# Mozilla Firefox ESR (hsb) 128.3.0

Mozilla Firefox ESR (hsb) 128.3.0, released October 1, 2024, fixes 178 CVEs in Mozilla Firefox ESR (hsb). 2 of them are being exploited (CVE-2023-4863); 2 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Firefox ESR (hsb) is 153.7.0, which also fixes every one of these CVEs.

- Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr.hsb-128.3.0
- Platform: Windows apps
- Released: Oct 1, 2024
- Priority: Patch now (Closes CVE-2023-4863, exploited (CISA KEV))
- CVEs: 178, exploited: 2, on CISA KEV: 2
- Superseded by: [Mozilla Firefox ESR (hsb) 153.7.0](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-hsb.md), the latest version, which also fixes every CVE listed here

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Mozilla Firefox ESR (hsb)](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-hsb.md) |  | 128.3.0 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2023-4863](https://patchblox.com/security/data/cve/CVE-2023-4863.md) | Patch now | Chromium: CVE-2023-4863 Heap buffer overflow in WebP | 9.6 | 0.9998 | CISA KEV, Disclosed |
| [CVE-2023-5217](https://patchblox.com/security/data/cve/CVE-2023-5217.md) | Patch now | Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx | 8.8 | 0.4901 | CISA KEV, Disclosed |
| [CVE-2024-29944](https://patchblox.com/security/data/cve/CVE-2024-29944.md) | Urgent | Mozilla Firefox ESR and 3 others: Inclusion of Web Functionality from an Untrusted Source | 8.8 | 0.0470 |  |
| [CVE-2023-5176](https://patchblox.com/security/data/cve/CVE-2023-5176.md) | Urgent | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0139 |  |
| [CVE-2023-5174](https://patchblox.com/security/data/cve/CVE-2023-5174.md) | Urgent | Mozilla Firefox ESR and 5 others: Use After Free | 9.8 | 0.0120 |  |
| [CVE-2023-5168](https://patchblox.com/security/data/cve/CVE-2023-5168.md) | Urgent | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 9.8 | 0.0112 |  |
| [CVE-2024-6602](https://patchblox.com/security/data/cve/CVE-2024-6602.md) | Urgent | Memory corruption in NSS | 9.8 | 0.0099 |  |
| [CVE-2023-4056](https://patchblox.com/security/data/cve/CVE-2023-4056.md) | Urgent | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0,… | 9.8 | 0.0095 |  |
| [CVE-2023-4057](https://patchblox.com/security/data/cve/CVE-2023-4057.md) | Urgent | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. | 9.8 | 0.0089 |  |
| [CVE-2024-3863](https://patchblox.com/security/data/cve/CVE-2024-3863.md) | Urgent | Mozilla Firefox ESR and 5 others: Unrestricted Upload of File with Dangerous Type | 9.8 | 0.0081 |  |
| [CVE-2023-4058](https://patchblox.com/security/data/cve/CVE-2023-4058.md) | Urgent | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 115. | 9.8 | 0.0079 |  |
| [CVE-2024-4367](https://patchblox.com/security/data/cve/CVE-2024-4367.md) | High | Mozilla Firefox ESR and 6 others: Improper Check for Unusual or Exceptional Conditions | 8.8 | 0.7066 |  |
| [CVE-2024-29943](https://patchblox.com/security/data/cve/CVE-2024-29943.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Read | 9.8 | 0.2294 |  |
| [CVE-2023-6856](https://patchblox.com/security/data/cve/CVE-2023-6856.md) | High | Mozilla Firefox ESR and 5 others: The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems… | 8.8 | 0.2063 |  |
| [CVE-2023-4050](https://patchblox.com/security/data/cve/CVE-2023-4050.md) | High | Mozilla Firefox ESR and 3 others: In some cases, an untrusted input stream was copied to a stack buffer without checking its size. | 7.5 | 0.1258 |  |
| [CVE-2024-0741](https://patchblox.com/security/data/cve/CVE-2024-0741.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 7.5 | 0.0216 |  |
| [CVE-2023-6858](https://patchblox.com/security/data/cve/CVE-2023-6858.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0154 |  |
| [CVE-2023-5730](https://patchblox.com/security/data/cve/CVE-2023-5730.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. | 9.8 | 0.0154 |  |
| [CVE-2023-5724](https://patchblox.com/security/data/cve/CVE-2023-5724.md) | High | Mozilla Firefox ESR and 5 others: Uncontrolled Resource Consumption | 7.5 | 0.0152 |  |
| [CVE-2023-6861](https://patchblox.com/security/data/cve/CVE-2023-6861.md) | High | Mozilla Firefox ESR and 5 others: The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless… | 8.8 | 0.0141 |  |
| [CVE-2023-5728](https://patchblox.com/security/data/cve/CVE-2023-5728.md) | High | Mozilla Firefox ESR and 5 others: Use After Free | 7.5 | 0.0132 |  |
| [CVE-2024-0743](https://patchblox.com/security/data/cve/CVE-2024-0743.md) | High | Mozilla Firefox ESR and 5 others: Unchecked Return Value | 7.5 | 0.0129 |  |
| [CVE-2023-6864](https://patchblox.com/security/data/cve/CVE-2023-6864.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. | 8.8 | 0.0119 |  |
| [CVE-2023-5731](https://patchblox.com/security/data/cve/CVE-2023-5731.md) | High | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 118. | 9.8 | 0.0115 |  |
| [CVE-2023-4046](https://patchblox.com/security/data/cve/CVE-2023-4046.md) | High | Mozilla Firefox ESR and 3 others: Allocation of Resources Without Limits or Throttling | 7.5 | 0.0113 |  |
| [CVE-2024-2607](https://patchblox.com/security/data/cve/CVE-2024-2607.md) | High | Mozilla Firefox ESR and 5 others: Write-what-where Condition | 8.1 | 0.0111 |  |
| [CVE-2023-6859](https://patchblox.com/security/data/cve/CVE-2023-6859.md) | High | Mozilla Firefox ESR and 5 others: A use-after-free condition affected TLS socket creation when under memory pressure. | 8.8 | 0.0109 |  |
| [CVE-2024-5688](https://patchblox.com/security/data/cve/CVE-2024-5688.md) | High | Mozilla Firefox ESR and 6 others: Use After Free | 8.1 | 0.0107 |  |
| [CVE-2023-5175](https://patchblox.com/security/data/cve/CVE-2023-5175.md) | High | Mozilla Firefox ESR and 3 others: Use After Free | 9.8 | 0.0104 |  |
| [CVE-2023-6863](https://patchblox.com/security/data/cve/CVE-2023-6863.md) | High | Mozilla Firefox ESR and 5 others: The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic… | 8.8 | 0.0104 |  |
| [CVE-2023-5172](https://patchblox.com/security/data/cve/CVE-2023-5172.md) | High | Mozilla Firefox ESR and 3 others: Use After Free | 9.8 | 0.0101 |  |
| [CVE-2024-2612](https://patchblox.com/security/data/cve/CVE-2024-2612.md) | High | Mozilla Firefox ESR and 5 others: Use After Free | 8.1 | 0.0097 |  |
| [CVE-2023-6212](https://patchblox.com/security/data/cve/CVE-2023-6212.md) | High | Mozilla Firefox ESR and 5 others: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. | 8.8 | 0.0095 |  |
| [CVE-2023-4048](https://patchblox.com/security/data/cve/CVE-2023-4048.md) | High | Mozilla Firefox ESR and 3 others: An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low… | 7.5 | 0.0093 |  |
| [CVE-2023-5173](https://patchblox.com/security/data/cve/CVE-2023-5173.md) | High | Mozilla Firefox ESR and 3 others: In a non-standard configuration of Firefox, an integer overflow could have occurred based on network… | 7.5 | 0.0091 |  |
| [CVE-2023-6207](https://patchblox.com/security/data/cve/CVE-2023-6207.md) | High | Mozilla Firefox ESR and 5 others: Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox… | 8.8 | 0.0091 |  |
| [CVE-2023-6208](https://patchblox.com/security/data/cve/CVE-2023-6208.md) | High | Mozilla Firefox ESR and 5 others: When using X11, text selected by the page using the Selection API was erroneously copied into the primary… | 8.8 | 0.0089 |  |
| [CVE-2023-6865](https://patchblox.com/security/data/cve/CVE-2023-6865.md) | High | Mozilla Firefox ESR and 3 others: `EncryptingOutputStream` was susceptible to exposing uninitialized data. | 7.5 | 0.0089 |  |
| [CVE-2024-2614](https://patchblox.com/security/data/cve/CVE-2024-2614.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Write | 8.8 | 0.0089 |  |
| [CVE-2023-6205](https://patchblox.com/security/data/cve/CVE-2023-6205.md) | High | Mozilla Firefox ESR and 5 others: It was possible to cause the use of a MessagePort after it had already been freed, which could potentially… | 7.5 | 0.0087 |  |
| [CVE-2024-1553](https://patchblox.com/security/data/cve/CVE-2024-1553.md) | High | Mozilla Firefox ESR and 5 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.1 | 0.0087 |  |
| [CVE-2024-5702](https://patchblox.com/security/data/cve/CVE-2024-5702.md) | High | Mozilla Firefox ESR and 5 others: Use After Free | 7.5 | 0.0086 |  |
| [CVE-2024-3864](https://patchblox.com/security/data/cve/CVE-2024-3864.md) | High | Mozilla Firefox ESR and 5 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.1 | 0.0085 |  |
| [CVE-2023-6873](https://patchblox.com/security/data/cve/CVE-2023-6873.md) | High | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 120. | 8.8 | 0.0085 |  |
| [CVE-2023-6204](https://patchblox.com/security/data/cve/CVE-2023-6204.md) | High | Mozilla Firefox ESR and 5 others: On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds… | 7.5 | 0.0084 |  |
| [CVE-2024-0750](https://patchblox.com/security/data/cve/CVE-2024-0750.md) | High | Mozilla Firefox ESR and 5 others: User Interface (UI) Misrepresentation of Critical Information | 8.8 | 0.0084 |  |
| [CVE-2023-4576](https://patchblox.com/security/data/cve/CVE-2023-4576.md) | High | Integer Overflow in RecordedSourceSurfaceCreation | 8.6 | 0.0082 |  |
| [CVE-2024-5696](https://patchblox.com/security/data/cve/CVE-2024-5696.md) | High | Mozilla Firefox ESR and 6 others: Out-of-bounds Write | 8.6 | 0.0081 |  |
| [CVE-2023-5721](https://patchblox.com/security/data/cve/CVE-2023-5721.md) | High | Mozilla Firefox ESR and 5 others: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally… | 7.5 | 0.0081 |  |
| [CVE-2023-4584](https://patchblox.com/security/data/cve/CVE-2023-4584.md) | High | Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2 | 8.8 | 0.0080 |  |
| [CVE-2023-4585](https://patchblox.com/security/data/cve/CVE-2023-4585.md) | High | Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2 | 8.8 | 0.0077 |  |
| [CVE-2024-5699](https://patchblox.com/security/data/cve/CVE-2024-5699.md) | High | Mozilla Firefox ESR and 4 others: Improper Handling of Case Sensitivity | 9.8 | 0.0077 |  |
| [CVE-2023-4053](https://patchblox.com/security/data/cve/CVE-2023-4053.md) | High | Full screen notification obscured by external program | 8.8 | 0.0077 |  |
| [CVE-2024-0755](https://patchblox.com/security/data/cve/CVE-2024-0755.md) | High | Mozilla Firefox ESR and 5 others: Improper Control of Generation of Code ('Code Injection') | 8.8 | 0.0075 |  |
| [CVE-2024-3854](https://patchblox.com/security/data/cve/CVE-2024-3854.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Read | 8.8 | 0.0073 |  |
| [CVE-2023-4055](https://patchblox.com/security/data/cve/CVE-2023-4055.md) | High | Mozilla Firefox ESR and 3 others: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 7.5 | 0.0073 |  |
| [CVE-2024-1546](https://patchblox.com/security/data/cve/CVE-2024-1546.md) | High | Mozilla Firefox ESR and 5 others: Out-of-bounds Read | 7.5 | 0.0072 |  |
| [CVE-2023-5170](https://patchblox.com/security/data/cve/CVE-2023-5170.md) | High | Mozilla Firefox ESR and 3 others: In canvas rendering, a compromised content process could have caused a surface to change unexpectedly,… | 7.4 | 0.0072 |  |
| [CVE-2023-4583](https://patchblox.com/security/data/cve/CVE-2023-4583.md) | High | Browsing Context potentially not cleared when closing Private Window | 8.8 | 0.0069 |  |
| [CVE-2023-6866](https://patchblox.com/security/data/cve/CVE-2023-6866.md) | High | Mozilla Firefox ESR and 3 others: TypedArrays can be fallible and lacked proper exception handling. | 8.8 | 0.0068 |  |
| [CVE-2024-1547](https://patchblox.com/security/data/cve/CVE-2024-1547.md) | High | Mozilla Firefox ESR and 5 others: Authentication Bypass by Spoofing | 7.5 | 0.0068 |  |
| [CVE-2023-6213](https://patchblox.com/security/data/cve/CVE-2023-6213.md) | High | Mozilla Firefox ESR and 3 others: Memory safety bugs present in Firefox 119. | 8.8 | 0.0067 |  |
| [CVE-2023-4574](https://patchblox.com/security/data/cve/CVE-2023-4574.md) | High | Memory corruption in IPC ColorPickerShownCallback | 8.8 | 0.0066 |  |
| [CVE-2024-6611](https://patchblox.com/security/data/cve/CVE-2024-6611.md) | High | Incorrect handling of SameSite cookies | 9.8 | 0.0066 |  |
| [CVE-2024-0745](https://patchblox.com/security/data/cve/CVE-2024-0745.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 8.8 | 0.0066 |  |
| [CVE-2023-4051](https://patchblox.com/security/data/cve/CVE-2023-4051.md) | High | Full screen notification obscured by file open dialog | 8.8 | 0.0066 |  |
| [CVE-2023-4575](https://patchblox.com/security/data/cve/CVE-2023-4575.md) | High | Memory corruption in IPC FilePickerShownCallback | 8.8 | 0.0066 |  |
| [CVE-2024-7652](https://patchblox.com/security/data/cve/CVE-2024-7652.md) | High | Type Confusion in Async Generators in Javascript Engine | 8.6 | 0.0066 |  |
| [CVE-2023-4577](https://patchblox.com/security/data/cve/CVE-2023-4577.md) | High | Memory corruption in JIT UpdateRegExpStatics | 8.8 | 0.0065 |  |
| [CVE-2023-6206](https://patchblox.com/security/data/cve/CVE-2023-6206.md) | High | Mozilla Firefox ESR and 5 others: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay… | 7.5 | 0.0064 |  |
| [CVE-2023-4049](https://patchblox.com/security/data/cve/CVE-2023-4049.md) | High | Mozilla Firefox ESR and 3 others: Race conditions in reference counting code were found through code inspection. | 7.5 | 0.0063 |  |
| [CVE-2024-0751](https://patchblox.com/security/data/cve/CVE-2024-0751.md) | High | Mozilla Firefox ESR and 5 others: Improper Privilege Management | 8.8 | 0.0063 |  |
| [CVE-2023-4047](https://patchblox.com/security/data/cve/CVE-2023-4047.md) | High | Mozilla Firefox ESR and 3 others: Cross-Site Request Forgery (CSRF) | 8.8 | 0.0063 |  |
| [CVE-2023-4573](https://patchblox.com/security/data/cve/CVE-2023-4573.md) | High | Memory corruption in IPC CanvasTranslator | 8.8 | 0.0063 |  |
| [CVE-2024-3852](https://patchblox.com/security/data/cve/CVE-2024-3852.md) | High | Mozilla Firefox ESR and 5 others: Symbolic Name not Mapping to Correct Object | 7.5 | 0.0063 |  |
| [CVE-2023-4578](https://patchblox.com/security/data/cve/CVE-2023-4578.md) | High | Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception | 8.8 | 0.0062 |  |
| [CVE-2024-3856](https://patchblox.com/security/data/cve/CVE-2024-3856.md) | High | Mozilla Firefox ESR and 3 others: Use After Free | 8.8 | 0.0061 |  |
| [CVE-2024-0744](https://patchblox.com/security/data/cve/CVE-2024-0744.md) | High | Mozilla Firefox ESR and 3 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.5 | 0.0060 |  |
| [CVE-2024-0742](https://patchblox.com/security/data/cve/CVE-2024-0742.md) | High | Mozilla Firefox ESR and 5 others: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally… | 7.5 | 0.0060 |  |
| [CVE-2024-2615](https://patchblox.com/security/data/cve/CVE-2024-2615.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 9.8 | 0.0060 |  |
| [CVE-2024-4770](https://patchblox.com/security/data/cve/CVE-2024-4770.md) | High | Mozilla Firefox ESR and 6 others: Use After Free | 8.8 | 0.0059 |  |
| [CVE-2023-4045](https://patchblox.com/security/data/cve/CVE-2023-4045.md) | High | Mozilla Firefox ESR and 3 others: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image… | 7.5 | 0.0059 |  |
| [CVE-2024-5695](https://patchblox.com/security/data/cve/CVE-2024-5695.md) | High | Mozilla Firefox ESR and 4 others: Out-of-bounds Write | 9.8 | 0.0058 |  |
| [CVE-2024-5701](https://patchblox.com/security/data/cve/CVE-2024-5701.md) | High | Mozilla Firefox ESR and 4 others: Out-of-bounds Write | 9.8 | 0.0058 |  |
| [CVE-2024-6609](https://patchblox.com/security/data/cve/CVE-2024-6609.md) | High | Memory corruption in NSS | 8.8 | 0.0058 |  |
| [CVE-2023-4581](https://patchblox.com/security/data/cve/CVE-2023-4581.md) | High | XLL file extensions were downloadable without warnings | 8.8 | 0.0057 |  |
| [CVE-2024-4764](https://patchblox.com/security/data/cve/CVE-2024-4764.md) | High | Mozilla Firefox ESR and 4 others: Use After Free | 9.8 | 0.0057 |  |
| [CVE-2024-3858](https://patchblox.com/security/data/cve/CVE-2024-3858.md) | High | Mozilla Firefox ESR and 3 others: NULL Pointer Dereference | 7.5 | 0.0057 |  |
| [CVE-2024-6607](https://patchblox.com/security/data/cve/CVE-2024-6607.md) | High | Leaving pointerlock by pressing the escape key could be prevented | 8.8 | 0.0056 |  |
| [CVE-2024-1557](https://patchblox.com/security/data/cve/CVE-2024-1557.md) | High | Mozilla Firefox ESR and 3 others: Out-of-bounds Write | 8.1 | 0.0056 |  |
| [CVE-2024-4773](https://patchblox.com/security/data/cve/CVE-2024-4773.md) | High | Mozilla Firefox ESR and 4 others: URL Redirection to Untrusted Site ('Open Redirect') | 7.5 | 0.0054 |  |
| [CVE-2024-6604](https://patchblox.com/security/data/cve/CVE-2024-6604.md) | High | Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 | 7.5 | 0.0054 |  |
| [CVE-2024-6603](https://patchblox.com/security/data/cve/CVE-2024-6603.md) | High | Memory corruption in thread creation | 7.5 | 0.0054 |  |
| [CVE-2024-4777](https://patchblox.com/security/data/cve/CVE-2024-4777.md) | High | Mozilla Firefox ESR and 6 others: Use After Free | 8.8 | 0.0054 |  |
| [CVE-2024-4771](https://patchblox.com/security/data/cve/CVE-2024-4771.md) | High | Mozilla Firefox ESR and 4 others: Use After Free | 8.6 | 0.0052 |  |
| [CVE-2024-2613](https://patchblox.com/security/data/cve/CVE-2024-2613.md) | High | Mozilla Firefox ESR and 3 others: Improper Restriction of Rendered UI Layers or Frames | 7.5 | 0.0050 |  |
| [CVE-2024-9399](https://patchblox.com/security/data/cve/CVE-2024-9399.md) | High | Mozilla Firefox ESR and 7 others: Improper Resource Shutdown or Release | 7.5 | 0.0050 |  |
| [CVE-2024-3865](https://patchblox.com/security/data/cve/CVE-2024-3865.md) | High | Mozilla Firefox ESR and 3 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.1 | 0.0049 |  |
| [CVE-2024-1555](https://patchblox.com/security/data/cve/CVE-2024-1555.md) | High | Mozilla Firefox ESR and 3 others: Authentication Bypass by Spoofing | 8.3 | 0.0048 |  |
| [CVE-2024-5694](https://patchblox.com/security/data/cve/CVE-2024-5694.md) | High | Mozilla Firefox ESR and 4 others: Use After Free | 7.5 | 0.0047 |  |
| [CVE-2024-6615](https://patchblox.com/security/data/cve/CVE-2024-6615.md) | High | Memory safety bugs fixed in Firefox 128 and Thunderbird 128 | 8.8 | 0.0045 |  |
| [CVE-2024-4778](https://patchblox.com/security/data/cve/CVE-2024-4778.md) | High | Mozilla Firefox ESR and 4 others: Improper Handling of Overlap Between Protected Memory Ranges | 9.8 | 0.0044 |  |
| [CVE-2024-5700](https://patchblox.com/security/data/cve/CVE-2024-5700.md) | High | Mozilla Firefox ESR and 6 others: Access of Memory Location Before Start of Buffer | 7.5 | 0.0044 |  |
| [CVE-2023-4580](https://patchblox.com/security/data/cve/CVE-2023-4580.md) | High | Push notifications saved to disk unencrypted | 8.8 | 0.0042 |  |
| [CVE-2024-4776](https://patchblox.com/security/data/cve/CVE-2024-4776.md) | High | Mozilla Firefox ESR and 4 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 8.2 | 0.0042 |  |
| [CVE-2024-6606](https://patchblox.com/security/data/cve/CVE-2024-6606.md) | High | Out-of-bounds read in clipboard component | 8.2 | 0.0040 |  |
| [CVE-2024-6601](https://patchblox.com/security/data/cve/CVE-2024-6601.md) | High | Race condition in permission assignment | 7.5 | 0.0039 |  |
| [CVE-2024-2608](https://patchblox.com/security/data/cve/CVE-2024-2608.md) | High | Mozilla Firefox ESR and 5 others: Integer Overflow to Buffer Overflow | 8.4 | 0.0039 |  |
| [CVE-2024-1554](https://patchblox.com/security/data/cve/CVE-2024-1554.md) | High | Mozilla Firefox ESR and 3 others: Insufficient Verification of Data Authenticity | 9.8 | 0.0038 |  |
| [CVE-2024-3853](https://patchblox.com/security/data/cve/CVE-2024-3853.md) | High | Mozilla Firefox ESR and 3 others: A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage… | 7.5 | 0.0036 |  |
| [CVE-2024-6605](https://patchblox.com/security/data/cve/CVE-2024-6605.md) | High | Firefox Android missed activation delay to prevent tapjacking | 8.8 | 0.0036 |  |
| [CVE-2024-4765](https://patchblox.com/security/data/cve/CVE-2024-4765.md) | High | Mozilla Firefox ESR and 4 others: Use of a Broken or Risky Cryptographic Algorithm | 8.1 | 0.0027 |  |
| [CVE-2024-3857](https://patchblox.com/security/data/cve/CVE-2024-3857.md) | High | Mozilla Firefox ESR and 5 others: Use After Free | 7.8 | 0.0025 |  |
| [CVE-2023-6209](https://patchblox.com/security/data/cve/CVE-2023-6209.md) | Routine | Mozilla Firefox ESR and 5 others: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in… | 6.5 | 0.0142 |  |
| [CVE-2023-5171](https://patchblox.com/security/data/cve/CVE-2023-5171.md) | Routine | Mozilla Firefox ESR and 5 others: During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing… | 6.5 | 0.0112 |  |
| [CVE-2023-5169](https://patchblox.com/security/data/cve/CVE-2023-5169.md) | Routine | Mozilla Firefox ESR and 5 others: A compromised content process could have provided malicious data in a `PathRecording` resulting in an… | 6.5 | 0.0110 |  |
| [CVE-2023-5732](https://patchblox.com/security/data/cve/CVE-2023-5732.md) | Routine | Address bar spoofing via bidirectional characters | 6.5 | 0.0105 |  |
| [CVE-2023-5388](https://patchblox.com/security/data/cve/CVE-2023-5388.md) | Routine | Mozilla Firefox ESR and 5 others: NSS was susceptible to a timing side-channel attack when performing RSA decryption. | 6.5 | 0.0097 |  |
| [CVE-2023-6860](https://patchblox.com/security/data/cve/CVE-2023-6860.md) | Routine | Mozilla Firefox ESR and 5 others: The `VideoBridge` allowed any content process to use textures produced by remote decoders. | 6.5 | 0.0096 |  |
| [CVE-2024-1548](https://patchblox.com/security/data/cve/CVE-2024-1548.md) | Routine | Mozilla Firefox ESR and 5 others: A website could have obscured the fullscreen notification by using a dropdown select input element. | 6.1 | 0.0095 |  |
| [CVE-2023-5725](https://patchblox.com/security/data/cve/CVE-2023-5725.md) | Routine | Mozilla Firefox ESR and 5 others: A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could… | 6.1 | 0.0094 |  |
| [CVE-2023-5727](https://patchblox.com/security/data/cve/CVE-2023-5727.md) | Routine | Mozilla Firefox ESR and 5 others: The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle… | 6.5 | 0.0083 |  |
| [CVE-2024-3302](https://patchblox.com/security/data/cve/CVE-2024-3302.md) | Routine | Mozilla Firefox ESR and 5 others: Allocation of Resources Without Limits or Throttling | 3.7 | 0.0077 |  |
| [CVE-2024-1551](https://patchblox.com/security/data/cve/CVE-2024-1551.md) | Routine | Mozilla Firefox ESR and 5 others: Reliance on Cookies without Validation and Integrity Checking | 6.1 | 0.0074 |  |
| [CVE-2024-0746](https://patchblox.com/security/data/cve/CVE-2024-0746.md) | Routine | Mozilla Firefox ESR and 5 others: Use After Free | 6.5 | 0.0074 |  |
| [CVE-2024-5690](https://patchblox.com/security/data/cve/CVE-2024-5690.md) | Routine | Mozilla Firefox ESR and 6 others: Observable Discrepancy | 6.1 | 0.0074 |  |
| [CVE-2024-0753](https://patchblox.com/security/data/cve/CVE-2024-0753.md) | Routine | Mozilla Firefox ESR and 5 others: In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. | 6.5 | 0.0072 |  |
| [CVE-2023-6135](https://patchblox.com/security/data/cve/CVE-2023-6135.md) | Routine | Mozilla Firefox ESR and 3 others: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". | 4.3 | 0.0071 |  |
| [CVE-2023-4052](https://patchblox.com/security/data/cve/CVE-2023-4052.md) | Routine | Mozilla Firefox ESR and 5 others: The Firefox updater created a directory writable by non-privileged users. | 6.5 | 0.0071 |  |
| [CVE-2024-2610](https://patchblox.com/security/data/cve/CVE-2024-2610.md) | Routine | Mozilla Firefox ESR and 5 others: Improper Control of Generation of Code ('Code Injection') | 6.1 | 0.0070 |  |
| [CVE-2023-5723](https://patchblox.com/security/data/cve/CVE-2023-5723.md) | Routine | Mozilla Firefox ESR and 3 others: An attacker with temporary script access to a site could have set a cookie containing invalid characters… | 5.3 | 0.0070 |  |
| [CVE-2023-5729](https://patchblox.com/security/data/cve/CVE-2023-5729.md) | Routine | Mozilla Firefox ESR and 3 others: A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. | 4.3 | 0.0070 |  |
| [CVE-2023-6867](https://patchblox.com/security/data/cve/CVE-2023-6867.md) | Routine | Mozilla Firefox ESR and 3 others: The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking… | 6.1 | 0.0068 |  |
| [CVE-2024-3859](https://patchblox.com/security/data/cve/CVE-2024-3859.md) | Routine | Mozilla Firefox ESR and 5 others: Integer Overflow or Wraparound | 6.1 | 0.0067 |  |
| [CVE-2024-5691](https://patchblox.com/security/data/cve/CVE-2024-5691.md) | Routine | Mozilla Firefox ESR and 6 others: Protection Mechanism Failure | 6.1 | 0.0065 |  |
| [CVE-2023-6872](https://patchblox.com/security/data/cve/CVE-2023-6872.md) | Routine | Mozilla Firefox ESR and 3 others: Browser tab titles were being leaked by GNOME to system logs. | 6.5 | 0.0065 |  |
| [CVE-2023-5722](https://patchblox.com/security/data/cve/CVE-2023-5722.md) | Routine | Mozilla Firefox ESR and 3 others: Using iterative requests an attacker was able to learn the size of an opaque response, as well as the… | 5.3 | 0.0065 |  |
| [CVE-2024-5692](https://patchblox.com/security/data/cve/CVE-2024-5692.md) | Routine | Mozilla Firefox ESR and 6 others: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into… | 6.5 | 0.0062 |  |
| [CVE-2023-6210](https://patchblox.com/security/data/cve/CVE-2023-6210.md) | Routine | Mozilla Firefox ESR and 3 others: When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed… | 6.5 | 0.0061 |  |
| [CVE-2024-2611](https://patchblox.com/security/data/cve/CVE-2024-2611.md) | Routine | Mozilla Firefox ESR and 5 others: A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into… | 6.1 | 0.0061 |  |
| [CVE-2024-2609](https://patchblox.com/security/data/cve/CVE-2024-2609.md) | Routine | Mozilla Firefox ESR and 5 others: Product UI does not Warn User of Unsafe Actions | 6.1 | 0.0060 |  |
| [CVE-2024-0747](https://patchblox.com/security/data/cve/CVE-2024-0747.md) | Routine | Mozilla Firefox ESR and 5 others: Protection Mechanism Failure | 6.5 | 0.0060 |  |
| [CVE-2024-2605](https://patchblox.com/security/data/cve/CVE-2024-2605.md) | Routine | Mozilla Firefox ESR and 5 others: An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping… | 5.9 | 0.0058 |  |
| [CVE-2024-5693](https://patchblox.com/security/data/cve/CVE-2024-5693.md) | Routine | Mozilla Firefox ESR and 6 others: Inclusion of Functionality from Untrusted Control Sphere | 6.1 | 0.0058 |  |
| [CVE-2024-1550](https://patchblox.com/security/data/cve/CVE-2024-1550.md) | Routine | Mozilla Firefox ESR and 5 others: Improper Restriction of Rendered UI Layers or Frames | 6.1 | 0.0058 |  |
| [CVE-2023-6869](https://patchblox.com/security/data/cve/CVE-2023-6869.md) | Routine | Mozilla Firefox ESR and 3 others: A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe. | 6.5 | 0.0056 |  |
| [CVE-2024-4768](https://patchblox.com/security/data/cve/CVE-2024-4768.md) | Routine | Mozilla Firefox ESR and 6 others: Improper Preservation of Permissions | 6.1 | 0.0054 |  |
| [CVE-2024-1549](https://patchblox.com/security/data/cve/CVE-2024-1549.md) | Routine | Mozilla Firefox ESR and 5 others: If a website set a large custom cursor, portions of the cursor could have overlapped with the permission… | 6.1 | 0.0053 |  |
| [CVE-2024-6612](https://patchblox.com/security/data/cve/CVE-2024-6612.md) | Routine | CSP violation leakage when using devtools | 5.3 | 0.0050 |  |
| [CVE-2023-6211](https://patchblox.com/security/data/cve/CVE-2023-6211.md) | Routine | Mozilla Firefox ESR and 3 others: If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only… | 6.5 | 0.0049 |  |
| [CVE-2023-6871](https://patchblox.com/security/data/cve/CVE-2023-6871.md) | Routine | Mozilla Firefox ESR and 3 others: Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new… | 4.3 | 0.0049 |  |
| [CVE-2024-4767](https://patchblox.com/security/data/cve/CVE-2024-4767.md) | Routine | Mozilla Firefox ESR and 6 others: Exposure of Private Personal Information to an Unauthorized Actor | 6.1 | 0.0049 |  |
| [CVE-2024-1556](https://patchblox.com/security/data/cve/CVE-2024-1556.md) | Routine | Mozilla Firefox ESR and 3 others: Improper Check for Unusual or Exceptional Conditions | 6.5 | 0.0047 |  |
| [CVE-2023-4579](https://patchblox.com/security/data/cve/CVE-2023-4579.md) | Routine | Persisted search terms were formatted as URLs | 3.1 | 0.0045 |  |
| [CVE-2024-2606](https://patchblox.com/security/data/cve/CVE-2024-2606.md) | Routine | Mozilla Firefox ESR and 3 others: Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers… | 3.7 | 0.0044 |  |
| [CVE-2024-10941](https://patchblox.com/security/data/cve/CVE-2024-10941.md) | Routine | Mozilla Firefox ESR and 4 others: Improper Neutralization of Invalid Characters in Identifiers in Web Pages | 6.5 | 0.0043 |  |
| [CVE-2024-0754](https://patchblox.com/security/data/cve/CVE-2024-0754.md) | Routine | Mozilla Firefox ESR and 3 others: Uncaught Exception | 6.5 | 0.0043 |  |
| [CVE-2024-0752](https://patchblox.com/security/data/cve/CVE-2024-0752.md) | Routine | Mozilla Firefox ESR and 3 others: Use After Free | 6.5 | 0.0042 |  |
| [CVE-2024-5687](https://patchblox.com/security/data/cve/CVE-2024-5687.md) | Routine | Mozilla Firefox ESR and 4 others: Improper Access Control | 5.3 | 0.0041 |  |
| [CVE-2024-3855](https://patchblox.com/security/data/cve/CVE-2024-3855.md) | Routine | Mozilla Firefox ESR and 3 others: Out-of-bounds Read | 6.5 | 0.0040 |  |
| [CVE-2024-5689](https://patchblox.com/security/data/cve/CVE-2024-5689.md) | Routine | Mozilla Firefox ESR and 4 others: In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the… | 4.3 | 0.0040 |  |
| [CVE-2024-6600](https://patchblox.com/security/data/cve/CVE-2024-6600.md) | Routine | Memory corruption in WebGL API | 6.3 | 0.0040 |  |
| [CVE-2024-5697](https://patchblox.com/security/data/cve/CVE-2024-5697.md) | Routine | Mozilla Firefox ESR and 4 others: Observable Discrepancy | 4.3 | 0.0040 |  |
| [CVE-2024-5698](https://patchblox.com/security/data/cve/CVE-2024-5698.md) | Routine | Mozilla Firefox ESR and 4 others: User Interface (UI) Misrepresentation of Critical Information | 6.1 | 0.0038 |  |
| [CVE-2024-6608](https://patchblox.com/security/data/cve/CVE-2024-6608.md) | Routine | Cursor could be moved out of the viewport using pointerlock. | 4.3 | 0.0038 |  |
| [CVE-2024-4774](https://patchblox.com/security/data/cve/CVE-2024-4774.md) | Routine | Mozilla Firefox ESR and 4 others: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | 6.5 | 0.0037 |  |
| [CVE-2024-6614](https://patchblox.com/security/data/cve/CVE-2024-6614.md) | Routine | Incorrect listing of stack frames | 4.3 | 0.0037 |  |
| [CVE-2024-4769](https://patchblox.com/security/data/cve/CVE-2024-4769.md) | Routine | Mozilla Firefox ESR and 6 others: Insufficient Type Distinction | 6.1 | 0.0037 |  |
| [CVE-2024-0748](https://patchblox.com/security/data/cve/CVE-2024-0748.md) | Routine | Mozilla Firefox ESR and 3 others: A compromised content process could have updated the document URI. | 4.3 | 0.0037 |  |
| [CVE-2024-3862](https://patchblox.com/security/data/cve/CVE-2024-3862.md) | Routine | Mozilla Firefox ESR and 3 others: Use of Uninitialized Resource | 5.3 | 0.0037 |  |
| [CVE-2024-6610](https://patchblox.com/security/data/cve/CVE-2024-6610.md) | Routine | Form validation popups could block exiting full-screen mode | 4.3 | 0.0034 |  |
| [CVE-2024-0749](https://patchblox.com/security/data/cve/CVE-2024-0749.md) | Routine | Mozilla Firefox ESR and 5 others: Origin Validation Error | 6.1 | 0.0034 |  |
| [CVE-2024-3861](https://patchblox.com/security/data/cve/CVE-2024-3861.md) | Routine | Mozilla Firefox ESR and 5 others: If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference… | 6.1 | 0.0023 |  |
| [CVE-2024-4775](https://patchblox.com/security/data/cve/CVE-2024-4775.md) | Routine | Mozilla Firefox ESR and 4 others: Missing Handler | 5.9 | 0.0022 |  |
| [CVE-2024-4772](https://patchblox.com/security/data/cve/CVE-2024-4772.md) | Routine | Mozilla Firefox ESR and 4 others: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | 5.9 | 0.0022 |  |
| [CVE-2023-4054](https://patchblox.com/security/data/cve/CVE-2023-4054.md) | Routine | Mozilla Firefox ESR and 4 others: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. | 5.5 | 0.0021 |  |
| [CVE-2024-6613](https://patchblox.com/security/data/cve/CVE-2024-6613.md) | Routine | Incorrect listing of stack frames | 5.5 | 0.0019 |  |
| [CVE-2024-3860](https://patchblox.com/security/data/cve/CVE-2024-3860.md) | Routine | Mozilla Firefox ESR and 3 others: Missing Release of Memory after Effective Lifetime | 6.2 | 0.0017 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.