox.com/security/data/cve/CVE-2026-92068.md) | Routine | Site isolation issue in the Reader Mode component | 5.4 | 0.0011 | | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.