# Mozilla Firefox ESR (id) 153.0.0 Mozilla Firefox ESR (id) 153.0.0, released July 20, 2026, fixes 389 CVEs in Mozilla Firefox ESR (id). None of them is reported as exploited. Patch Radar priority: Urgent. The latest Mozilla Firefox ESR (id) is 153.7.0, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr.id-153.0.0 - Platform: Windows apps - Released: Jul 20, 2026 - Priority: Urgent (Closes CVE-2026-2796, rated Critical) - CVEs: 389, exploited: 0, on CISA KEV: 0 - Superseded by: [Mozilla Firefox ESR (id) 153.7.0](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-id.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Mozilla Firefox ESR (id)](https://patchblox.com/security/data/product/windows-app/mozilla-firefox-esr-id.md) | | 153.0.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-2796](https://patchblox.com/security/data/cve/CVE-2026-2796.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0095 | | | [CVE-2026-16357](https://patchblox.com/security/data/cve/CVE-2026-16357.md) | Urgent | Incorrect boundary conditions in the Graphics component | 9.8 | 0.0087 | | | [CVE-2026-2805](https://patchblox.com/security/data/cve/CVE-2026-2805.md) | Urgent | Invalid pointer in the DOM: Core & HTML component | 9.8 | 0.0066 | | | [CVE-2026-16412](https://patchblox.com/security/data/cve/CVE-2026-16412.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0064 | | | [CVE-2026-4723](https://patchblox.com/security/data/cve/CVE-2026-4723.md) | Urgent | Use-after-free in the JavaScript Engine component | 9.8 | 0.0063 | | | [CVE-2026-16395](https://patchblox.com/security/data/cve/CVE-2026-16395.md) | Urgent | Integer overflow in the Audio/Video component | 9.8 | 0.0062 | | | [CVE-2026-16402](https://patchblox.com/security/data/cve/CVE-2026-16402.md) | Urgent | Integer overflow in the Graphics: ImageLib component | 9.8 | 0.0062 | | | [CVE-2026-16408](https://patchblox.com/security/data/cve/CVE-2026-16408.md) | Urgent | Integer overflow in the Audio/Video: Playback component | 9.8 | 0.0062 | | | [CVE-2025-8028](https://patchblox.com/security/data/cve/CVE-2025-8028.md) | Urgent | Large branch table could lead to truncated instruction | 9.8 | 0.0058 | | | [CVE-2026-16389](https://patchblox.com/security/data/cve/CVE-2026-16389.md) | Urgent | Incorrect boundary conditions, integer overflow in the Libraries component in NSS | 9.8 | 0.0057 | | | [CVE-2026-16382](https://patchblox.com/security/data/cve/CVE-2026-16382.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0056 | | | [CVE-2026-16388](https://patchblox.com/security/data/cve/CVE-2026-16388.md) | Urgent | Sandbox escape in the DOM: Networking component | 9.8 | 0.0055 | | | [CVE-2026-16410](https://patchblox.com/security/data/cve/CVE-2026-16410.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0055 | | | [CVE-2026-2799](https://patchblox.com/security/data/cve/CVE-2026-2799.md) | Urgent | Use-after-free in the DOM: Core & HTML component | 9.8 | 0.0054 | | | [CVE-2026-16393](https://patchblox.com/security/data/cve/CVE-2026-16393.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.1 | 0.0054 | | | [CVE-2026-16392](https://patchblox.com/security/data/cve/CVE-2026-16392.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.1 | 0.0053 | | | [CVE-2026-2797](https://patchblox.com/security/data/cve/CVE-2026-2797.md) | Urgent | Use-after-free in the JavaScript: GC component | 9.8 | 0.0053 | | | [CVE-2025-9187](https://patchblox.com/security/data/cve/CVE-2025-9187.md) | Urgent | Memory safety bugs fixed in Firefox 142 and Thunderbird 142 | 9.8 | 0.0052 | | | [CVE-2026-4724](https://patchblox.com/security/data/cve/CVE-2026-4724.md) | Urgent | Undefined behavior in the Audio/Video component | 9.1 | 0.0052 | | | [CVE-2026-16353](https://patchblox.com/security/data/cve/CVE-2026-16353.md) | Urgent | Invalid pointer in the DOM: Bindings (WebIDL) component | 9.8 | 0.0052 | | | [CVE-2026-16407](https://patchblox.com/security/data/cve/CVE-2026-16407.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0051 | | | [CVE-2025-8031](https://patchblox.com/security/data/cve/CVE-2025-8031.md) | Urgent | Incorrect URL stripping in CSP reports | 9.8 | 0.0051 | | | [CVE-2025-14326](https://patchblox.com/security/data/cve/CVE-2025-14326.md) | Urgent | Use-after-free in the Audio/Video: GMP component | 9.8 | 0.0050 | | | [CVE-2026-16411](https://patchblox.com/security/data/cve/CVE-2026-16411.md) | Urgent | Memory safety bugs fixed in Thunderbird 153 | 9.8 | 0.0049 | | | [CVE-2025-8044](https://patchblox.com/security/data/cve/CVE-2025-8044.md) | Urgent | Memory safety bugs fixed in Firefox 141 and Thunderbird 141 | 9.8 | 0.0048 | | | [CVE-2026-16360](https://patchblox.com/security/data/cve/CVE-2026-16360.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0047 | | | [CVE-2025-8034](https://patchblox.com/security/data/cve/CVE-2025-8034.md) | Urgent | Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0046 | | | [CVE-2026-2806](https://patchblox.com/security/data/cve/CVE-2026-2806.md) | Urgent | Uninitialized memory in the Graphics: Text component | 9.1 | 0.0045 | | | [CVE-2026-0892](https://patchblox.com/security/data/cve/CVE-2026-0892.md) | Urgent | Memory safety bugs fixed in Firefox 147 and Thunderbird 147 | 9.8 | 0.0045 | | | [CVE-2025-8043](https://patchblox.com/security/data/cve/CVE-2025-8043.md) | Urgent | Incorrect URL truncation | 9.8 | 0.0044 | | | [CVE-2026-16363](https://patchblox.com/security/data/cve/CVE-2026-16363.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16369](https://patchblox.com/security/data/cve/CVE-2026-16369.md) | Urgent | Integer overflow in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16370](https://patchblox.com/security/data/cve/CVE-2026-16370.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.1 | 0.0043 | | | [CVE-2026-16394](https://patchblox.com/security/data/cve/CVE-2026-16394.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0043 | | | [CVE-2026-16406](https://patchblox.com/security/data/cve/CVE-2026-16406.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0043 | | | [CVE-2025-8027](https://patchblox.com/security/data/cve/CVE-2025-8027.md) | Urgent | JavaScript engine only wrote partial return value to stack | 7.5 | 0.0043 | | | [CVE-2025-8033](https://patchblox.com/security/data/cve/CVE-2025-8033.md) | Urgent | Incorrect JavaScript state machine for generators | 7.5 | 0.0043 | | | [CVE-2026-16364](https://patchblox.com/security/data/cve/CVE-2026-16364.md) | Urgent | Incorrect boundary conditions in the Audio/Video: Playback component | 9.1 | 0.0043 | | | [CVE-2026-8948](https://patchblox.com/security/data/cve/CVE-2026-8948.md) | Urgent | Same-origin policy bypass in the DOM: Networking component | 9.1 | 0.0042 | | | [CVE-2026-16350](https://patchblox.com/security/data/cve/CVE-2026-16350.md) | Urgent | Incorrect boundary conditions in the Audio/Video: cubeb component | 9.8 | 0.0041 | | | [CVE-2026-16355](https://patchblox.com/security/data/cve/CVE-2026-16355.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0041 | | | [CVE-2026-16351](https://patchblox.com/security/data/cve/CVE-2026-16351.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Navigation component | 9.8 | 0.0039 | | | [CVE-2026-16352](https://patchblox.com/security/data/cve/CVE-2026-16352.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-16356](https://patchblox.com/security/data/cve/CVE-2026-16356.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-16368](https://patchblox.com/security/data/cve/CVE-2026-16368.md) | Urgent | Incorrect boundary conditions in the JavaScript: WebAssembly component | 9.8 | 0.0039 | | | [CVE-2026-16377](https://patchblox.com/security/data/cve/CVE-2026-16377.md) | Urgent | Mitigation bypass in the PDF Viewer component | 9.8 | 0.0039 | | | [CVE-2026-16383](https://patchblox.com/security/data/cve/CVE-2026-16383.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.8 | 0.0039 | | | [CVE-2025-13021](https://patchblox.com/security/data/cve/CVE-2025-13021.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.8 | 0.0038 | | | [CVE-2025-13022](https://patchblox.com/security/data/cve/CVE-2025-13022.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.8 | 0.0038 | | | [CVE-2025-13023](https://patchblox.com/security/data/cve/CVE-2025-13023.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component | 9.8 | 0.0038 | | | [CVE-2025-13024](https://patchblox.com/security/data/cve/CVE-2025-13024.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0038 | | | [CVE-2025-13026](https://patchblox.com/security/data/cve/CVE-2025-13026.md) | Urgent | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component | 9.8 | 0.0038 | | | [CVE-2026-16367](https://patchblox.com/security/data/cve/CVE-2026-16367.md) | Urgent | Sandbox escape due to invalid pointer in the Disability Access APIs component | 10.0 | 0.0038 | | | [CVE-2026-2800](https://patchblox.com/security/data/cve/CVE-2026-2800.md) | Urgent | Spoofing issue in the WebAuthn component in Firefox for Android | 9.8 | 0.0035 | | | [CVE-2026-0881](https://patchblox.com/security/data/cve/CVE-2026-0881.md) | Urgent | Sandbox escape in the Messaging System component | 10.0 | 0.0035 | | | [CVE-2026-4729](https://patchblox.com/security/data/cve/CVE-2026-4729.md) | Urgent | Memory safety bugs fixed in Firefox 149 and Thunderbird 149 | 9.8 | 0.0035 | | | [CVE-2026-4725](https://patchblox.com/security/data/cve/CVE-2026-4725.md) | Urgent | Sandbox escape due to use-after-free in the Graphics: Canvas2D component | 10.0 | 0.0034 | | | [CVE-2025-14860](https://patchblox.com/security/data/cve/CVE-2025-14860.md) | Urgent | Use-after-free in the Disability Access APIs component | 9.8 | 0.0032 | | | [CVE-2026-16390](https://patchblox.com/security/data/cve/CVE-2026-16390.md) | Urgent | Mitigation bypass in the Enterprise Policies component | 9.1 | 0.0032 | | | [CVE-2026-16380](https://patchblox.com/security/data/cve/CVE-2026-16380.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0031 | | | [CVE-2026-12293](https://patchblox.com/security/data/cve/CVE-2026-12293.md) | Urgent | Use-after-free in the Graphics: WebGPU component | 9.8 | 0.0030 | | | [CVE-2026-2795](https://patchblox.com/security/data/cve/CVE-2026-2795.md) | Urgent | Use-after-free in the JavaScript: GC component | 9.8 | 0.0030 | | | [CVE-2026-2807](https://patchblox.com/security/data/cve/CVE-2026-2807.md) | Urgent | Memory safety bugs fixed in Firefox 148 and Thunderbird 148 | 9.8 | 0.0029 | | | [CVE-2026-6768](https://patchblox.com/security/data/cve/CVE-2026-6768.md) | Urgent | Mitigation bypass in the Networking: Cookies component | 9.8 | 0.0029 | | | [CVE-2026-6760](https://patchblox.com/security/data/cve/CVE-2026-6760.md) | Urgent | Mitigation bypass in the Networking: Cookies component | 9.8 | 0.0028 | | | [CVE-2026-5735](https://patchblox.com/security/data/cve/CVE-2026-5735.md) | Urgent | Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 | 9.8 | 0.0027 | | | [CVE-2026-16359](https://patchblox.com/security/data/cve/CVE-2026-16359.md) | Urgent | Incorrect boundary conditions in the Audio/Video: GMP component | 9.1 | 0.0026 | | | [CVE-2026-12316](https://patchblox.com/security/data/cve/CVE-2026-12316.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-16358](https://patchblox.com/security/data/cve/CVE-2026-16358.md) | Urgent | Site isolation issue in the Graphics: WebRender component | 9.8 | 0.0022 | | | [CVE-2026-16349](https://patchblox.com/security/data/cve/CVE-2026-16349.md) | Urgent | Same-origin policy bypass in the DOM: Navigation component | 9.8 | 0.0022 | | | [CVE-2026-16375](https://patchblox.com/security/data/cve/CVE-2026-16375.md) | Urgent | Site isolation issue in the Networking: HTTP component | 9.8 | 0.0021 | | | [CVE-2026-16387](https://patchblox.com/security/data/cve/CVE-2026-16387.md) | Urgent | Site isolation issue in the Networking component | 9.8 | 0.0020 | | | [CVE-2026-16381](https://patchblox.com/security/data/cve/CVE-2026-16381.md) | Urgent | Same-origin policy bypass in the Networking: DNS component | 9.1 | 0.0017 | | | [CVE-2026-6770](https://patchblox.com/security/data/cve/CVE-2026-6770.md) | High | Other issue in the Storage: IndexedDB component | 8.8 | 0.0388 | | | [CVE-2026-4696](https://patchblox.com/security/data/cve/CVE-2026-4696.md) | High | Use-after-free in the Layout: Text and Fonts component | 9.8 | 0.0099 | | | [CVE-2026-6746](https://patchblox.com/security/data/cve/CVE-2026-6746.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0095 | | | [CVE-2026-4700](https://patchblox.com/security/data/cve/CVE-2026-4700.md) | High | Mitigation bypass in the Networking: HTTP component | 9.8 | 0.0094 | | | [CVE-2026-2773](https://patchblox.com/security/data/cve/CVE-2026-2773.md) | High | Incorrect boundary conditions in the Web Audio component | 9.8 | 0.0092 | | | [CVE-2026-2774](https://patchblox.com/security/data/cve/CVE-2026-2774.md) | High | Integer overflow in the Audio/Video component | 9.8 | 0.0085 | | | [CVE-2026-2775](https://patchblox.com/security/data/cve/CVE-2026-2775.md) | High | Mitigation bypass in the DOM: HTML Parser component | 9.8 | 0.0084 | | | [CVE-2026-4690](https://patchblox.com/security/data/cve/CVE-2026-4690.md) | High | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component | 8.6 | 0.0082 | | | [CVE-2026-4694](https://patchblox.com/security/data/cve/CVE-2026-4694.md) | High | Incorrect boundary conditions, integer overflow in the Graphics component | 8.2 | 0.0082 | | | [CVE-2026-6758](https://patchblox.com/security/data/cve/CVE-2026-6758.md) | High | Use-after-free in the JavaScript: WebAssembly component | 7.5 | 0.0081 | | | [CVE-2026-4698](https://patchblox.com/security/data/cve/CVE-2026-4698.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0080 | | | [CVE-2025-10533](https://patchblox.com/security/data/cve/CVE-2025-10533.md) | High | Integer overflow in the SVG component | 8.8 | 0.0078 | | | [CVE-2026-2771](https://patchblox.com/security/data/cve/CVE-2026-2771.md) | High | Undefined behavior in the DOM: Core & HTML component | 9.8 | 0.0076 | | | [CVE-2026-4686](https://patchblox.com/security/data/cve/CVE-2026-4686.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0075 | | | [CVE-2026-2763](https://patchblox.com/security/data/cve/CVE-2026-2763.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2764](https://patchblox.com/security/data/cve/CVE-2026-2764.md) | High | JIT miscompilation, use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2765](https://patchblox.com/security/data/cve/CVE-2026-2765.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2766](https://patchblox.com/security/data/cve/CVE-2026-2766.md) | High | Use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2770](https://patchblox.com/security/data/cve/CVE-2026-2770.md) | High | Use-after-free in the DOM: Bindings (WebIDL) component | 9.8 | 0.0074 | | | [CVE-2026-2772](https://patchblox.com/security/data/cve/CVE-2026-2772.md) | High | Use-after-free in the Audio/Video: Playback component | 9.8 | 0.0074 | | | [CVE-2026-4685](https://patchblox.com/security/data/cve/CVE-2026-4685.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0073 | | | [CVE-2026-4693](https://patchblox.com/security/data/cve/CVE-2026-4693.md) | High | Incorrect boundary conditions in the Audio/Video: Playback component | 8.2 | 0.0073 | | | [CVE-2026-4695](https://patchblox.com/security/data/cve/CVE-2026-4695.md) | High | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 8.2 | 0.0073 | | | [CVE-2026-4697](https://patchblox.com/security/data/cve/CVE-2026-4697.md) | High | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 8.2 | 0.0073 | | | [CVE-2026-4699](https://patchblox.com/security/data/cve/CVE-2026-4699.md) | High | Incorrect boundary conditions in the Layout: Text and Fonts component | 8.2 | 0.0073 | | | [CVE-2026-4702](https://patchblox.com/security/data/cve/CVE-2026-4702.md) | High | JIT miscompilation in the JavaScript Engine component | 9.8 | 0.0072 | | | [CVE-2026-4689](https://patchblox.com/security/data/cve/CVE-2026-4689.md) | High | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component | 10.0 | 0.0071 | | | [CVE-2026-2447](https://patchblox.com/security/data/cve/CVE-2026-2447.md) | High | Heap buffer overflow in libvpx | 8.8 | 0.0070 | | | [CVE-2026-2779](https://patchblox.com/security/data/cve/CVE-2026-2779.md) | High | Incorrect boundary conditions in the Networking: JAR component | 9.8 | 0.0069 | | | [CVE-2026-2769](https://patchblox.com/security/data/cve/CVE-2026-2769.md) | High | Use-after-free in the Storage: IndexedDB component | 8.8 | 0.0069 | | | [CVE-2026-2788](https://patchblox.com/security/data/cve/CVE-2026-2788.md) | High | Incorrect boundary conditions in the Audio/Video: GMP component | 9.8 | 0.0068 | | | [CVE-2026-4705](https://patchblox.com/security/data/cve/CVE-2026-4705.md) | High | Undefined behavior in the WebRTC: Signaling component | 9.8 | 0.0067 | | | [CVE-2026-4704](https://patchblox.com/security/data/cve/CVE-2026-4704.md) | High | Denial-of-service in the WebRTC: Signaling component | 8.2 | 0.0067 | | | [CVE-2025-9179](https://patchblox.com/security/data/cve/CVE-2025-9179.md) | High | Sandbox escape due to invalid pointer in the Audio/Video: GMP component | 9.8 | 0.0065 | | | [CVE-2026-2787](https://patchblox.com/security/data/cve/CVE-2026-2787.md) | High | Use-after-free in the DOM: Window and Location component | 9.8 | 0.0064 | | | [CVE-2025-14321](https://patchblox.com/security/data/cve/CVE-2025-14321.md) | High | Use-after-free in the WebRTC: Signaling component | 9.8 | 0.0064 | | | [CVE-2026-2762](https://patchblox.com/security/data/cve/CVE-2026-2762.md) | High | Integer overflow in the JavaScript: Standard Library component | 9.8 | 0.0063 | | | [CVE-2026-4707](https://patchblox.com/security/data/cve/CVE-2026-4707.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0061 | | | [CVE-2025-14324](https://patchblox.com/security/data/cve/CVE-2025-14324.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0061 | | | [CVE-2026-8956](https://patchblox.com/security/data/cve/CVE-2026-8956.md) | High | Integer overflow in the Networking: JAR component | 9.8 | 0.0061 | | | [CVE-2026-2791](https://patchblox.com/security/data/cve/CVE-2026-2791.md) | High | Mitigation bypass in the Networking: Cache component | 9.8 | 0.0060 | | | [CVE-2026-2757](https://patchblox.com/security/data/cve/CVE-2026-2757.md) | High | Incorrect boundary conditions in the WebRTC: Audio/Video component | 9.8 | 0.0059 | | | [CVE-2026-8949](https://patchblox.com/security/data/cve/CVE-2026-8949.md) | High | Integer overflow in the Widget: Win32 component | 7.5 | 0.0058 | | | [CVE-2026-2785](https://patchblox.com/security/data/cve/CVE-2026-2785.md) | High | Invalid pointer in the JavaScript Engine component | 9.8 | 0.0058 | | | [CVE-2026-2758](https://patchblox.com/security/data/cve/CVE-2026-2758.md) | High | Use-after-free in the JavaScript: GC component | 9.8 | 0.0057 | | | [CVE-2026-4687](https://patchblox.com/security/data/cve/CVE-2026-4687.md) | High | Sandbox escape due to incorrect boundary conditions in the Telemetry component | 8.6 | 0.0057 | | | [CVE-2026-4688](https://patchblox.com/security/data/cve/CVE-2026-4688.md) | High | Sandbox escape due to use-after-free in the Disability Access APIs component | 10.0 | 0.0056 | | | [CVE-2026-4726](https://patchblox.com/security/data/cve/CVE-2026-4726.md) | High | Denial-of-service in the XML component | 7.5 | 0.0056 | | | [CVE-2026-4727](https://patchblox.com/security/data/cve/CVE-2026-4727.md) | High | Denial-of-service in the Libraries component in NSS | 7.5 | 0.0056 | | | [CVE-2026-2776](https://patchblox.com/security/data/cve/CVE-2026-2776.md) | High | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software | 10.0 | 0.0056 | | | [CVE-2026-2778](https://patchblox.com/security/data/cve/CVE-2026-2778.md) | High | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component | 10.0 | 0.0056 | | | [CVE-2026-8946](https://patchblox.com/security/data/cve/CVE-2026-8946.md) | High | Incorrect boundary conditions in the Audio/Video: Web Codecs component | 7.5 | 0.0056 | | | [CVE-2026-0880](https://patchblox.com/security/data/cve/CVE-2026-0880.md) | High | Sandbox escape due to integer overflow in the Graphics component | 8.8 | 0.0054 | | | [CVE-2025-14330](https://patchblox.com/security/data/cve/CVE-2025-14330.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0054 | | | [CVE-2025-9185](https://patchblox.com/security/data/cve/CVE-2025-9185.md) | High | Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0054 | | | [CVE-2026-8953](https://patchblox.com/security/data/cve/CVE-2026-8953.md) | High | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.6 | 0.0053 | | | [CVE-2026-2789](https://patchblox.com/security/data/cve/CVE-2026-2789.md) | High | Use-after-free in the Graphics: ImageLib component | 9.8 | 0.0053 | | | [CVE-2026-4692](https://patchblox.com/security/data/cve/CVE-2026-4692.md) | High | Sandbox escape in the Responsive Design Mode component | 10.0 | 0.0052 | | | [CVE-2026-16376](https://patchblox.com/security/data/cve/CVE-2026-16376.md) | High | Denial-of-service in the Graphics: WebGPU component | 7.5 | 0.0052 | | | [CVE-2026-16409](https://patchblox.com/security/data/cve/CVE-2026-16409.md) | High | Invalid pointer in the Security: PSM component | 7.5 | 0.0052 | | | [CVE-2026-2786](https://patchblox.com/security/data/cve/CVE-2026-2786.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0051 | | | [CVE-2026-4691](https://patchblox.com/security/data/cve/CVE-2026-4691.md) | High | Use-after-free in the CSS Parsing and Computation component | 9.8 | 0.0051 | | | [CVE-2026-6785](https://patchblox.com/security/data/cve/CVE-2026-6785.md) | High | Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 | 8.8 | 0.0051 | | | [CVE-2025-11708](https://patchblox.com/security/data/cve/CVE-2025-11708.md) | High | Use-after-free in MediaTrackGraphImpl::GetInstance() | 9.8 | 0.0051 | | | [CVE-2026-0879](https://patchblox.com/security/data/cve/CVE-2026-0879.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics component | 9.8 | 0.0050 | | | [CVE-2026-6786](https://patchblox.com/security/data/cve/CVE-2026-6786.md) | High | Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 | 8.8 | 0.0050 | | | [CVE-2026-8390](https://patchblox.com/security/data/cve/CVE-2026-8390.md) | High | Use-after-free in the JavaScript: WebAssembly component | 7.3 | 0.0050 | | | [CVE-2026-12292](https://patchblox.com/security/data/cve/CVE-2026-12292.md) | High | Incorrect boundary conditions in the Web Audio component | 8.1 | 0.0049 | | | [CVE-2026-4709](https://patchblox.com/security/data/cve/CVE-2026-4709.md) | High | Incorrect boundary conditions in the Audio/Video: GMP component | 8.2 | 0.0049 | | | [CVE-2026-4718](https://patchblox.com/security/data/cve/CVE-2026-4718.md) | High | Undefined behavior in the WebRTC: Signaling component | 8.2 | 0.0049 | | | [CVE-2026-4701](https://patchblox.com/security/data/cve/CVE-2026-4701.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0049 | | | [CVE-2026-15718](https://patchblox.com/security/data/cve/CVE-2026-15718.md) | High | Invalid pointer in the JavaScript: WebAssembly component | 8.8 | 0.0049 | | | [CVE-2026-6757](https://patchblox.com/security/data/cve/CVE-2026-6757.md) | High | Invalid pointer in the JavaScript: WebAssembly component | 8.8 | 0.0049 | | | [CVE-2026-2784](https://patchblox.com/security/data/cve/CVE-2026-2784.md) | High | Mitigation bypass in the DOM: Security component | 9.8 | 0.0049 | | | [CVE-2026-6750](https://patchblox.com/security/data/cve/CVE-2026-6750.md) | High | Privilege escalation in the Graphics: WebRender component | 8.8 | 0.0048 | | | [CVE-2026-4706](https://patchblox.com/security/data/cve/CVE-2026-4706.md) | High | Incorrect boundary conditions in the Graphics: Canvas2D component | 8.2 | 0.0048 | | | [CVE-2026-12328](https://patchblox.com/security/data/cve/CVE-2026-12328.md) | High | Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0048 | | | [CVE-2026-2760](https://patchblox.com/security/data/cve/CVE-2026-2760.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2761](https://patchblox.com/security/data/cve/CVE-2026-2761.md) | High | Sandbox escape in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2759](https://patchblox.com/security/data/cve/CVE-2026-2759.md) | High | Incorrect boundary conditions in the Graphics: ImageLib component | 9.8 | 0.0048 | | | [CVE-2026-0891](https://patchblox.com/security/data/cve/CVE-2026-0891.md) | High | Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 | 8.1 | 0.0048 | | | [CVE-2025-14333](https://patchblox.com/security/data/cve/CVE-2025-14333.md) | High | Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 | 8.1 | 0.0047 | | | [CVE-2026-0877](https://patchblox.com/security/data/cve/CVE-2026-0877.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0047 | | | [CVE-2026-8975](https://patchblox.com/security/data/cve/CVE-2026-8975.md) | High | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0047 | | | [CVE-2026-0878](https://patchblox.com/security/data/cve/CVE-2026-0878.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0047 | | | [CVE-2026-0882](https://patchblox.com/security/data/cve/CVE-2026-0882.md) | High | Use-after-free in the IPC component | 8.8 | 0.0047 | | | [CVE-2026-0884](https://patchblox.com/security/data/cve/CVE-2026-0884.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0046 | | | [CVE-2026-0889](https://patchblox.com/security/data/cve/CVE-2026-0889.md) | High | Denial-of-service in the DOM: Service Workers component | 7.5 | 0.0046 | | | [CVE-2026-2767](https://patchblox.com/security/data/cve/CVE-2026-2767.md) | High | Use-after-free in the JavaScript: WebAssembly component | 9.8 | 0.0046 | | | [CVE-2026-4708](https://patchblox.com/security/data/cve/CVE-2026-4708.md) | High | Incorrect boundary conditions in the Graphics component | 8.2 | 0.0046 | | | [CVE-2026-4713](https://patchblox.com/security/data/cve/CVE-2026-4713.md) | High | Incorrect boundary conditions in the Graphics component | 8.2 | 0.0046 | | | [CVE-2026-4714](https://patchblox.com/security/data/cve/CVE-2026-4714.md) | High | Incorrect boundary conditions in the Audio/Video component | 8.2 | 0.0046 | | | [CVE-2026-4719](https://patchblox.com/security/data/cve/CVE-2026-4719.md) | High | Incorrect boundary conditions in the Graphics: Text component | 8.2 | 0.0046 | | | [CVE-2026-4715](https://patchblox.com/security/data/cve/CVE-2026-4715.md) | High | Uninitialized memory in the Graphics: Canvas2D component | 9.1 | 0.0046 | | | [CVE-2026-4720](https://patchblox.com/security/data/cve/CVE-2026-4720.md) | High | Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0045 | | | [CVE-2026-4721](https://patchblox.com/security/data/cve/CVE-2026-4721.md) | High | Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0045 | | | [CVE-2025-8036](https://patchblox.com/security/data/cve/CVE-2025-8036.md) | High | DNS rebinding circumvents CORS | 8.1 | 0.0045 | | | [CVE-2025-14323](https://patchblox.com/security/data/cve/CVE-2025-14323.md) | High | Privilege escalation in the DOM: Notifications component | 8.8 | 0.0045 | | | [CVE-2026-4717](https://patchblox.com/security/data/cve/CVE-2026-4717.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0044 | | | [CVE-2026-2768](https://patchblox.com/security/data/cve/CVE-2026-2768.md) | High | Sandbox escape in the Storage: IndexedDB component | 10.0 | 0.0044 | | | [CVE-2026-2777](https://patchblox.com/security/data/cve/CVE-2026-2777.md) | High | Privilege escalation in the Messaging System component | 9.8 | 0.0044 | | | [CVE-2025-9182](https://patchblox.com/security/data/cve/CVE-2025-9182.md) | High | Denial-of-service due to out-of-memory in the Graphics: WebRender component | 7.5 | 0.0044 | | | [CVE-2026-4710](https://patchblox.com/security/data/cve/CVE-2026-4710.md) | High | Incorrect boundary conditions in the Audio/Video component | 9.8 | 0.0044 | | | [CVE-2026-2781](https://patchblox.com/security/data/cve/CVE-2026-2781.md) | High | Integer overflow in the Libraries component in NSS | 9.8 | 0.0043 | | | [CVE-2026-4716](https://patchblox.com/security/data/cve/CVE-2026-4716.md) | High | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component | 9.1 | 0.0043 | | | [CVE-2025-14328](https://patchblox.com/security/data/cve/CVE-2025-14328.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 | | | [CVE-2025-14329](https://patchblox.com/security/data/cve/CVE-2025-14329.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 | | | [CVE-2026-16384](https://patchblox.com/security/data/cve/CVE-2026-16384.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16385](https://patchblox.com/security/data/cve/CVE-2026-16385.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16386](https://patchblox.com/security/data/cve/CVE-2026-16386.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16400](https://patchblox.com/security/data/cve/CVE-2026-16400.md) | High | Information disclosure in the DOM: Security component | 7.5 | 0.0043 | | | [CVE-2026-8954](https://patchblox.com/security/data/cve/CVE-2026-8954.md) | High | Incorrect boundary conditions, integer overflow in the Audio/Video component | 7.5 | 0.0043 | | | [CVE-2025-11709](https://patchblox.com/security/data/cve/CVE-2025-11709.md) | High | Out of bounds read/write in a privileged process triggered by WebGL textures | 9.8 | 0.0042 | | | [CVE-2025-11710](https://patchblox.com/security/data/cve/CVE-2025-11710.md) | High | Cross-process information leaked due to malicious IPC messages | 9.8 | 0.0042 | | | [CVE-2026-4711](https://patchblox.com/security/data/cve/CVE-2026-4711.md) | High | Use-after-free in the Widget: Cocoa component | 9.8 | 0.0042 | | | [CVE-2026-8389](https://patchblox.com/security/data/cve/CVE-2026-8389.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 8.8 | 0.0042 | | | [CVE-2025-9184](https://patchblox.com/security/data/cve/CVE-2025-9184.md) | High | Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0042 | | | [CVE-2026-8959](https://patchblox.com/security/data/cve/CVE-2026-8959.md) | High | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 9.6 | 0.0042 | | | [CVE-2026-16378](https://patchblox.com/security/data/cve/CVE-2026-16378.md) | High | Other issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0042 | | | [CVE-2025-9181](https://patchblox.com/security/data/cve/CVE-2025-9181.md) | High | Uninitialized memory in the JavaScript Engine component | 7.5 | 0.0041 | | | [CVE-2026-8947](https://patchblox.com/security/data/cve/CVE-2026-8947.md) | High | Use-after-free in the DOM: Bindings (WebIDL) component | 7.5 | 0.0041 | | | [CVE-2026-8968](https://patchblox.com/security/data/cve/CVE-2026-8968.md) | High | Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component | 7.5 | 0.0041 | | | [CVE-2025-13016](https://patchblox.com/security/data/cve/CVE-2025-13016.md) | High | Incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5 | 0.0041 | | | [CVE-2026-4712](https://patchblox.com/security/data/cve/CVE-2026-4712.md) | High | Information disclosure in the Widget: Cocoa component | 8.2 | 0.0041 | | | [CVE-2026-12327](https://patchblox.com/security/data/cve/CVE-2026-12327.md) | High | Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0041 | | | [CVE-2026-16372](https://patchblox.com/security/data/cve/CVE-2026-16372.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0041 | | | [CVE-2025-14327](https://patchblox.com/security/data/cve/CVE-2025-14327.md) | High | Spoofing issue in the Downloads Panel component | 7.5 | 0.0041 | | | [CVE-2026-0885](https://patchblox.com/security/data/cve/CVE-2026-0885.md) | High | Use-after-free in the JavaScript: GC component | 7.5 | 0.0040 | | | [CVE-2026-6749](https://patchblox.com/security/data/cve/CVE-2026-6749.md) | High | Information disclosure due to uninitialized memory in the Graphics: Canvas2D component | 8.8 | 0.0040 | | | [CVE-2026-16366](https://patchblox.com/security/data/cve/CVE-2026-16366.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0040 | | | [CVE-2026-16401](https://patchblox.com/security/data/cve/CVE-2026-16401.md) | High | Privilege escalation in the Data Loss Prevention component | 8.8 | 0.0040 | | | [CVE-2025-8035](https://patchblox.com/security/data/cve/CVE-2025-8035.md) | High | Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0040 | | | [CVE-2026-6747](https://patchblox.com/security/data/cve/CVE-2026-6747.md) | High | Use-after-free in the WebRTC component | 8.8 | 0.0040 | | | [CVE-2026-6748](https://patchblox.com/security/data/cve/CVE-2026-6748.md) | High | Uninitialized memory in the Audio/Video: Web Codecs component | 9.8 | 0.0040 | | | [CVE-2026-12290](https://patchblox.com/security/data/cve/CVE-2026-12290.md) | High | Memory safety bug fixed in Thunderbird 152 | 8.1 | 0.0040 | | | [CVE-2026-2780](https://patchblox.com/security/data/cve/CVE-2026-2780.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0040 | | | [CVE-2026-12289](https://patchblox.com/security/data/cve/CVE-2026-12289.md) | High | Privilege escalation in the Graphics: WebRender component | 8.8 | 0.0040 | | | [CVE-2026-12295](https://patchblox.com/security/data/cve/CVE-2026-12295.md) | High | Sandbox escape in the DOM: Navigation component | 9.6 | 0.0039 | | | [CVE-2026-12296](https://patchblox.com/security/data/cve/CVE-2026-12296.md) | High | Sandbox escape in the Security: Process Sandboxing component | 9.6 | 0.0039 | | | [CVE-2026-12297](https://patchblox.com/security/data/cve/CVE-2026-12297.md) | High | Sandbox escape due to incorrect boundary conditions in the Networking component | 9.6 | 0.0039 | | | [CVE-2026-6772](https://patchblox.com/security/data/cve/CVE-2026-6772.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 8.8 | 0.0039 | | | [CVE-2026-6754](https://patchblox.com/security/data/cve/CVE-2026-6754.md) | High | Use-after-free in the JavaScript Engine component | 8.8 | 0.0039 | | | [CVE-2026-8955](https://patchblox.com/security/data/cve/CVE-2026-8955.md) | High | Privilege escalation in the DOM: Workers component | 8.8 | 0.0039 | | | [CVE-2026-8957](https://patchblox.com/security/data/cve/CVE-2026-8957.md) | High | Privilege escalation in the Enterprise Policies component | 8.8 | 0.0039 | | | [CVE-2026-0886](https://patchblox.com/security/data/cve/CVE-2026-0886.md) | High | Incorrect boundary conditions in the Graphics component | 7.5 | 0.0038 | | | [CVE-2026-12291](https://patchblox.com/security/data/cve/CVE-2026-12291.md) | High | Use-after-free in the Networking: HTTP component | 8.8 | 0.0038 | | | [CVE-2026-2792](https://patchblox.com/security/data/cve/CVE-2026-2792.md) | High | Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2026-2793](https://patchblox.com/security/data/cve/CVE-2026-2793.md) | High | Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2025-8029](https://patchblox.com/security/data/cve/CVE-2025-8029.md) | High | javascript: URLs executed on object and embed tags | 8.1 | 0.0038 | | | [CVE-2025-8030](https://patchblox.com/security/data/cve/CVE-2025-8030.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0038 | | | [CVE-2026-8960](https://patchblox.com/security/data/cve/CVE-2026-8960.md) | High | Spoofing issue in WebExtensions | 7.5 | 0.0038 | | | [CVE-2026-7323](https://patchblox.com/security/data/cve/CVE-2026-7323.md) | High | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 | 8.8 | 0.0038 | | | [CVE-2025-8032](https://patchblox.com/security/data/cve/CVE-2025-8032.md) | High | XSLT documents could bypass CSP | 8.1 | 0.0038 | | | [CVE-2026-4684](https://patchblox.com/security/data/cve/CVE-2026-4684.md) | High | Race condition, use-after-free in the Graphics: WebRender component | 8.2 | 0.0037 | | | [CVE-2026-12305](https://patchblox.com/security/data/cve/CVE-2026-12305.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0037 | | | [CVE-2026-8952](https://patchblox.com/security/data/cve/CVE-2026-8952.md) | High | Privilege escalation in the Application Update component | 8.8 | 0.0037 | | | [CVE-2026-8962](https://patchblox.com/security/data/cve/CVE-2026-8962.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0037 | | | [CVE-2025-10528](https://patchblox.com/security/data/cve/CVE-2025-10528.md) | High | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component | 7.5 | 0.0037 | | | [CVE-2026-8945](https://patchblox.com/security/data/cve/CVE-2026-8945.md) | High | Sandbox escape in Firefox and Firefox Focus for Android | 7.5 | 0.0037 | | | [CVE-2025-8040](https://patchblox.com/security/data/cve/CVE-2025-8040.md) | High | Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0037 | | | [CVE-2026-8973](https://patchblox.com/security/data/cve/CVE-2026-8973.md) | High | Memory safety bugs fixed in Thunderbird 151 | 8.8 | 0.0037 | | | [CVE-2025-14325](https://patchblox.com/security/data/cve/CVE-2025-14325.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0037 | | | [CVE-2026-8974](https://patchblox.com/security/data/cve/CVE-2026-8974.md) | High | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0037 | | | [CVE-2026-5732](https://patchblox.com/security/data/cve/CVE-2026-5732.md) | High | Incorrect boundary conditions, integer overflow in the Graphics: Text component | 8.8 | 0.0036 | | | [CVE-2026-12294](https://patchblox.com/security/data/cve/CVE-2026-12294.md) | High | Sandbox escape in the DOM: Workers component | 9.6 | 0.0036 | | | [CVE-2026-6759](https://patchblox.com/security/data/cve/CVE-2026-6759.md) | High | Use-after-free in the Widget: Cocoa component | 8.8 | 0.0036 | | | [CVE-2026-12326](https://patchblox.com/security/data/cve/CVE-2026-12326.md) | High | Memory safety bugs fixed in Firefox 152 and Thunderbird 152 | 8.1 | 0.0036 | | | [CVE-2025-14322](https://patchblox.com/security/data/cve/CVE-2025-14322.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0036 | | | [CVE-2026-3847](https://patchblox.com/security/data/cve/CVE-2026-3847.md) | High | Memory safety bugs fixed in Firefox 148.0.2 | 8.8 | 0.0036 | | | [CVE-2026-6784](https://patchblox.com/security/data/cve/CVE-2026-6784.md) | High | Memory safety bugs fixed in Firefox 150 and Thunderbird 150 | 7.5 | 0.0036 | | | [CVE-2025-13027](https://patchblox.com/security/data/cve/CVE-2025-13027.md) | High | Memory safety bugs fixed in Firefox 145 and Thunderbird 145 | 8.1 | 0.0036 | | | [CVE-2025-10534](https://patchblox.com/security/data/cve/CVE-2025-10534.md) | High | Spoofing issue in the Site Permissions component | 8.1 | 0.0036 | | | [CVE-2026-0883](https://patchblox.com/security/data/cve/CVE-2026-0883.md) | High | Information disclosure in the Networking component | 7.5 | 0.0036 | | | [CVE-2026-8958](https://patchblox.com/security/data/cve/CVE-2026-8958.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 8.6 | 0.0034 | | | [CVE-2026-5734](https://patchblox.com/security/data/cve/CVE-2026-5734.md) | High | Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 | 9.8 | 0.0034 | | | [CVE-2026-2783](https://patchblox.com/security/data/cve/CVE-2026-2783.md) | High | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0034 | | | [CVE-2026-16354](https://patchblox.com/security/data/cve/CVE-2026-16354.md) | High | Information disclosure in the Graphics: ImageLib component | 8.8 | 0.0034 | | | [CVE-2025-8039](https://patchblox.com/security/data/cve/CVE-2025-8039.md) | High | Search terms persisted in URL bar | 8.1 | 0.0034 | | | [CVE-2026-2782](https://patchblox.com/security/data/cve/CVE-2026-2782.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0034 | | | [CVE-2025-10537](https://patchblox.com/security/data/cve/CVE-2025-10537.md) | High | Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 | 8.8 | 0.0034 | | | [CVE-2026-15719](https://patchblox.com/security/data/cve/CVE-2026-15719.md) | High | Site isolation issue in the DOM: Navigation component | 8.8 | 0.0034 | | | [CVE-2026-2801](https://patchblox.com/security/data/cve/CVE-2026-2801.md) | High | Incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5 | 0.0034 | | | [CVE-2025-11714](https://patchblox.com/security/data/cve/CVE-2025-11714.md) | High | Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0034 | | | [CVE-2025-14332](https://patchblox.com/security/data/cve/CVE-2025-14332.md) | High | Memory safety bugs fixed in Firefox 146 and Thunderbird 146 | 7.3 | 0.0033 | | | [CVE-2026-4722](https://patchblox.com/security/data/cve/CVE-2026-4722.md) | High | Privilege escalation in the IPC component | 8.8 | 0.0033 | | | [CVE-2026-8966](https://patchblox.com/security/data/cve/CVE-2026-8966.md) | High | Information disclosure in the IP Protection component | 7.5 | 0.0033 | | | [CVE-2026-8967](https://patchblox.com/security/data/cve/CVE-2026-8967.md) | High | Information disclosure in the Graphics: WebGPU component | 7.5 | 0.0033 | | | [CVE-2026-8972](https://patchblox.com/security/data/cve/CVE-2026-8972.md) | High | Privilege escalation in the WebRTC: Audio/Video component | 8.8 | 0.0033 | | | [CVE-2025-11715](https://patchblox.com/security/data/cve/CVE-2025-11715.md) | High | Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0033 | | | [CVE-2025-10532](https://patchblox.com/security/data/cve/CVE-2025-10532.md) | High | Incorrect boundary conditions in the JavaScript: GC component | 7.5 | 0.0033 | | | [CVE-2026-0887](https://patchblox.com/security/data/cve/CVE-2026-0887.md) | High | Clickjacking issue, information disclosure in the PDF Viewer component | 7.5 | 0.0033 | | | [CVE-2026-6773](https://patchblox.com/security/data/cve/CVE-2026-6773.md) | High | Denial-of-service due to integer overflow in the Graphics: WebGPU component | 7.5 | 0.0032 | | | [CVE-2026-8965](https://patchblox.com/security/data/cve/CVE-2026-8965.md) | High | Information disclosure in the DOM: Security component | 7.5 | 0.0032 | | | [CVE-2026-7320](https://patchblox.com/security/data/cve/CVE-2026-7320.md) | High | Information disclosure due to incorrect boundary conditions in the Audio/Video component | 8.8 | 0.0032 | | | [CVE-2026-8093](https://patchblox.com/security/data/cve/CVE-2026-8093.md) | High | Memory safety bugs fixed in Thunderbird 150.0.2 | 8.1 | 0.0032 | | | [CVE-2026-16374](https://patchblox.com/security/data/cve/CVE-2026-16374.md) | High | Information disclosure in the Framework component in DevTools | 8.8 | 0.0032 | | | [CVE-2026-16391](https://patchblox.com/security/data/cve/CVE-2026-16391.md) | High | Information disclosure in the Storage: IndexedDB component | 8.8 | 0.0032 | | | [CVE-2026-8961](https://patchblox.com/security/data/cve/CVE-2026-8961.md) | High | Spoofing issue in the Form Autofill component | 7.5 | 0.0032 | | | [CVE-2025-10529](https://patchblox.com/security/data/cve/CVE-2025-10529.md) | High | Same-origin policy bypass in the Layout component | 7.5 | 0.0032 | | | [CVE-2026-8090](https://patchblox.com/security/data/cve/CVE-2026-8090.md) | High | Use-after-free in the DOM: Networking component | 7.5 | 0.0032 | | | [CVE-2025-13014](https://patchblox.com/security/data/cve/CVE-2025-13014.md) | High | Use-after-free in the Audio/Video component | 8.8 | 0.0032 | | | [CVE-2026-7322](https://patchblox.com/security/data/cve/CVE-2026-7322.md) | High | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 | 8.8 | 0.0032 | | | [CVE-2026-5733](https://patchblox.com/security/data/cve/CVE-2026-5733.md) | High | Incorrect boundary conditions in the Graphics: WebGPU component | 8.8 | 0.0032 | | | [CVE-2025-10535](https://patchblox.com/security/data/cve/CVE-2025-10535.md) | High | Information disclosure, mitigation bypass in the Privacy component in Firefox for Android | 7.5 | 0.0031 | | | [CVE-2026-8401](https://patchblox.com/security/data/cve/CVE-2026-8401.md) | High | Sandbox escape in the Profile Backup component | 9.8 | 0.0031 | | | [CVE-2026-6771](https://patchblox.com/security/data/cve/CVE-2026-6771.md) | High | Mitigation bypass in the DOM: Security component | 9.8 | 0.0031 | | | [CVE-2026-6751](https://patchblox.com/security/data/cve/CVE-2026-6751.md) | High | Uninitialized memory in the Audio/Video: Web Codecs component | 8.8 | 0.0031 | | | [CVE-2026-8970](https://patchblox.com/security/data/cve/CVE-2026-8970.md) | High | Privilege escalation in the Security component | 8.8 | 0.0031 | | | [CVE-2025-13020](https://patchblox.com/security/data/cve/CVE-2025-13020.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0031 | | | [CVE-2026-6752](https://patchblox.com/security/data/cve/CVE-2026-6752.md) | High | Incorrect boundary conditions in the WebRTC component | 8.8 | 0.0031 | | | [CVE-2026-6753](https://patchblox.com/security/data/cve/CVE-2026-6753.md) | High | Incorrect boundary conditions in the WebRTC component | 8.8 | 0.0031 | | | [CVE-2026-12298](https://patchblox.com/security/data/cve/CVE-2026-12298.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0031 | | | [CVE-2026-12299](https://patchblox.com/security/data/cve/CVE-2026-12299.md) | High | JIT miscompilation in the DOM: Core & HTML component | 7.5 | 0.0031 | | | [CVE-2026-2794](https://patchblox.com/security/data/cve/CVE-2026-2794.md) | High | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android | 7.5 | 0.0030 | | | [CVE-2026-8963](https://patchblox.com/security/data/cve/CVE-2026-8963.md) | High | Spoofing issue in the Web Speech component | 7.5 | 0.0030 | | | [CVE-2026-8964](https://patchblox.com/security/data/cve/CVE-2026-8964.md) | High | Spoofing issue in the Popup Blocker component | 7.5 | 0.0030 | | | [CVE-2026-10701](https://patchblox.com/security/data/cve/CVE-2026-10701.md) | High | Incorrect boundary conditions in the Graphics: Text component | 7.5 | 0.0030 | | | [CVE-2026-0890](https://patchblox.com/security/data/cve/CVE-2026-0890.md) | High | Spoofing issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0030 | | | [CVE-2026-7324](https://patchblox.com/security/data/cve/CVE-2026-7324.md) | High | Memory safety bugs fixed in Thunderbird 150.0.1 | 7.3 | 0.0030 | | | [CVE-2026-2798](https://patchblox.com/security/data/cve/CVE-2026-2798.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0030 | | | [CVE-2025-13025](https://patchblox.com/security/data/cve/CVE-2025-13025.md) | High | Incorrect boundary conditions in the Graphics: WebGPU component | 7.5 | 0.0030 | | | [CVE-2026-8391](https://patchblox.com/security/data/cve/CVE-2026-8391.md) | High | Other issue in the JavaScript Engine component | 7.5 | 0.0030 | | | [CVE-2026-16371](https://patchblox.com/security/data/cve/CVE-2026-16371.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0030 | | | [CVE-2026-6780](https://patchblox.com/security/data/cve/CVE-2026-6780.md) | High | Denial-of-service in the Audio/Video: Playback component | 7.5 | 0.0029 | | | [CVE-2026-6781](https://patchblox.com/security/data/cve/CVE-2026-6781.md) | High | Denial-of-service in the Audio/Video: Playback component | 7.5 | 0.0029 | | | [CVE-2026-16362](https://patchblox.com/security/data/cve/CVE-2026-16362.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0029 | | | [CVE-2026-2803](https://patchblox.com/security/data/cve/CVE-2026-2803.md) | High | Information disclosure, mitigation bypass in the Settings UI component | 7.5 | 0.0029 | | | [CVE-2026-8969](https://patchblox.com/security/data/cve/CVE-2026-8969.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0029 | | | [CVE-2025-10527](https://patchblox.com/security/data/cve/CVE-2025-10527.md) | High | Sandbox escape due to use-after-free in the Graphics: Canvas2D component | 7.5 | 0.0029 | | | [CVE-2026-12317](https://patchblox.com/security/data/cve/CVE-2026-12317.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0029 | | | [CVE-2025-11713](https://patchblox.com/security/data/cve/CVE-2025-11713.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0029 | | | [CVE-2025-11152](https://patchblox.com/security/data/cve/CVE-2025-11152.md) | High | Sandbox escape due to integer overflow in the Graphics: Canvas2D component | 8.6 | 0.0029 | | | [CVE-2025-9180](https://patchblox.com/security/data/cve/CVE-2025-9180.md) | High | Same-origin policy bypass in the Graphics: Canvas2D component | 8.1 | 0.0028 | | | [CVE-2026-92021](https://patchblox.com/security/data/cve/CVE-2026-92021.md) | High | Use-after-free in the JavaScript Engine: JIT component | 8.8 | 0.0028 | | | [CVE-2026-24869](https://patchblox.com/security/data/cve/CVE-2026-24869.md) | High | Use-after-free in the Layout: Scrolling and Overflow component | 8.8 | 0.0028 | | | [CVE-2026-16365](https://patchblox.com/security/data/cve/CVE-2026-16365.md) | High | Privilege escalation in the DOM: Workers component | 8.8 | 0.0028 | | | [CVE-2026-16379](https://patchblox.com/security/data/cve/CVE-2026-16379.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0028 | | | [CVE-2025-13017](https://patchblox.com/security/data/cve/CVE-2025-13017.md) | High | Same-origin policy bypass in the DOM: Notifications component | 8.1 | 0.0028 | | | [CVE-2025-13018](https://patchblox.com/security/data/cve/CVE-2025-13018.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0028 | | | [CVE-2025-13019](https://patchblox.com/security/data/cve/CVE-2025-13019.md) | High | Same-origin policy bypass in the DOM: Workers component | 8.1 | 0.0028 | | | [CVE-2026-6756](https://patchblox.com/security/data/cve/CVE-2026-6756.md) | High | Mitigation bypass in Firefox for Android | 7.5 | 0.0027 | | | [CVE-2025-8038](https://patchblox.com/security/data/cve/CVE-2025-8038.md) | High | CSP frame-src was not correctly enforced for paths | 9.8 | 0.0027 | | | [CVE-2025-8037](https://patchblox.com/security/data/cve/CVE-2025-8037.md) | High | Nameless cookies shadow secure cookies | 9.1 | 0.0027 | | | [CVE-2026-12318](https://patchblox.com/security/data/cve/CVE-2026-12318.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 7.3 | 0.0026 | | | [CVE-2026-12306](https://patchblox.com/security/data/cve/CVE-2026-12306.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12307](https://patchblox.com/security/data/cve/CVE-2026-12307.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12308](https://patchblox.com/security/data/cve/CVE-2026-12308.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-7321](https://patchblox.com/security/data/cve/CVE-2026-7321.md) | High | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component | 9.6 | 0.0026 | | | [CVE-2026-6766](https://patchblox.com/security/data/cve/CVE-2026-6766.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 8.8 | 0.0026 | | | [CVE-2025-14861](https://patchblox.com/security/data/cve/CVE-2025-14861.md) | High | Memory safety bugs fixed in Firefox 146.0.1 | 8.8 | 0.0026 | | | [CVE-2026-16405](https://patchblox.com/security/data/cve/CVE-2026-16405.md) | High | Information disclosure in the Networking: WebSockets component | 8.8 | 0.0026 | | | [CVE-2026-2790](https://patchblox.com/security/data/cve/CVE-2026-2790.md) | High | Same-origin policy bypass in the Networking: JAR component | 9.8 | 0.0025 | | | [CVE-2026-6782](https://patchblox.com/security/data/cve/CVE-2026-6782.md) | High | Information disclosure in the IP Protection component | 7.5 | 0.0025 | | | [CVE-2026-12310](https://patchblox.com/security/data/cve/CVE-2026-12310.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12312](https://patchblox.com/security/data/cve/CVE-2026-12312.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12314](https://patchblox.com/security/data/cve/CVE-2026-12314.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12315](https://patchblox.com/security/data/cve/CVE-2026-12315.md) | High | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-12302](https://patchblox.com/security/data/cve/CVE-2026-12302.md) | High | Mitigation bypass in the DOM: Security component | 7.5 | 0.0025 | | | [CVE-2025-11153](https://patchblox.com/security/data/cve/CVE-2025-11153.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0025 | | | [CVE-2026-8388](https://patchblox.com/security/data/cve/CVE-2026-8388.md) | High | Incorrect boundary conditions in the JavaScript Engine: JIT component | 7.5 | 0.0024 | | | [CVE-2025-13012](https://patchblox.com/security/data/cve/CVE-2025-13012.md) | High | Race condition in the Graphics component | 7.5 | 0.0024 | | | [CVE-2026-16396](https://patchblox.com/security/data/cve/CVE-2026-16396.md) | High | Privilege escalation in WebExtensions | 8.8 | 0.0024 | | | [CVE-2026-92014](https://patchblox.com/security/data/cve/CVE-2026-92014.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics component | 8.8 | 0.0024 | | | [CVE-2026-12309](https://patchblox.com/security/data/cve/CVE-2026-12309.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0024 | | | [CVE-2026-6764](https://patchblox.com/security/data/cve/CVE-2026-6764.md) | High | Incorrect boundary conditions in the DOM: Device Interfaces component | 8.8 | 0.0023 | | | [CVE-2025-11711](https://patchblox.com/security/data/cve/CVE-2025-11711.md) | High | Some non-writable Object properties could be modified | 7.5 | 0.0023 | | | [CVE-2025-13015](https://patchblox.com/security/data/cve/CVE-2025-13015.md) | High | Spoofing issue in Firefox | 7.5 | 0.0023 | | | [CVE-2026-6767](https://patchblox.com/security/data/cve/CVE-2026-6767.md) | High | Other issue in the Libraries component in NSS | 8.8 | 0.0023 | | | [CVE-2026-12325](https://patchblox.com/security/data/cve/CVE-2026-12325.md) | High | Denial-of-service in the Graphics: ImageLib component | 7.5 | 0.0023 | | | [CVE-2026-6769](https://patchblox.com/security/data/cve/CVE-2026-6769.md) | High | Privilege escalation in the Debugger component | 8.8 | 0.0023 | | | [CVE-2026-6761](https://patchblox.com/security/data/cve/CVE-2026-6761.md) | High | Privilege escalation in the Networking component | 8.8 | 0.0022 | | | [CVE-2025-11712](https://patchblox.com/security/data/cve/CVE-2025-11712.md) | High | An OBJECT tag type attribute overrode browser behavior on web resources without a content-type | 7.5 | 0.0022 | | | [CVE-2025-13013](https://patchblox.com/security/data/cve/CVE-2025-13013.md) | High | Mitigation bypass in the DOM: Core & HTML component | 7.5 | 0.0022 | | | [CVE-2026-16398](https://patchblox.com/security/data/cve/CVE-2026-16398.md) | High | Site isolation issue in the Graphics component | 7.5 | 0.0022 | | | [CVE-2026-16399](https://patchblox.com/security/data/cve/CVE-2026-16399.md) | High | Site isolation issue in the DOM: Navigation component | 7.5 | 0.0022 | | | [CVE-2026-6765](https://patchblox.com/security/data/cve/CVE-2026-6765.md) | High | Information disclosure in the Form Autofill component | 8.8 | 0.0022 | | | [CVE-2026-12324](https://patchblox.com/security/data/cve/CVE-2026-12324.md) | High | Incorrect boundary conditions in the Graphics: CanvasWebGL component | 7.5 | 0.0021 | | | [CVE-2025-14331](https://patchblox.com/security/data/cve/CVE-2025-14331.md) | High | Same-origin policy bypass in the Request Handling component | 7.5 | 0.0020 | | | [CVE-2026-8950](https://patchblox.com/security/data/cve/CVE-2026-8950.md) | High | Same-origin policy bypass in the Networking: HTTP component | 9.3 | 0.0019 | | | [CVE-2026-6763](https://patchblox.com/security/data/cve/CVE-2026-6763.md) | High | Mitigation bypass in the File Handling component | 8.8 | 0.0019 | | | [CVE-2026-12304](https://patchblox.com/security/data/cve/CVE-2026-12304.md) | High | Same-origin policy bypass in the Networking: Cookies component | 9.1 | 0.0019 | | | [CVE-2026-6762](https://patchblox.com/security/data/cve/CVE-2026-6762.md) | High | Spoofing issue in the DOM: Core & HTML component | 8.8 | 0.0019 | | | [CVE-2026-12311](https://patchblox.com/security/data/cve/CVE-2026-12311.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0019 | | | [CVE-2025-10536](https://patchblox.com/security/data/cve/CVE-2025-10536.md) | High | Information disclosure in the Networking: Cache component | 7.5 | 0.0018 | | | [CVE-2026-12313](https://patchblox.com/security/data/cve/CVE-2026-12313.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0018 | | | [CVE-2026-6776](https://patchblox.com/security/data/cve/CVE-2026-6776.md) | High | Incorrect boundary conditions in the WebRTC: Networking component | 8.8 | 0.0011 | | | [CVE-2026-10702](https://patchblox.com/security/data/cve/CVE-2026-10702.md) | Routine | JIT miscompilation in the JavaScript Engine: JIT component | 4.3 | 0.0086 | | | [CVE-2026-2804](https://patchblox.com/security/data/cve/CVE-2026-2804.md) | Routine | Use-after-free in the JavaScript: WebAssembly component | 5.4 | 0.0047 | | | [CVE-2026-16403](https://patchblox.com/security/data/cve/CVE-2026-16403.md) | Routine | Spoofing issue in the Address Bar component | 6.5 | 0.0035 | | | [CVE-2026-0888](https://patchblox.com/security/data/cve/CVE-2026-0888.md) | Routine | Information disclosure in the XML component | 5.3 | 0.0035 | | | [CVE-2026-16397](https://patchblox.com/security/data/cve/CVE-2026-16397.md) | Routine | Clickjacking issue in the WebExtensions component in Firefox for Android | 6.5 | 0.0030 | | | [CVE-2025-10530](https://patchblox.com/security/data/cve/CVE-2025-10530.md) | Routine | Spoofing issue in the WebAuthn component in Firefox for Android | 6.5 | 0.0030 | | | [CVE-2025-9183](https://patchblox.com/security/data/cve/CVE-2025-9183.md) | Routine | Spoofing issue in the Address Bar component | 6.5 | 0.0029 | | | [CVE-2025-10531](https://patchblox.com/security/data/cve/CVE-2025-10531.md) | Routine | Mitigation bypass in the Web Compatibility: Tooling component | 5.4 | 0.0028 | | | [CVE-2026-6778](https://patchblox.com/security/data/cve/CVE-2026-6778.md) | Routine | Invalid pointer in the Audio/Video: Playback component | 5.3 | 0.0026 | | | [CVE-2026-6755](https://patchblox.com/security/data/cve/CVE-2026-6755.md) | Routine | Mitigation bypass in the DOM: postMessage component | 6.5 | 0.0025 | | | [CVE-2026-8951](https://patchblox.com/security/data/cve/CVE-2026-8951.md) | Routine | Spoofing issue in the Toolbar component in Firefox for Android | 6.5 | 0.0025 | | | [CVE-2026-12300](https://patchblox.com/security/data/cve/CVE-2026-12300.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-12301](https://patchblox.com/security/data/cve/CVE-2026-12301.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-4728](https://patchblox.com/security/data/cve/CVE-2026-4728.md) | Routine | Spoofing issue in the Privacy: Anti-Tracking component | 6.5 | 0.0025 | | | [CVE-2025-9186](https://patchblox.com/security/data/cve/CVE-2025-9186.md) | Routine | Spoofing issue in the Address Bar component of Firefox Focus for Android | 6.5 | 0.0024 | | | [CVE-2026-6783](https://patchblox.com/security/data/cve/CVE-2026-6783.md) | Routine | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component | 5.3 | 0.0023 | | | [CVE-2026-12303](https://patchblox.com/security/data/cve/CVE-2026-12303.md) | Routine | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component | 4.3 | 0.0022 | | | [CVE-2026-24868](https://patchblox.com/security/data/cve/CVE-2026-24868.md) | Routine | Mitigation bypass in the Privacy: Anti-Tracking component | 6.5 | 0.0022 | | | [CVE-2026-12319](https://patchblox.com/security/data/cve/CVE-2026-12319.md) | Routine | Denial-of-service in the Audio/Video: Playback component | 6.5 | 0.0021 | | | [CVE-2026-6775](https://patchblox.com/security/data/cve/CVE-2026-6775.md) | Routine | Incorrect boundary conditions in the WebRTC component | 5.3 | 0.0021 | | | [CVE-2026-6779](https://patchblox.com/security/data/cve/CVE-2026-6779.md) | Routine | Other issue in the JavaScript Engine component | 5.3 | 0.0021 | | | [CVE-2026-12322](https://patchblox.com/security/data/cve/CVE-2026-12322.md) | Routine | Clickjacking issue in the Widget: Gtk component | 5.4 | 0.0021 | | | [CVE-2026-8971](https://patchblox.com/security/data/cve/CVE-2026-8971.md) | Routine | Same-origin policy bypass in the Networking: JAR component | 6.5 | 0.0021 | | | [CVE-2026-12320](https://patchblox.com/security/data/cve/CVE-2026-12320.md) | Routine | Information disclosure in the Password Manager component | 4.3 | 0.0018 | | | [CVE-2026-12323](https://patchblox.com/security/data/cve/CVE-2026-12323.md) | Routine | Spoofing issue in the DOM: Core & HTML component | 5.4 | 0.0017 | | | [CVE-2026-2802](https://patchblox.com/security/data/cve/CVE-2026-2802.md) | Routine | Race condition in the JavaScript: GC component | 4.2 | 0.0016 | | | [CVE-2026-6777](https://patchblox.com/security/data/cve/CVE-2026-6777.md) | Routine | Other issue in the Networking: DNS component | 5.3 | 0.0016 | | | [CVE-2026-12321](https://patchblox.com/security/data/cve/CVE-2026-12321.md) | Routine | JIT miscompilation in the JavaScript: WebAssembly component | 5.4 | 0.0016 | | | [CVE-2026-6774](https://patchblox.com/security/data/cve/CVE-2026-6774.md) | Routine | Mitigation bypass in the DOM: Security component | 5.4 | 0.0015 | | | [CVE-2026-3846](https://patchblox.com/security/data/cve/CVE-2026-3846.md) | Routine | Same-origin policy bypass in the CSS Parsing and Computation component | 6.5 | 0.0013 | | --- Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.