{
  "fix": "Mozilla Firefox ESR (son) 140.3.0",
  "url": "https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr.son-140.3.0",
  "summary": "Mozilla Firefox ESR (son) 140.3.0, released September 16, 2025, fixes 142 CVEs in Mozilla Firefox ESR (son). One of them is being exploited (CVE-2024-9680); 1 on CISA KEV. Patch Radar priority: Patch now. The latest Mozilla Firefox ESR (son) is 153.7.0, which also fixes every one of these CVEs.",
  "platform": "windows-app",
  "type": "app-version",
  "title": "Mozilla Firefox ESR (son) 140.3.0",
  "released": "2025-09-16T00:00:00Z",
  "priority": "Patch now",
  "priorityTier": 1,
  "priorityReason": "Closes CVE-2024-9680, exploited (CISA KEV, ransomware)",
  "supported": true,
  "cveCount": 142,
  "exploitedCveCount": 1,
  "kevCveCount": 1,
  "ransomwareCveCount": 1,
  "maxEpss": 0.23184,
  "maxCvss": 10,
  "appliesTo": [
    {
      "product": "Mozilla Firefox ESR (son)",
      "productUrl": "https://patchblox.com/security/product/windows-app/mozilla-firefox-esr-son",
      "fixedVersion": "140.3.0",
      "latestVersion": "153.7.0",
      "supported": true
    }
  ],
  "supersededBy": {
    "product": "Mozilla Firefox ESR (son)",
    "latestVersion": "153.7.0",
    "productUrl": "https://patchblox.com/security/product/windows-app/mozilla-firefox-esr-son"
  },
  "cves": [
    {
      "cveId": "CVE-2024-9680",
      "url": "https://patchblox.com/security/cve/CVE-2024-9680",
      "title": "Mozilla Firefox Use-After-Free Vulnerability",
      "priority": "Patch now",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.23184,
      "kev": true,
      "ransomware": true,
      "exploited": true,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-2857",
      "url": "https://patchblox.com/security/cve/CVE-2025-2857",
      "title": "Incorrect handle could lead to sandbox escapes",
      "priority": "Urgent",
      "cvss": 10,
      "epss": 0.01976,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11704",
      "url": "https://patchblox.com/security/cve/CVE-2024-11704",
      "title": "Mozilla Firefox ESR and 8 others: Double Free",
      "priority": "Urgent",
      "severity": "critical",
      "cvss": 9.8,
      "epss": 0.00913,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11693",
      "url": "https://patchblox.com/security/cve/CVE-2024-11693",
      "title": "Mozilla Firefox ESR and 8 others: The executable file warning was not presented when downloading .library-ms files.",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00827,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-49710",
      "url": "https://patchblox.com/security/cve/CVE-2025-49710",
      "title": "Integer overflow in OrderedHashTable",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00754,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-49709",
      "url": "https://patchblox.com/security/cve/CVE-2025-49709",
      "title": "Memory corruption in canvas surfaces",
      "priority": "Urgent",
      "cvss": 9.8,
      "epss": 0.00671,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10004",
      "url": "https://patchblox.com/security/cve/CVE-2024-10004",
      "title": "Mozilla Firefox ESR and 4 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "Urgent",
      "cvss": 9.1,
      "epss": 0.00381,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1941",
      "url": "https://patchblox.com/security/cve/CVE-2025-1941",
      "title": "Lock screen setting bypass in Firefox Focus for Android",
      "priority": "Urgent",
      "cvss": 9.1,
      "epss": 0.00369,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0242",
      "url": "https://patchblox.com/security/cve/CVE-2025-0242",
      "title": "Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.14716,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0247",
      "url": "https://patchblox.com/security/cve/CVE-2025-0247",
      "title": "Memory safety bugs fixed in Firefox 134 and Thunderbird 134",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.10695,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4918",
      "url": "https://patchblox.com/security/cve/CVE-2025-4918",
      "title": "Out-of-bounds access when resolving Promise objects",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.09515,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4919",
      "url": "https://patchblox.com/security/cve/CVE-2025-4919",
      "title": "Out-of-bounds access when optimizing linear sums",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.09115,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6424",
      "url": "https://patchblox.com/security/cve/CVE-2025-6424",
      "title": "Use-after-free in FontFaceSet",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.079,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8381",
      "url": "https://patchblox.com/security/cve/CVE-2024-8381",
      "title": "Mozilla Firefox ESR and 6 others: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.04395,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6436",
      "url": "https://patchblox.com/security/cve/CVE-2025-6436",
      "title": "Memory safety bugs fixed in Firefox 140 and Thunderbird 140",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.1,
      "epss": 0.04256,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1009",
      "url": "https://patchblox.com/security/cve/CVE-2025-1009",
      "title": "Use-after-free in XSLT",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.01199,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3028",
      "url": "https://patchblox.com/security/cve/CVE-2025-3028",
      "title": "Use-after-free triggered by XSLTProcessor",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.0087,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10466",
      "url": "https://patchblox.com/security/cve/CVE-2024-10466",
      "title": "Mozilla Firefox ESR and 7 others: Uncontrolled Resource Consumption",
      "priority": "High",
      "severity": "MODERATE",
      "cvss": 7.5,
      "epss": 0.0081,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11697",
      "url": "https://patchblox.com/security/cve/CVE-2024-11697",
      "title": "Mozilla Firefox ESR and 8 others: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00809,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9401",
      "url": "https://patchblox.com/security/cve/CVE-2024-9401",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00739,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0241",
      "url": "https://patchblox.com/security/cve/CVE-2025-0241",
      "title": "Memory corruption when using JavaScript Text Segmentation",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.7,
      "epss": 0.00734,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11699",
      "url": "https://patchblox.com/security/cve/CVE-2024-11699",
      "title": "Mozilla Firefox ESR and 8 others: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00723,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8384",
      "url": "https://patchblox.com/security/cve/CVE-2024-8384",
      "title": "Mozilla Firefox ESR and 6 others: Use After Free",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00719,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-2817",
      "url": "https://patchblox.com/security/cve/CVE-2025-2817",
      "title": "Privilege escalation in Thunderbird Updater",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00667,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11705",
      "url": "https://patchblox.com/security/cve/CVE-2024-11705",
      "title": "Mozilla Firefox ESR and 8 others: NULL Pointer Dereference",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.1,
      "epss": 0.0066,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10458",
      "url": "https://patchblox.com/security/cve/CVE-2024-10458",
      "title": "Mozilla Firefox ESR and 7 others: Improper Preservation of Permissions",
      "priority": "High",
      "severity": "MODERATE",
      "cvss": 8.2,
      "epss": 0.0064,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7520",
      "url": "https://patchblox.com/security/cve/CVE-2024-7520",
      "title": "Mozilla Firefox ESR and 6 others: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00638,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8383",
      "url": "https://patchblox.com/security/cve/CVE-2024-8383",
      "title": "Mozilla Firefox ESR and 4 others: Initialization of a Resource with an Insecure Default",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00637,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7522",
      "url": "https://patchblox.com/security/cve/CVE-2024-7522",
      "title": "Mozilla Firefox ESR and 6 others: Out-of-bounds Read",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00634,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10459",
      "url": "https://patchblox.com/security/cve/CVE-2024-10459",
      "title": "Mozilla Firefox ESR and 7 others: Use After Free",
      "priority": "High",
      "severity": "MODERATE",
      "cvss": 7.6,
      "epss": 0.00634,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10467",
      "url": "https://patchblox.com/security/cve/CVE-2024-10467",
      "title": "Mozilla Firefox ESR and 7 others: Out-of-bounds Read",
      "priority": "High",
      "severity": "MODERATE",
      "cvss": 8.8,
      "epss": 0.00632,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7519",
      "url": "https://patchblox.com/security/cve/CVE-2024-7519",
      "title": "Mozilla Firefox ESR and 6 others: Out-of-bounds Write",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00629,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1011",
      "url": "https://patchblox.com/security/cve/CVE-2025-1011",
      "title": "A bug in WebAssembly code generation could result in a crash",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00629,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7521",
      "url": "https://patchblox.com/security/cve/CVE-2024-7521",
      "title": "Mozilla Firefox ESR and 6 others: Improper Handling of Exceptional Conditions",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00616,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9402",
      "url": "https://patchblox.com/security/cve/CVE-2024-9402",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00615,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7527",
      "url": "https://patchblox.com/security/cve/CVE-2024-7527",
      "title": "Mozilla Firefox ESR and 6 others: Use After Free",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00607,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7525",
      "url": "https://patchblox.com/security/cve/CVE-2024-7525",
      "title": "Mozilla Firefox ESR and 6 others: Improper Access Control",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00598,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8382",
      "url": "https://patchblox.com/security/cve/CVE-2024-8382",
      "title": "Mozilla Firefox ESR and 6 others: Improper Check for Dropped Privileges",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00595,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1016",
      "url": "https://patchblox.com/security/cve/CVE-2025-1016",
      "title": "Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00588,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9396",
      "url": "https://patchblox.com/security/cve/CVE-2024-9396",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00587,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7526",
      "url": "https://patchblox.com/security/cve/CVE-2024-7526",
      "title": "Mozilla Firefox ESR and 6 others: Use of Uninitialized Resource",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.0058,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8385",
      "url": "https://patchblox.com/security/cve/CVE-2024-8385",
      "title": "Mozilla Firefox ESR and 7 others: Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00575,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1017",
      "url": "https://patchblox.com/security/cve/CVE-2025-1017",
      "title": "Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00575,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1937",
      "url": "https://patchblox.com/security/cve/CVE-2025-1937",
      "title": "Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00562,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1020",
      "url": "https://patchblox.com/security/cve/CVE-2025-1020",
      "title": "Memory safety bugs fixed in Firefox 135 and Thunderbird 135",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.00541,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1931",
      "url": "https://patchblox.com/security/cve/CVE-2025-1931",
      "title": "Use-after-free in WebTransportChild",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00538,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9392",
      "url": "https://patchblox.com/security/cve/CVE-2024-9392",
      "title": "Mozilla Firefox ESR and 7 others: Origin Validation Error",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.8,
      "epss": 0.00535,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11702",
      "url": "https://patchblox.com/security/cve/CVE-2024-11702",
      "title": "Mozilla Firefox ESR and 8 others: Inappropriate Encoding for Output Context",
      "priority": "High",
      "cvss": 7.5,
      "epss": 0.00531,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7529",
      "url": "https://patchblox.com/security/cve/CVE-2024-7529",
      "title": "Mozilla Firefox ESR and 6 others: User Interface (UI) Misrepresentation of Critical Information",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9394",
      "url": "https://patchblox.com/security/cve/CVE-2024-9394",
      "title": "Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.6,
      "epss": 0.00521,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11694",
      "url": "https://patchblox.com/security/cve/CVE-2024-11694",
      "title": "Mozilla Firefox ESR and 8 others: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00518,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7528",
      "url": "https://patchblox.com/security/cve/CVE-2024-7528",
      "title": "Mozilla Firefox ESR and 6 others: Use After Free",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00516,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3030",
      "url": "https://patchblox.com/security/cve/CVE-2025-3030",
      "title": "Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00513,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11700",
      "url": "https://patchblox.com/security/cve/CVE-2024-11700",
      "title": "Mozilla Firefox ESR and 8 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "High",
      "cvss": 8.1,
      "epss": 0.00511,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7518",
      "url": "https://patchblox.com/security/cve/CVE-2024-7518",
      "title": "Mozilla Firefox ESR and 6 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00509,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4091",
      "url": "https://patchblox.com/security/cve/CVE-2025-4091",
      "title": "Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00507,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9400",
      "url": "https://patchblox.com/security/cve/CVE-2024-9400",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00506,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5268",
      "url": "https://patchblox.com/security/cve/CVE-2025-5268",
      "title": "Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00506,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11692",
      "url": "https://patchblox.com/security/cve/CVE-2024-11692",
      "title": "Mozilla Firefox ESR and 8 others: Authentication Bypass by Spoofing",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00491,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7524",
      "url": "https://patchblox.com/security/cve/CVE-2024-7524",
      "title": "Mozilla Firefox ESR and 4 others: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 9.6,
      "epss": 0.00489,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1942",
      "url": "https://patchblox.com/security/cve/CVE-2025-1942",
      "title": "Disclosure of uninitialized memory when .toUpperCase() causes string to get longer",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.00483,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3034",
      "url": "https://patchblox.com/security/cve/CVE-2025-3034",
      "title": "Memory safety bugs fixed in Firefox 137 and Thunderbird 137",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.1,
      "epss": 0.00482,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11695",
      "url": "https://patchblox.com/security/cve/CVE-2024-11695",
      "title": "Mozilla Firefox ESR and 8 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00461,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1010",
      "url": "https://patchblox.com/security/cve/CVE-2025-1010",
      "title": "Use-after-free in Custom Highlight",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00461,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4083",
      "url": "https://patchblox.com/security/cve/CVE-2025-4083",
      "title": "Process isolation bypass using \u0022javascript:\u0022 URI links in cross-origin frames",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.1,
      "epss": 0.00459,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6435",
      "url": "https://patchblox.com/security/cve/CVE-2025-6435",
      "title": "Save as in Devtools could download files without sanitizing the extension",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.1,
      "epss": 0.00457,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1934",
      "url": "https://patchblox.com/security/cve/CVE-2025-1934",
      "title": "Unexpected GC during RegExp bailout processing",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00453,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1012",
      "url": "https://patchblox.com/security/cve/CVE-2025-1012",
      "title": "Use-after-free during concurrent delazification",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00449,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1936",
      "url": "https://patchblox.com/security/cve/CVE-2025-1936",
      "title": "Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00447,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9403",
      "url": "https://patchblox.com/security/cve/CVE-2024-9403",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00447,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1943",
      "url": "https://patchblox.com/security/cve/CVE-2025-1943",
      "title": "Memory safety bugs fixed in Firefox 136 and Thunderbird 136",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.2,
      "epss": 0.00437,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8900",
      "url": "https://patchblox.com/security/cve/CVE-2024-8900",
      "title": "Mozilla Firefox ESR and 7 others: Incorrect Permission Assignment for Critical Resource",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00426,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1932",
      "url": "https://patchblox.com/security/cve/CVE-2025-1932",
      "title": "Inconsistent comparator in XSLT sorting led to out-of-bounds access",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00423,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3032",
      "url": "https://patchblox.com/security/cve/CVE-2025-3032",
      "title": "Leaking file descriptors from the fork server",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.4,
      "epss": 0.00406,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1930",
      "url": "https://patchblox.com/security/cve/CVE-2025-1930",
      "title": "AudioIPC StreamData could trigger a use-after-free in the Browser process",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00401,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9393",
      "url": "https://patchblox.com/security/cve/CVE-2024-9393",
      "title": "Mozilla Firefox ESR and 7 others: Origin Validation Error",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.6,
      "epss": 0.00397,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1014",
      "url": "https://patchblox.com/security/cve/CVE-2025-1014",
      "title": "Certificate length was not properly checked",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00388,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7530",
      "url": "https://patchblox.com/security/cve/CVE-2024-7530",
      "title": "Mozilla Firefox ESR and 4 others: Use After Free",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00384,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6427",
      "url": "https://patchblox.com/security/cve/CVE-2025-6427",
      "title": "connect-src Content Security Policy restriction could be bypassed",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.1,
      "epss": 0.00368,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11696",
      "url": "https://patchblox.com/security/cve/CVE-2024-11696",
      "title": "Mozilla Firefox ESR and 8 others: Improper Verification of Cryptographic Signature",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00363,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3029",
      "url": "https://patchblox.com/security/cve/CVE-2025-3029",
      "title": "URL Bar Spoofing via non-BMP Unicode characters",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00355,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6429",
      "url": "https://patchblox.com/security/cve/CVE-2025-6429",
      "title": "Incorrect parsing of URLs could have allowed embedding of youtube.com",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.5,
      "epss": 0.00352,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6432",
      "url": "https://patchblox.com/security/cve/CVE-2025-6432",
      "title": "DNS Requests leaked outside of a configured SOCKS proxy",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.6,
      "epss": 0.0035,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1935",
      "url": "https://patchblox.com/security/cve/CVE-2025-1935",
      "title": "Clickjacking the registerProtocolHandler info-bar",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00343,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5272",
      "url": "https://patchblox.com/security/cve/CVE-2025-5272",
      "title": "Memory safety bugs fixed in Firefox 139 and Thunderbird 139",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.3,
      "epss": 0.00343,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5266",
      "url": "https://patchblox.com/security/cve/CVE-2025-5266",
      "title": "Script element events leaked cross-origin resource status",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00338,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1938",
      "url": "https://patchblox.com/security/cve/CVE-2025-1938",
      "title": "Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00337,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4087",
      "url": "https://patchblox.com/security/cve/CVE-2025-4087",
      "title": "Unsafe attribute access during XPath parsing",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00323,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1933",
      "url": "https://patchblox.com/security/cve/CVE-2025-1933",
      "title": "JIT corruption of WASM i32 return values on 64-bit CPUs",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00319,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1013",
      "url": "https://patchblox.com/security/cve/CVE-2025-1013",
      "title": "Potential opening of private browsing tabs in normal browsing windows",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00318,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4085",
      "url": "https://patchblox.com/security/cve/CVE-2025-4085",
      "title": "Potential information leakage and privilege escalation in UITour actor",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.1,
      "epss": 0.00308,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6425",
      "url": "https://patchblox.com/security/cve/CVE-2025-6425",
      "title": "The WebCompat WebExtension shipped with Firefox exposed a persistent UUID",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00307,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5264",
      "url": "https://patchblox.com/security/cve/CVE-2025-5264",
      "title": "Potential local code execution in \u201CCopy as cURL\u201D command",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00301,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6433",
      "url": "https://patchblox.com/security/cve/CVE-2025-6433",
      "title": "WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate",
      "priority": "High",
      "severity": "Medium",
      "cvss": 9.8,
      "epss": 0.00297,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5270",
      "url": "https://patchblox.com/security/cve/CVE-2025-5270",
      "title": "SNI was sometimes unencrypted",
      "priority": "High",
      "severity": "Medium",
      "cvss": 7.5,
      "epss": 0.00288,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5267",
      "url": "https://patchblox.com/security/cve/CVE-2025-5267",
      "title": "Clickjacking vulnerability could have led to leaking saved payment card details",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 8.8,
      "epss": 0.00279,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7523",
      "url": "https://patchblox.com/security/cve/CVE-2024-7523",
      "title": "Mozilla Firefox ESR and 4 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.1,
      "epss": 0.00277,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6430",
      "url": "https://patchblox.com/security/cve/CVE-2025-6430",
      "title": "Content-Disposition header ignored when a file is included in an embed or object tag",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.00266,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5263",
      "url": "https://patchblox.com/security/cve/CVE-2025-5263",
      "title": "Error handling for script execution was incorrectly isolated from web content",
      "priority": "High",
      "severity": "Medium",
      "cvss": 8.8,
      "epss": 0.00263,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0243",
      "url": "https://patchblox.com/security/cve/CVE-2025-0243",
      "title": "Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6",
      "priority": "High",
      "severity": "IMPORTANT",
      "cvss": 7.5,
      "epss": 0.0025,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1940",
      "url": "https://patchblox.com/security/cve/CVE-2025-1940",
      "title": "Android Intent confirmation prompt tapjacking using Select options",
      "priority": "High",
      "cvss": 7.1,
      "epss": 0.00249,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3033",
      "url": "https://patchblox.com/security/cve/CVE-2025-3033",
      "title": "Opening local .url files could lead to another file being opened",
      "priority": "High",
      "cvss": 7.7,
      "epss": 0.00174,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0244",
      "url": "https://patchblox.com/security/cve/CVE-2025-0244",
      "title": "Address bar spoofing using an invalid protocol scheme on Firefox for Android",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.07451,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0238",
      "url": "https://patchblox.com/security/cve/CVE-2025-0238",
      "title": "Use-after-free when breaking lines in text",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00794,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10463",
      "url": "https://patchblox.com/security/cve/CVE-2024-10463",
      "title": "Mozilla Firefox ESR and 7 others: Observable Discrepancy",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 6.5,
      "epss": 0.00734,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0240",
      "url": "https://patchblox.com/security/cve/CVE-2025-0240",
      "title": "Compartment mismatch when parsing JavaScript JSON module",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00673,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10464",
      "url": "https://patchblox.com/security/cve/CVE-2024-10464",
      "title": "Mozilla Firefox ESR and 7 others: Out-of-bounds Read",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 6.5,
      "epss": 0.00637,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10461",
      "url": "https://patchblox.com/security/cve/CVE-2024-10461",
      "title": "Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 6.1,
      "epss": 0.00599,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0237",
      "url": "https://patchblox.com/security/cve/CVE-2025-0237",
      "title": "WebChannel APIs susceptible to confused deputy attack",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.8,
      "epss": 0.00598,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9398",
      "url": "https://patchblox.com/security/cve/CVE-2024-9398",
      "title": "Mozilla Firefox ESR and 7 others: Observable Discrepancy",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 5.3,
      "epss": 0.00566,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10462",
      "url": "https://patchblox.com/security/cve/CVE-2024-10462",
      "title": "Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 6.5,
      "epss": 0.00565,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10465",
      "url": "https://patchblox.com/security/cve/CVE-2024-10465",
      "title": "Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 6.5,
      "epss": 0.00565,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11706",
      "url": "https://patchblox.com/security/cve/CVE-2024-11706",
      "title": "Mozilla Firefox ESR and 8 others: NULL Pointer Dereference",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00499,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4082",
      "url": "https://patchblox.com/security/cve/CVE-2025-4082",
      "title": "WebGL shader attribute memory corruption in Thunderbird for macOS",
      "priority": "Routine",
      "cvss": 5.9,
      "epss": 0.00459,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1414",
      "url": "https://patchblox.com/security/cve/CVE-2025-1414",
      "title": "Memory safety bugs fixed in Firefox 135.0.1",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00453,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-7531",
      "url": "https://patchblox.com/security/cve/CVE-2024-7531",
      "title": "Mozilla Firefox ESR and 4 others: Time-of-check Time-of-use (TOCTOU) Race Condition",
      "priority": "Routine",
      "severity": "medium",
      "cvss": 6.5,
      "epss": 0.00437,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11701",
      "url": "https://patchblox.com/security/cve/CVE-2024-11701",
      "title": "Mozilla Firefox ESR and 8 others: Authentication Bypass by Spoofing",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 4.3,
      "epss": 0.0042,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10468",
      "url": "https://patchblox.com/security/cve/CVE-2024-10468",
      "title": "Mozilla Firefox ESR and 7 others: Allocation of Resources Without Limits or Throttling",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 5.3,
      "epss": 0.00416,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1018",
      "url": "https://patchblox.com/security/cve/CVE-2025-1018",
      "title": "Fullscreen notification is not displayed when fullscreen is re-requested",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 5.3,
      "epss": 0.00407,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-8386",
      "url": "https://patchblox.com/security/cve/CVE-2024-8386",
      "title": "Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 6.1,
      "epss": 0.00388,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9397",
      "url": "https://patchblox.com/security/cve/CVE-2024-9397",
      "title": "Mozilla Firefox ESR and 7 others: Improper Restriction of Rendered UI Layers or Frames",
      "priority": "Routine",
      "severity": "IMPORTANT",
      "cvss": 6.1,
      "epss": 0.00373,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1019",
      "url": "https://patchblox.com/security/cve/CVE-2025-1019",
      "title": "Fullscreen notification not properly displayed",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 4.3,
      "epss": 0.00357,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11708",
      "url": "https://patchblox.com/security/cve/CVE-2024-11708",
      "title": "Mozilla Firefox ESR and 8 others: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00353,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-10460",
      "url": "https://patchblox.com/security/cve/CVE-2024-10460",
      "title": "Mozilla Firefox ESR and 7 others: Origin Validation Error",
      "priority": "Routine",
      "severity": "MODERATE",
      "cvss": 5.3,
      "epss": 0.00344,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4090",
      "url": "https://patchblox.com/security/cve/CVE-2025-4090",
      "title": "Leaked library paths in Thunderbird for Android",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00335,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3608",
      "url": "https://patchblox.com/security/cve/CVE-2025-3608",
      "title": "Race condition in nsHttpTransaction could lead to memory corruption",
      "priority": "Routine",
      "cvss": 6.5,
      "epss": 0.0033,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9395",
      "url": "https://patchblox.com/security/cve/CVE-2024-9395",
      "title": "Mozilla Firefox ESR and 4 others: A specially crafted filename containing a large number of spaces could obscure the file\u0027s extension when\u2026",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00327,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4092",
      "url": "https://patchblox.com/security/cve/CVE-2025-4092",
      "title": "Memory safety bugs fixed in Firefox 138 and Thunderbird 138",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00312,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5271",
      "url": "https://patchblox.com/security/cve/CVE-2025-5271",
      "title": "Devtools\u0027 preview ignored CSP headers",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00307,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3031",
      "url": "https://patchblox.com/security/cve/CVE-2025-3031",
      "title": "JIT optimization bug with different stack slot sizes",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00305,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-3035",
      "url": "https://patchblox.com/security/cve/CVE-2025-3035",
      "title": "Tab title disclosure across pages when using AI chatbot",
      "priority": "Routine",
      "cvss": 5.3,
      "epss": 0.00299,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4086",
      "url": "https://patchblox.com/security/cve/CVE-2025-4086",
      "title": "Specially crafted filename could be used to obscure download type",
      "priority": "Routine",
      "cvss": 6.5,
      "epss": 0.00298,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0245",
      "url": "https://patchblox.com/security/cve/CVE-2025-0245",
      "title": "Lock screen setting bypass in Firefox Focus for Android",
      "priority": "Routine",
      "cvss": 3.3,
      "epss": 0.0029,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-6434",
      "url": "https://patchblox.com/security/cve/CVE-2025-6434",
      "title": "HTTPS-Only exception screen lacked anti-clickjacking delay",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 4.3,
      "epss": 0.00283,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9391",
      "url": "https://patchblox.com/security/cve/CVE-2024-9391",
      "title": "Mozilla Firefox ESR and 4 others: Authentication Bypass by Spoofing",
      "priority": "Routine",
      "cvss": 6.5,
      "epss": 0.00282,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-9936",
      "url": "https://patchblox.com/security/cve/CVE-2024-9936",
      "title": "Mozilla Firefox ESR and 4 others: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.00274,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-0239",
      "url": "https://patchblox.com/security/cve/CVE-2025-0239",
      "title": "Alt-Svc ALPN validation failure when redirected",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 5.4,
      "epss": 0.00227,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2024-11703",
      "url": "https://patchblox.com/security/cve/CVE-2024-11703",
      "title": "Mozilla Firefox ESR and 5 others: Insufficiently Protected Credentials",
      "priority": "Routine",
      "cvss": 5.7,
      "epss": 0.00219,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-5265",
      "url": "https://patchblox.com/security/cve/CVE-2025-5265",
      "title": "Potential local code execution in \u201CCopy as cURL\u201D command",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 4.8,
      "epss": 0.00208,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4089",
      "url": "https://patchblox.com/security/cve/CVE-2025-4089",
      "title": "Potential local code execution in \u0022copy as cURL\u0022 command",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 5.1,
      "epss": 0.00187,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-1939",
      "url": "https://patchblox.com/security/cve/CVE-2025-1939",
      "title": "Tapjacking in Android Custom Tabs using transition animations",
      "priority": "Routine",
      "cvss": 3.9,
      "epss": 0.00187,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2025-4088",
      "url": "https://patchblox.com/security/cve/CVE-2025-4088",
      "title": "Cross-site request forgery via storage access API redirects",
      "priority": "Routine",
      "severity": "Medium",
      "cvss": 6.5,
      "epss": 0.0018,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T19:49:26Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}