# Mozilla Thunderbird ESR (ro) 153.0.1 Mozilla Thunderbird ESR (ro) 153.0.1, released July 23, 2026, fixes 272 CVEs in Mozilla Thunderbird ESR (ro). None of them is reported as exploited. Patch Radar priority: Urgent. The latest Mozilla Thunderbird ESR (ro) is 153.7.0, which also fixes every one of these CVEs. - Web page: https://patchblox.com/security/fix/windows-app/mozilla.thunderbird.esr.ro-153.0.1 - Platform: Windows apps - Released: Jul 23, 2026 - Priority: Urgent (Closes CVE-2026-2796, rated Critical) - CVEs: 272, exploited: 0, on CISA KEV: 0 - Superseded by: [Mozilla Thunderbird ESR (ro) 153.7.0](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-esr-ro.md), the latest version, which also fixes every CVE listed here ## Applies to | Product | Release | Fixed in | |---|---|---| | [Mozilla Thunderbird ESR (ro)](https://patchblox.com/security/data/product/windows-app/mozilla-thunderbird-esr-ro.md) | | 153.0.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-2796](https://patchblox.com/security/data/cve/CVE-2026-2796.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0095 | | | [CVE-2026-16357](https://patchblox.com/security/data/cve/CVE-2026-16357.md) | Urgent | Incorrect boundary conditions in the Graphics component | 9.8 | 0.0087 | | | [CVE-2026-2805](https://patchblox.com/security/data/cve/CVE-2026-2805.md) | Urgent | Invalid pointer in the DOM: Core & HTML component | 9.8 | 0.0066 | | | [CVE-2026-16402](https://patchblox.com/security/data/cve/CVE-2026-16402.md) | Urgent | Integer overflow in the Graphics: ImageLib component | 9.8 | 0.0062 | | | [CVE-2025-8028](https://patchblox.com/security/data/cve/CVE-2025-8028.md) | Urgent | Large branch table could lead to truncated instruction | 9.8 | 0.0058 | | | [CVE-2026-16389](https://patchblox.com/security/data/cve/CVE-2026-16389.md) | Urgent | Incorrect boundary conditions, integer overflow in the Libraries component in NSS | 9.8 | 0.0057 | | | [CVE-2026-16382](https://patchblox.com/security/data/cve/CVE-2026-16382.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0056 | | | [CVE-2026-16388](https://patchblox.com/security/data/cve/CVE-2026-16388.md) | Urgent | Sandbox escape in the DOM: Networking component | 9.8 | 0.0055 | | | [CVE-2026-16410](https://patchblox.com/security/data/cve/CVE-2026-16410.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0055 | | | [CVE-2026-2799](https://patchblox.com/security/data/cve/CVE-2026-2799.md) | Urgent | Use-after-free in the DOM: Core & HTML component | 9.8 | 0.0054 | | | [CVE-2026-16393](https://patchblox.com/security/data/cve/CVE-2026-16393.md) | Urgent | Incorrect boundary conditions in the Graphics: WebGPU component | 9.1 | 0.0054 | | | [CVE-2026-16392](https://patchblox.com/security/data/cve/CVE-2026-16392.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.1 | 0.0053 | | | [CVE-2026-2797](https://patchblox.com/security/data/cve/CVE-2026-2797.md) | Urgent | Use-after-free in the JavaScript: GC component | 9.8 | 0.0053 | | | [CVE-2025-9187](https://patchblox.com/security/data/cve/CVE-2025-9187.md) | Urgent | Memory safety bugs fixed in Firefox 142 and Thunderbird 142 | 9.8 | 0.0052 | | | [CVE-2026-4724](https://patchblox.com/security/data/cve/CVE-2026-4724.md) | Urgent | Undefined behavior in the Audio/Video component | 9.1 | 0.0052 | | | [CVE-2026-16353](https://patchblox.com/security/data/cve/CVE-2026-16353.md) | Urgent | Invalid pointer in the DOM: Bindings (WebIDL) component | 9.8 | 0.0052 | | | [CVE-2026-16407](https://patchblox.com/security/data/cve/CVE-2026-16407.md) | Urgent | Mitigation bypass in the DOM: Service Workers component | 9.8 | 0.0051 | | | [CVE-2025-8031](https://patchblox.com/security/data/cve/CVE-2025-8031.md) | Urgent | Incorrect URL stripping in CSP reports | 9.8 | 0.0051 | | | [CVE-2025-14326](https://patchblox.com/security/data/cve/CVE-2025-14326.md) | Urgent | Use-after-free in the Audio/Video: GMP component | 9.8 | 0.0050 | | | [CVE-2025-8044](https://patchblox.com/security/data/cve/CVE-2025-8044.md) | Urgent | Memory safety bugs fixed in Firefox 141 and Thunderbird 141 | 9.8 | 0.0048 | | | [CVE-2026-16360](https://patchblox.com/security/data/cve/CVE-2026-16360.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 | 9.8 | 0.0047 | | | [CVE-2025-8034](https://patchblox.com/security/data/cve/CVE-2025-8034.md) | Urgent | Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0046 | | | [CVE-2026-2806](https://patchblox.com/security/data/cve/CVE-2026-2806.md) | Urgent | Uninitialized memory in the Graphics: Text component | 9.1 | 0.0045 | | | [CVE-2026-0892](https://patchblox.com/security/data/cve/CVE-2026-0892.md) | Urgent | Memory safety bugs fixed in Firefox 147 and Thunderbird 147 | 9.8 | 0.0045 | | | [CVE-2025-8043](https://patchblox.com/security/data/cve/CVE-2025-8043.md) | Urgent | Incorrect URL truncation | 9.8 | 0.0044 | | | [CVE-2026-16363](https://patchblox.com/security/data/cve/CVE-2026-16363.md) | Urgent | JIT miscompilation in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16369](https://patchblox.com/security/data/cve/CVE-2026-16369.md) | Urgent | Integer overflow in the JavaScript: WebAssembly component | 9.8 | 0.0044 | | | [CVE-2026-16370](https://patchblox.com/security/data/cve/CVE-2026-16370.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.1 | 0.0043 | | | [CVE-2025-8027](https://patchblox.com/security/data/cve/CVE-2025-8027.md) | Urgent | JavaScript engine only wrote partial return value to stack | 7.5 | 0.0043 | | | [CVE-2025-8033](https://patchblox.com/security/data/cve/CVE-2025-8033.md) | Urgent | Incorrect JavaScript state machine for generators | 7.5 | 0.0043 | | | [CVE-2026-16364](https://patchblox.com/security/data/cve/CVE-2026-16364.md) | Urgent | Incorrect boundary conditions in the Audio/Video: Playback component | 9.1 | 0.0043 | | | [CVE-2026-8948](https://patchblox.com/security/data/cve/CVE-2026-8948.md) | Urgent | Same-origin policy bypass in the DOM: Networking component | 9.1 | 0.0042 | | | [CVE-2026-16350](https://patchblox.com/security/data/cve/CVE-2026-16350.md) | Urgent | Incorrect boundary conditions in the Audio/Video: cubeb component | 9.8 | 0.0041 | | | [CVE-2026-16355](https://patchblox.com/security/data/cve/CVE-2026-16355.md) | Urgent | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0041 | | | [CVE-2026-16351](https://patchblox.com/security/data/cve/CVE-2026-16351.md) | Urgent | Sandbox escape due to use-after-free in the DOM: Navigation component | 9.8 | 0.0039 | | | [CVE-2026-16352](https://patchblox.com/security/data/cve/CVE-2026-16352.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-16356](https://patchblox.com/security/data/cve/CVE-2026-16356.md) | Urgent | Sandbox escape due to use-after-free in the Disability Access APIs component | 9.8 | 0.0039 | | | [CVE-2026-16368](https://patchblox.com/security/data/cve/CVE-2026-16368.md) | Urgent | Incorrect boundary conditions in the JavaScript: WebAssembly component | 9.8 | 0.0039 | | | [CVE-2026-16377](https://patchblox.com/security/data/cve/CVE-2026-16377.md) | Urgent | Mitigation bypass in the PDF Viewer component | 9.8 | 0.0039 | | | [CVE-2026-16383](https://patchblox.com/security/data/cve/CVE-2026-16383.md) | Urgent | Mitigation bypass in the DOM: Networking component | 9.8 | 0.0039 | | | [CVE-2026-16367](https://patchblox.com/security/data/cve/CVE-2026-16367.md) | Urgent | Sandbox escape due to invalid pointer in the Disability Access APIs component | 10.0 | 0.0038 | | | [CVE-2026-2800](https://patchblox.com/security/data/cve/CVE-2026-2800.md) | Urgent | Spoofing issue in the WebAuthn component in Firefox for Android | 9.8 | 0.0035 | | | [CVE-2026-0881](https://patchblox.com/security/data/cve/CVE-2026-0881.md) | Urgent | Sandbox escape in the Messaging System component | 10.0 | 0.0035 | | | [CVE-2026-4729](https://patchblox.com/security/data/cve/CVE-2026-4729.md) | Urgent | Memory safety bugs fixed in Firefox 149 and Thunderbird 149 | 9.8 | 0.0035 | | | [CVE-2026-16390](https://patchblox.com/security/data/cve/CVE-2026-16390.md) | Urgent | Mitigation bypass in the Enterprise Policies component | 9.1 | 0.0032 | | | [CVE-2026-16361](https://patchblox.com/security/data/cve/CVE-2026-16361.md) | Urgent | Memory safety bugs fixed in Thunderbird ESR 140.13 | 9.8 | 0.0032 | | | [CVE-2026-16380](https://patchblox.com/security/data/cve/CVE-2026-16380.md) | Urgent | Mitigation bypass in the Networking component | 9.1 | 0.0031 | | | [CVE-2026-12293](https://patchblox.com/security/data/cve/CVE-2026-12293.md) | Urgent | Use-after-free in the Graphics: WebGPU component | 9.8 | 0.0030 | | | [CVE-2026-2795](https://patchblox.com/security/data/cve/CVE-2026-2795.md) | Urgent | Use-after-free in the JavaScript: GC component | 9.8 | 0.0030 | | | [CVE-2026-2807](https://patchblox.com/security/data/cve/CVE-2026-2807.md) | Urgent | Memory safety bugs fixed in Firefox 148 and Thunderbird 148 | 9.8 | 0.0029 | | | [CVE-2026-6768](https://patchblox.com/security/data/cve/CVE-2026-6768.md) | Urgent | Mitigation bypass in the Networking: Cookies component | 9.8 | 0.0029 | | | [CVE-2026-6760](https://patchblox.com/security/data/cve/CVE-2026-6760.md) | Urgent | Mitigation bypass in the Networking: Cookies component | 9.8 | 0.0028 | | | [CVE-2026-5735](https://patchblox.com/security/data/cve/CVE-2026-5735.md) | Urgent | Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 | 9.8 | 0.0027 | | | [CVE-2026-16359](https://patchblox.com/security/data/cve/CVE-2026-16359.md) | Urgent | Incorrect boundary conditions in the Audio/Video: GMP component | 9.1 | 0.0026 | | | [CVE-2026-12316](https://patchblox.com/security/data/cve/CVE-2026-12316.md) | Urgent | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-16358](https://patchblox.com/security/data/cve/CVE-2026-16358.md) | Urgent | Site isolation issue in the Graphics: WebRender component | 9.8 | 0.0022 | | | [CVE-2026-16349](https://patchblox.com/security/data/cve/CVE-2026-16349.md) | Urgent | Same-origin policy bypass in the DOM: Navigation component | 9.8 | 0.0022 | | | [CVE-2026-16375](https://patchblox.com/security/data/cve/CVE-2026-16375.md) | Urgent | Site isolation issue in the Networking: HTTP component | 9.8 | 0.0021 | | | [CVE-2026-16387](https://patchblox.com/security/data/cve/CVE-2026-16387.md) | Urgent | Site isolation issue in the Networking component | 9.8 | 0.0020 | | | [CVE-2026-16381](https://patchblox.com/security/data/cve/CVE-2026-16381.md) | Urgent | Same-origin policy bypass in the Networking: DNS component | 9.1 | 0.0017 | | | [CVE-2026-2773](https://patchblox.com/security/data/cve/CVE-2026-2773.md) | High | Incorrect boundary conditions in the Web Audio component | 9.8 | 0.0092 | | | [CVE-2026-2774](https://patchblox.com/security/data/cve/CVE-2026-2774.md) | High | Integer overflow in the Audio/Video component | 9.8 | 0.0085 | | | [CVE-2026-2775](https://patchblox.com/security/data/cve/CVE-2026-2775.md) | High | Mitigation bypass in the DOM: HTML Parser component | 9.8 | 0.0084 | | | [CVE-2026-4694](https://patchblox.com/security/data/cve/CVE-2026-4694.md) | High | Incorrect boundary conditions, integer overflow in the Graphics component | 8.2 | 0.0082 | | | [CVE-2026-6758](https://patchblox.com/security/data/cve/CVE-2026-6758.md) | High | Use-after-free in the JavaScript: WebAssembly component | 7.5 | 0.0081 | | | [CVE-2026-2771](https://patchblox.com/security/data/cve/CVE-2026-2771.md) | High | Undefined behavior in the DOM: Core & HTML component | 9.8 | 0.0076 | | | [CVE-2026-2763](https://patchblox.com/security/data/cve/CVE-2026-2763.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2764](https://patchblox.com/security/data/cve/CVE-2026-2764.md) | High | JIT miscompilation, use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2765](https://patchblox.com/security/data/cve/CVE-2026-2765.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2766](https://patchblox.com/security/data/cve/CVE-2026-2766.md) | High | Use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2770](https://patchblox.com/security/data/cve/CVE-2026-2770.md) | High | Use-after-free in the DOM: Bindings (WebIDL) component | 9.8 | 0.0074 | | | [CVE-2026-2772](https://patchblox.com/security/data/cve/CVE-2026-2772.md) | High | Use-after-free in the Audio/Video: Playback component | 9.8 | 0.0074 | | | [CVE-2026-4689](https://patchblox.com/security/data/cve/CVE-2026-4689.md) | High | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component | 10.0 | 0.0071 | | | [CVE-2026-2779](https://patchblox.com/security/data/cve/CVE-2026-2779.md) | High | Incorrect boundary conditions in the Networking: JAR component | 9.8 | 0.0069 | | | [CVE-2026-2769](https://patchblox.com/security/data/cve/CVE-2026-2769.md) | High | Use-after-free in the Storage: IndexedDB component | 8.8 | 0.0069 | | | [CVE-2026-2788](https://patchblox.com/security/data/cve/CVE-2026-2788.md) | High | Incorrect boundary conditions in the Audio/Video: GMP component | 9.8 | 0.0068 | | | [CVE-2025-9179](https://patchblox.com/security/data/cve/CVE-2025-9179.md) | High | Sandbox escape due to invalid pointer in the Audio/Video: GMP component | 9.8 | 0.0065 | | | [CVE-2026-2787](https://patchblox.com/security/data/cve/CVE-2026-2787.md) | High | Use-after-free in the DOM: Window and Location component | 9.8 | 0.0064 | | | [CVE-2025-14321](https://patchblox.com/security/data/cve/CVE-2025-14321.md) | High | Use-after-free in the WebRTC: Signaling component | 9.8 | 0.0064 | | | [CVE-2026-2762](https://patchblox.com/security/data/cve/CVE-2026-2762.md) | High | Integer overflow in the JavaScript: Standard Library component | 9.8 | 0.0063 | | | [CVE-2025-14324](https://patchblox.com/security/data/cve/CVE-2025-14324.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0061 | | | [CVE-2026-8956](https://patchblox.com/security/data/cve/CVE-2026-8956.md) | High | Integer overflow in the Networking: JAR component | 9.8 | 0.0061 | | | [CVE-2026-2791](https://patchblox.com/security/data/cve/CVE-2026-2791.md) | High | Mitigation bypass in the Networking: Cache component | 9.8 | 0.0060 | | | [CVE-2026-2757](https://patchblox.com/security/data/cve/CVE-2026-2757.md) | High | Incorrect boundary conditions in the WebRTC: Audio/Video component | 9.8 | 0.0059 | | | [CVE-2026-8949](https://patchblox.com/security/data/cve/CVE-2026-8949.md) | High | Integer overflow in the Widget: Win32 component | 7.5 | 0.0058 | | | [CVE-2026-2785](https://patchblox.com/security/data/cve/CVE-2026-2785.md) | High | Invalid pointer in the JavaScript Engine component | 9.8 | 0.0058 | | | [CVE-2026-2758](https://patchblox.com/security/data/cve/CVE-2026-2758.md) | High | Use-after-free in the JavaScript: GC component | 9.8 | 0.0057 | | | [CVE-2026-4726](https://patchblox.com/security/data/cve/CVE-2026-4726.md) | High | Denial-of-service in the XML component | 7.5 | 0.0056 | | | [CVE-2026-4727](https://patchblox.com/security/data/cve/CVE-2026-4727.md) | High | Denial-of-service in the Libraries component in NSS | 7.5 | 0.0056 | | | [CVE-2026-2776](https://patchblox.com/security/data/cve/CVE-2026-2776.md) | High | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software | 10.0 | 0.0056 | | | [CVE-2026-2778](https://patchblox.com/security/data/cve/CVE-2026-2778.md) | High | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component | 10.0 | 0.0056 | | | [CVE-2026-0880](https://patchblox.com/security/data/cve/CVE-2026-0880.md) | High | Sandbox escape due to integer overflow in the Graphics component | 8.8 | 0.0054 | | | [CVE-2025-14330](https://patchblox.com/security/data/cve/CVE-2025-14330.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0054 | | | [CVE-2025-9185](https://patchblox.com/security/data/cve/CVE-2025-9185.md) | High | Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0054 | | | [CVE-2026-2789](https://patchblox.com/security/data/cve/CVE-2026-2789.md) | High | Use-after-free in the Graphics: ImageLib component | 9.8 | 0.0053 | | | [CVE-2026-4692](https://patchblox.com/security/data/cve/CVE-2026-4692.md) | High | Sandbox escape in the Responsive Design Mode component | 10.0 | 0.0052 | | | [CVE-2026-16376](https://patchblox.com/security/data/cve/CVE-2026-16376.md) | High | Denial-of-service in the Graphics: WebGPU component | 7.5 | 0.0052 | | | [CVE-2026-16409](https://patchblox.com/security/data/cve/CVE-2026-16409.md) | High | Invalid pointer in the Security: PSM component | 7.5 | 0.0052 | | | [CVE-2026-2786](https://patchblox.com/security/data/cve/CVE-2026-2786.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0051 | | | [CVE-2026-0879](https://patchblox.com/security/data/cve/CVE-2026-0879.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics component | 9.8 | 0.0050 | | | [CVE-2026-12292](https://patchblox.com/security/data/cve/CVE-2026-12292.md) | High | Incorrect boundary conditions in the Web Audio component | 8.1 | 0.0049 | | | [CVE-2026-4718](https://patchblox.com/security/data/cve/CVE-2026-4718.md) | High | Undefined behavior in the WebRTC: Signaling component | 8.2 | 0.0049 | | | [CVE-2026-2784](https://patchblox.com/security/data/cve/CVE-2026-2784.md) | High | Mitigation bypass in the DOM: Security component | 9.8 | 0.0049 | | | [CVE-2026-12328](https://patchblox.com/security/data/cve/CVE-2026-12328.md) | High | Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0048 | | | [CVE-2026-2760](https://patchblox.com/security/data/cve/CVE-2026-2760.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2761](https://patchblox.com/security/data/cve/CVE-2026-2761.md) | High | Sandbox escape in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2759](https://patchblox.com/security/data/cve/CVE-2026-2759.md) | High | Incorrect boundary conditions in the Graphics: ImageLib component | 9.8 | 0.0048 | | | [CVE-2026-0891](https://patchblox.com/security/data/cve/CVE-2026-0891.md) | High | Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 | 8.1 | 0.0048 | | | [CVE-2025-14333](https://patchblox.com/security/data/cve/CVE-2025-14333.md) | High | Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 | 8.1 | 0.0047 | | | [CVE-2026-0877](https://patchblox.com/security/data/cve/CVE-2026-0877.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0047 | | | [CVE-2026-8975](https://patchblox.com/security/data/cve/CVE-2026-8975.md) | High | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0047 | | | [CVE-2026-14899](https://patchblox.com/security/data/cve/CVE-2026-14899.md) | High | Off-by-one out of bounds read in MIME header parser for forwarding | 8.8 | 0.0047 | | | [CVE-2026-0878](https://patchblox.com/security/data/cve/CVE-2026-0878.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0047 | | | [CVE-2026-0882](https://patchblox.com/security/data/cve/CVE-2026-0882.md) | High | Use-after-free in the IPC component | 8.8 | 0.0047 | | | [CVE-2026-0884](https://patchblox.com/security/data/cve/CVE-2026-0884.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0046 | | | [CVE-2026-0889](https://patchblox.com/security/data/cve/CVE-2026-0889.md) | High | Denial-of-service in the DOM: Service Workers component | 7.5 | 0.0046 | | | [CVE-2026-2767](https://patchblox.com/security/data/cve/CVE-2026-2767.md) | High | Use-after-free in the JavaScript: WebAssembly component | 9.8 | 0.0046 | | | [CVE-2026-4720](https://patchblox.com/security/data/cve/CVE-2026-4720.md) | High | Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0045 | | | [CVE-2026-4721](https://patchblox.com/security/data/cve/CVE-2026-4721.md) | High | Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 | 9.8 | 0.0045 | | | [CVE-2025-8036](https://patchblox.com/security/data/cve/CVE-2025-8036.md) | High | DNS rebinding circumvents CORS | 8.1 | 0.0045 | | | [CVE-2025-14323](https://patchblox.com/security/data/cve/CVE-2025-14323.md) | High | Privilege escalation in the DOM: Notifications component | 8.8 | 0.0045 | | | [CVE-2026-2768](https://patchblox.com/security/data/cve/CVE-2026-2768.md) | High | Sandbox escape in the Storage: IndexedDB component | 10.0 | 0.0044 | | | [CVE-2026-2777](https://patchblox.com/security/data/cve/CVE-2026-2777.md) | High | Privilege escalation in the Messaging System component | 9.8 | 0.0044 | | | [CVE-2025-9182](https://patchblox.com/security/data/cve/CVE-2025-9182.md) | High | Denial-of-service due to out-of-memory in the Graphics: WebRender component | 7.5 | 0.0044 | | | [CVE-2026-4710](https://patchblox.com/security/data/cve/CVE-2026-4710.md) | High | Incorrect boundary conditions in the Audio/Video component | 9.8 | 0.0044 | | | [CVE-2026-2781](https://patchblox.com/security/data/cve/CVE-2026-2781.md) | High | Integer overflow in the Libraries component in NSS | 9.8 | 0.0043 | | | [CVE-2025-14328](https://patchblox.com/security/data/cve/CVE-2025-14328.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 | | | [CVE-2025-14329](https://patchblox.com/security/data/cve/CVE-2025-14329.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 | | | [CVE-2026-16384](https://patchblox.com/security/data/cve/CVE-2026-16384.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16385](https://patchblox.com/security/data/cve/CVE-2026-16385.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16386](https://patchblox.com/security/data/cve/CVE-2026-16386.md) | High | Information disclosure due to uninitialized memory in the Graphics: WebGPU component | 7.5 | 0.0043 | | | [CVE-2026-16400](https://patchblox.com/security/data/cve/CVE-2026-16400.md) | High | Information disclosure in the DOM: Security component | 7.5 | 0.0043 | | | [CVE-2025-11709](https://patchblox.com/security/data/cve/CVE-2025-11709.md) | High | Out of bounds read/write in a privileged process triggered by WebGL textures | 9.8 | 0.0042 | | | [CVE-2025-9184](https://patchblox.com/security/data/cve/CVE-2025-9184.md) | High | Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0042 | | | [CVE-2026-8959](https://patchblox.com/security/data/cve/CVE-2026-8959.md) | High | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component | 9.6 | 0.0042 | | | [CVE-2026-16378](https://patchblox.com/security/data/cve/CVE-2026-16378.md) | High | Other issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0042 | | | [CVE-2025-9181](https://patchblox.com/security/data/cve/CVE-2025-9181.md) | High | Uninitialized memory in the JavaScript Engine component | 7.5 | 0.0041 | | | [CVE-2026-8968](https://patchblox.com/security/data/cve/CVE-2026-8968.md) | High | Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component | 7.5 | 0.0041 | | | [CVE-2026-12327](https://patchblox.com/security/data/cve/CVE-2026-12327.md) | High | Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 | 8.1 | 0.0041 | | | [CVE-2026-16372](https://patchblox.com/security/data/cve/CVE-2026-16372.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0041 | | | [CVE-2025-14327](https://patchblox.com/security/data/cve/CVE-2025-14327.md) | High | Spoofing issue in the Downloads Panel component | 7.5 | 0.0041 | | | [CVE-2026-0885](https://patchblox.com/security/data/cve/CVE-2026-0885.md) | High | Use-after-free in the JavaScript: GC component | 7.5 | 0.0040 | | | [CVE-2026-16366](https://patchblox.com/security/data/cve/CVE-2026-16366.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0040 | | | [CVE-2026-16401](https://patchblox.com/security/data/cve/CVE-2026-16401.md) | High | Privilege escalation in the Data Loss Prevention component | 8.8 | 0.0040 | | | [CVE-2025-8035](https://patchblox.com/security/data/cve/CVE-2025-8035.md) | High | Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0040 | | | [CVE-2026-12290](https://patchblox.com/security/data/cve/CVE-2026-12290.md) | High | Memory safety bug fixed in Thunderbird 152 | 8.1 | 0.0040 | | | [CVE-2026-2780](https://patchblox.com/security/data/cve/CVE-2026-2780.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0040 | | | [CVE-2026-12289](https://patchblox.com/security/data/cve/CVE-2026-12289.md) | High | Privilege escalation in the Graphics: WebRender component | 8.8 | 0.0040 | | | [CVE-2026-12295](https://patchblox.com/security/data/cve/CVE-2026-12295.md) | High | Sandbox escape in the DOM: Navigation component | 9.6 | 0.0039 | | | [CVE-2026-12296](https://patchblox.com/security/data/cve/CVE-2026-12296.md) | High | Sandbox escape in the Security: Process Sandboxing component | 9.6 | 0.0039 | | | [CVE-2026-12297](https://patchblox.com/security/data/cve/CVE-2026-12297.md) | High | Sandbox escape due to incorrect boundary conditions in the Networking component | 9.6 | 0.0039 | | | [CVE-2026-8955](https://patchblox.com/security/data/cve/CVE-2026-8955.md) | High | Privilege escalation in the DOM: Workers component | 8.8 | 0.0039 | | | [CVE-2026-8957](https://patchblox.com/security/data/cve/CVE-2026-8957.md) | High | Privilege escalation in the Enterprise Policies component | 8.8 | 0.0039 | | | [CVE-2026-0886](https://patchblox.com/security/data/cve/CVE-2026-0886.md) | High | Incorrect boundary conditions in the Graphics component | 7.5 | 0.0038 | | | [CVE-2026-12291](https://patchblox.com/security/data/cve/CVE-2026-12291.md) | High | Use-after-free in the Networking: HTTP component | 8.8 | 0.0038 | | | [CVE-2026-2792](https://patchblox.com/security/data/cve/CVE-2026-2792.md) | High | Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2026-2793](https://patchblox.com/security/data/cve/CVE-2026-2793.md) | High | Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2025-8029](https://patchblox.com/security/data/cve/CVE-2025-8029.md) | High | javascript: URLs executed on object and embed tags | 8.1 | 0.0038 | | | [CVE-2025-8030](https://patchblox.com/security/data/cve/CVE-2025-8030.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0038 | | | [CVE-2026-8960](https://patchblox.com/security/data/cve/CVE-2026-8960.md) | High | Spoofing issue in WebExtensions | 7.5 | 0.0038 | | | [CVE-2026-7323](https://patchblox.com/security/data/cve/CVE-2026-7323.md) | High | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 | 8.8 | 0.0038 | | | [CVE-2026-4371](https://patchblox.com/security/data/cve/CVE-2026-4371.md) | High | Out of bounds read in IMAP parsing | 8.2 | 0.0038 | | | [CVE-2025-8032](https://patchblox.com/security/data/cve/CVE-2025-8032.md) | High | XSLT documents could bypass CSP | 8.1 | 0.0038 | | | [CVE-2026-12305](https://patchblox.com/security/data/cve/CVE-2026-12305.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0037 | | | [CVE-2026-8952](https://patchblox.com/security/data/cve/CVE-2026-8952.md) | High | Privilege escalation in the Application Update component | 8.8 | 0.0037 | | | [CVE-2026-8962](https://patchblox.com/security/data/cve/CVE-2026-8962.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0037 | | | [CVE-2025-8040](https://patchblox.com/security/data/cve/CVE-2025-8040.md) | High | Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0037 | | | [CVE-2026-8973](https://patchblox.com/security/data/cve/CVE-2026-8973.md) | High | Memory safety bugs fixed in Thunderbird 151 | 8.8 | 0.0037 | | | [CVE-2025-14325](https://patchblox.com/security/data/cve/CVE-2025-14325.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0037 | | | [CVE-2026-8974](https://patchblox.com/security/data/cve/CVE-2026-8974.md) | High | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 | 8.8 | 0.0037 | | | [CVE-2026-12294](https://patchblox.com/security/data/cve/CVE-2026-12294.md) | High | Sandbox escape in the DOM: Workers component | 9.6 | 0.0036 | | | [CVE-2026-12326](https://patchblox.com/security/data/cve/CVE-2026-12326.md) | High | Memory safety bugs fixed in Firefox 152 and Thunderbird 152 | 8.1 | 0.0036 | | | [CVE-2025-14322](https://patchblox.com/security/data/cve/CVE-2025-14322.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0036 | | | [CVE-2026-6784](https://patchblox.com/security/data/cve/CVE-2026-6784.md) | High | Memory safety bugs fixed in Firefox 150 and Thunderbird 150 | 7.5 | 0.0036 | | | [CVE-2025-10534](https://patchblox.com/security/data/cve/CVE-2025-10534.md) | High | Spoofing issue in the Site Permissions component | 8.1 | 0.0036 | | | [CVE-2026-0883](https://patchblox.com/security/data/cve/CVE-2026-0883.md) | High | Information disclosure in the Networking component | 7.5 | 0.0036 | | | [CVE-2026-8958](https://patchblox.com/security/data/cve/CVE-2026-8958.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 8.6 | 0.0034 | | | [CVE-2026-5734](https://patchblox.com/security/data/cve/CVE-2026-5734.md) | High | Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 | 9.8 | 0.0034 | | | [CVE-2026-2783](https://patchblox.com/security/data/cve/CVE-2026-2783.md) | High | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0034 | | | [CVE-2026-16354](https://patchblox.com/security/data/cve/CVE-2026-16354.md) | High | Information disclosure in the Graphics: ImageLib component | 8.8 | 0.0034 | | | [CVE-2025-8039](https://patchblox.com/security/data/cve/CVE-2025-8039.md) | High | Search terms persisted in URL bar | 8.1 | 0.0034 | | | [CVE-2026-2782](https://patchblox.com/security/data/cve/CVE-2026-2782.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0034 | | | [CVE-2025-10537](https://patchblox.com/security/data/cve/CVE-2025-10537.md) | High | Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 | 8.8 | 0.0034 | | | [CVE-2026-2801](https://patchblox.com/security/data/cve/CVE-2026-2801.md) | High | Incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5 | 0.0034 | | | [CVE-2025-14332](https://patchblox.com/security/data/cve/CVE-2025-14332.md) | High | Memory safety bugs fixed in Firefox 146 and Thunderbird 146 | 7.3 | 0.0033 | | | [CVE-2026-8966](https://patchblox.com/security/data/cve/CVE-2026-8966.md) | High | Information disclosure in the IP Protection component | 7.5 | 0.0033 | | | [CVE-2026-8967](https://patchblox.com/security/data/cve/CVE-2026-8967.md) | High | Information disclosure in the Graphics: WebGPU component | 7.5 | 0.0033 | | | [CVE-2026-8972](https://patchblox.com/security/data/cve/CVE-2026-8972.md) | High | Privilege escalation in the WebRTC: Audio/Video component | 8.8 | 0.0033 | | | [CVE-2025-11715](https://patchblox.com/security/data/cve/CVE-2025-11715.md) | High | Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0033 | | | [CVE-2026-0887](https://patchblox.com/security/data/cve/CVE-2026-0887.md) | High | Clickjacking issue, information disclosure in the PDF Viewer component | 7.5 | 0.0033 | | | [CVE-2026-6773](https://patchblox.com/security/data/cve/CVE-2026-6773.md) | High | Denial-of-service due to integer overflow in the Graphics: WebGPU component | 7.5 | 0.0032 | | | [CVE-2026-8965](https://patchblox.com/security/data/cve/CVE-2026-8965.md) | High | Information disclosure in the DOM: Security component | 7.5 | 0.0032 | | | [CVE-2026-7320](https://patchblox.com/security/data/cve/CVE-2026-7320.md) | High | Information disclosure due to incorrect boundary conditions in the Audio/Video component | 8.8 | 0.0032 | | | [CVE-2026-8093](https://patchblox.com/security/data/cve/CVE-2026-8093.md) | High | Memory safety bugs fixed in Thunderbird 150.0.2 | 8.1 | 0.0032 | | | [CVE-2026-16374](https://patchblox.com/security/data/cve/CVE-2026-16374.md) | High | Information disclosure in the Framework component in DevTools | 8.8 | 0.0032 | | | [CVE-2026-16391](https://patchblox.com/security/data/cve/CVE-2026-16391.md) | High | Information disclosure in the Storage: IndexedDB component | 8.8 | 0.0032 | | | [CVE-2026-8961](https://patchblox.com/security/data/cve/CVE-2026-8961.md) | High | Spoofing issue in the Form Autofill component | 7.5 | 0.0032 | | | [CVE-2025-10529](https://patchblox.com/security/data/cve/CVE-2025-10529.md) | High | Same-origin policy bypass in the Layout component | 7.5 | 0.0032 | | | [CVE-2026-8090](https://patchblox.com/security/data/cve/CVE-2026-8090.md) | High | Use-after-free in the DOM: Networking component | 7.5 | 0.0032 | | | [CVE-2026-7322](https://patchblox.com/security/data/cve/CVE-2026-7322.md) | High | Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 | 8.8 | 0.0032 | | | [CVE-2026-8970](https://patchblox.com/security/data/cve/CVE-2026-8970.md) | High | Privilege escalation in the Security component | 8.8 | 0.0031 | | | [CVE-2026-12298](https://patchblox.com/security/data/cve/CVE-2026-12298.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0031 | | | [CVE-2026-12299](https://patchblox.com/security/data/cve/CVE-2026-12299.md) | High | JIT miscompilation in the DOM: Core & HTML component | 7.5 | 0.0031 | | | [CVE-2026-8963](https://patchblox.com/security/data/cve/CVE-2026-8963.md) | High | Spoofing issue in the Web Speech component | 7.5 | 0.0030 | | | [CVE-2026-8964](https://patchblox.com/security/data/cve/CVE-2026-8964.md) | High | Spoofing issue in the Popup Blocker component | 7.5 | 0.0030 | | | [CVE-2026-0890](https://patchblox.com/security/data/cve/CVE-2026-0890.md) | High | Spoofing issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0030 | | | [CVE-2026-7324](https://patchblox.com/security/data/cve/CVE-2026-7324.md) | High | Memory safety bugs fixed in Thunderbird 150.0.1 | 7.3 | 0.0030 | | | [CVE-2026-2798](https://patchblox.com/security/data/cve/CVE-2026-2798.md) | High | Use-after-free in the DOM: Core & HTML component | 8.8 | 0.0030 | | | [CVE-2026-16371](https://patchblox.com/security/data/cve/CVE-2026-16371.md) | High | Privilege escalation in the DOM: Navigation component | 8.8 | 0.0030 | | | [CVE-2026-6780](https://patchblox.com/security/data/cve/CVE-2026-6780.md) | High | Denial-of-service in the Audio/Video: Playback component | 7.5 | 0.0029 | | | [CVE-2026-6781](https://patchblox.com/security/data/cve/CVE-2026-6781.md) | High | Denial-of-service in the Audio/Video: Playback component | 7.5 | 0.0029 | | | [CVE-2026-16362](https://patchblox.com/security/data/cve/CVE-2026-16362.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0029 | | | [CVE-2026-2803](https://patchblox.com/security/data/cve/CVE-2026-2803.md) | High | Information disclosure, mitigation bypass in the Settings UI component | 7.5 | 0.0029 | | | [CVE-2026-8969](https://patchblox.com/security/data/cve/CVE-2026-8969.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0029 | | | [CVE-2026-12317](https://patchblox.com/security/data/cve/CVE-2026-12317.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0029 | | | [CVE-2025-9180](https://patchblox.com/security/data/cve/CVE-2025-9180.md) | High | Same-origin policy bypass in the Graphics: Canvas2D component | 8.1 | 0.0028 | | | [CVE-2026-92021](https://patchblox.com/security/data/cve/CVE-2026-92021.md) | High | Use-after-free in the JavaScript Engine: JIT component | 8.8 | 0.0028 | | | [CVE-2026-16365](https://patchblox.com/security/data/cve/CVE-2026-16365.md) | High | Privilege escalation in the DOM: Workers component | 8.8 | 0.0028 | | | [CVE-2026-16379](https://patchblox.com/security/data/cve/CVE-2026-16379.md) | High | Privilege escalation in the DOM: Content Processes component | 8.8 | 0.0028 | | | [CVE-2025-8038](https://patchblox.com/security/data/cve/CVE-2025-8038.md) | High | CSP frame-src was not correctly enforced for paths | 9.8 | 0.0027 | | | [CVE-2025-8037](https://patchblox.com/security/data/cve/CVE-2025-8037.md) | High | Nameless cookies shadow secure cookies | 9.1 | 0.0027 | | | [CVE-2026-12318](https://patchblox.com/security/data/cve/CVE-2026-12318.md) | High | Incorrect boundary conditions in the Libraries component in NSS | 7.3 | 0.0026 | | | [CVE-2026-12306](https://patchblox.com/security/data/cve/CVE-2026-12306.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12307](https://patchblox.com/security/data/cve/CVE-2026-12307.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-12308](https://patchblox.com/security/data/cve/CVE-2026-12308.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0026 | | | [CVE-2026-7321](https://patchblox.com/security/data/cve/CVE-2026-7321.md) | High | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component | 9.6 | 0.0026 | | | [CVE-2026-2790](https://patchblox.com/security/data/cve/CVE-2026-2790.md) | High | Same-origin policy bypass in the Networking: JAR component | 9.8 | 0.0025 | | | [CVE-2026-6782](https://patchblox.com/security/data/cve/CVE-2026-6782.md) | High | Information disclosure in the IP Protection component | 7.5 | 0.0025 | | | [CVE-2026-12310](https://patchblox.com/security/data/cve/CVE-2026-12310.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12312](https://patchblox.com/security/data/cve/CVE-2026-12312.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12314](https://patchblox.com/security/data/cve/CVE-2026-12314.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0025 | | | [CVE-2026-12315](https://patchblox.com/security/data/cve/CVE-2026-12315.md) | High | Mitigation bypass in the DOM: Security component | 9.1 | 0.0025 | | | [CVE-2026-12302](https://patchblox.com/security/data/cve/CVE-2026-12302.md) | High | Mitigation bypass in the DOM: Security component | 7.5 | 0.0025 | | | [CVE-2026-16396](https://patchblox.com/security/data/cve/CVE-2026-16396.md) | High | Privilege escalation in WebExtensions | 8.8 | 0.0024 | | | [CVE-2026-92014](https://patchblox.com/security/data/cve/CVE-2026-92014.md) | High | Privilege escalation due to incorrect boundary conditions in the Graphics component | 8.8 | 0.0024 | | | [CVE-2026-12309](https://patchblox.com/security/data/cve/CVE-2026-12309.md) | High | Memory safety bug fixed in Thunderbird 152 | 7.5 | 0.0024 | | | [CVE-2026-12325](https://patchblox.com/security/data/cve/CVE-2026-12325.md) | High | Denial-of-service in the Graphics: ImageLib component | 7.5 | 0.0023 | | | [CVE-2026-16398](https://patchblox.com/security/data/cve/CVE-2026-16398.md) | High | Site isolation issue in the Graphics component | 7.5 | 0.0022 | | | [CVE-2026-16399](https://patchblox.com/security/data/cve/CVE-2026-16399.md) | High | Site isolation issue in the DOM: Navigation component | 7.5 | 0.0022 | | | [CVE-2026-3889](https://patchblox.com/security/data/cve/CVE-2026-3889.md) | High | Spoofing issue in Thunderbird | 8.2 | 0.0021 | | | [CVE-2026-12324](https://patchblox.com/security/data/cve/CVE-2026-12324.md) | High | Incorrect boundary conditions in the Graphics: CanvasWebGL component | 7.5 | 0.0021 | | | [CVE-2025-14331](https://patchblox.com/security/data/cve/CVE-2025-14331.md) | High | Same-origin policy bypass in the Request Handling component | 7.5 | 0.0020 | | | [CVE-2026-8950](https://patchblox.com/security/data/cve/CVE-2026-8950.md) | High | Same-origin policy bypass in the Networking: HTTP component | 9.3 | 0.0019 | | | [CVE-2026-12304](https://patchblox.com/security/data/cve/CVE-2026-12304.md) | High | Same-origin policy bypass in the Networking: Cookies component | 9.1 | 0.0019 | | | [CVE-2026-12311](https://patchblox.com/security/data/cve/CVE-2026-12311.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0019 | | | [CVE-2026-12313](https://patchblox.com/security/data/cve/CVE-2026-12313.md) | High | Information disclosure, sandbox escape in the Security: Process Sandboxing component | 7.5 | 0.0018 | | | [CVE-2026-2804](https://patchblox.com/security/data/cve/CVE-2026-2804.md) | Routine | Use-after-free in the JavaScript: WebAssembly component | 5.4 | 0.0047 | | | [CVE-2026-16403](https://patchblox.com/security/data/cve/CVE-2026-16403.md) | Routine | Spoofing issue in the Address Bar component | 6.5 | 0.0035 | | | [CVE-2026-0888](https://patchblox.com/security/data/cve/CVE-2026-0888.md) | Routine | Information disclosure in the XML component | 5.3 | 0.0035 | | | [CVE-2026-57962](https://patchblox.com/security/data/cve/CVE-2026-57962.md) | Routine | Denial-of-service via malicious LDAP address-book server | 5.3 | 0.0034 | | | [CVE-2026-57963](https://patchblox.com/security/data/cve/CVE-2026-57963.md) | Routine | Chat UI manipulation by injection | 6.5 | 0.0031 | | | [CVE-2025-10530](https://patchblox.com/security/data/cve/CVE-2025-10530.md) | Routine | Spoofing issue in the WebAuthn component in Firefox for Android | 6.5 | 0.0030 | | | [CVE-2025-10531](https://patchblox.com/security/data/cve/CVE-2025-10531.md) | Routine | Mitigation bypass in the Web Compatibility: Tooling component | 5.4 | 0.0028 | | | [CVE-2026-6778](https://patchblox.com/security/data/cve/CVE-2026-6778.md) | Routine | Invalid pointer in the Audio/Video: Playback component | 5.3 | 0.0026 | | | [CVE-2026-6755](https://patchblox.com/security/data/cve/CVE-2026-6755.md) | Routine | Mitigation bypass in the DOM: postMessage component | 6.5 | 0.0025 | | | [CVE-2026-12300](https://patchblox.com/security/data/cve/CVE-2026-12300.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-12301](https://patchblox.com/security/data/cve/CVE-2026-12301.md) | Routine | Memory safety bug fixed in Thunderbird 152 | 5.3 | 0.0025 | | | [CVE-2026-4728](https://patchblox.com/security/data/cve/CVE-2026-4728.md) | Routine | Spoofing issue in the Privacy: Anti-Tracking component | 6.5 | 0.0025 | | | [CVE-2026-6783](https://patchblox.com/security/data/cve/CVE-2026-6783.md) | Routine | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component | 5.3 | 0.0023 | | | [CVE-2026-12303](https://patchblox.com/security/data/cve/CVE-2026-12303.md) | Routine | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component | 4.3 | 0.0022 | | | [CVE-2026-12319](https://patchblox.com/security/data/cve/CVE-2026-12319.md) | Routine | Denial-of-service in the Audio/Video: Playback component | 6.5 | 0.0021 | | | [CVE-2026-6775](https://patchblox.com/security/data/cve/CVE-2026-6775.md) | Routine | Incorrect boundary conditions in the WebRTC component | 5.3 | 0.0021 | | | [CVE-2026-6779](https://patchblox.com/security/data/cve/CVE-2026-6779.md) | Routine | Other issue in the JavaScript Engine component | 5.3 | 0.0021 | | | [CVE-2026-12322](https://patchblox.com/security/data/cve/CVE-2026-12322.md) | Routine | Clickjacking issue in the Widget: Gtk component | 5.4 | 0.0021 | | | [CVE-2026-8971](https://patchblox.com/security/data/cve/CVE-2026-8971.md) | Routine | Same-origin policy bypass in the Networking: JAR component | 6.5 | 0.0021 | | | [CVE-2026-12320](https://patchblox.com/security/data/cve/CVE-2026-12320.md) | Routine | Information disclosure in the Password Manager component | 4.3 | 0.0018 | | | [CVE-2026-0818](https://patchblox.com/security/data/cve/CVE-2026-0818.md) | Routine | CSS-based exfiltration of the content from partially encrypted emails when allowing remote content | 4.3 | 0.0018 | | | [CVE-2026-12323](https://patchblox.com/security/data/cve/CVE-2026-12323.md) | Routine | Spoofing issue in the DOM: Core & HTML component | 5.4 | 0.0017 | | | [CVE-2026-2802](https://patchblox.com/security/data/cve/CVE-2026-2802.md) | Routine | Race condition in the JavaScript: GC component | 4.2 | 0.0016 | | | [CVE-2026-6777](https://patchblox.com/security/data/cve/CVE-2026-6777.md) | Routine | Other issue in the Networking: DNS component | 5.3 | 0.0016 | | | [CVE-2026-12321](https://patchblox.com/security/data/cve/CVE-2026-12321.md) | Routine | JIT miscompilation in the JavaScript: WebAssembly component | 5.4 | 0.0016 | | | [CVE-2026-6774](https://patchblox.com/security/data/cve/CVE-2026-6774.md) | Routine | Mitigation bypass in the DOM: Security component | 5.4 | 0.0015 | | --- Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.