Overview 1,355 matches · 0 in Waratek scope · 0 protected · 7 exploited · 1 CISA KEV · 60 public PoC · 8 EPSS ≥ 0.5
1,355matches
0in Waratek scope0.0%
0protected0.0%
7exploited0.5%
1CISA KEV0.1%
60public PoC4.4%
8EPSS ≥ 0.50.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
3
0.2%
Not applicable
1,352
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,355
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 107 / year
20031
Not applicable1
Medium1
not blocked1
No public exploit1
200410
Not applicable10
Medium10
not blocked10
Working exploit published3
No public exploit7
200532
Not applicable32
Medium32
not blocked32
Working exploit published8
No public exploit24
200648
Not applicable48
Medium48
not blocked48
Working exploit published7
No public exploit41
200751
Not applicable51
Medium51
not blocked51
Working exploit published5
Forecast only1
No public exploit45
200851
Not applicable51
Medium51
not blocked51
Working exploit published6
No public exploit45
200955
Outside Waratek scope1
Not applicable54
Medium55
not blocked55
Exploited1
Working exploit published16
No public exploit38
201044
Not applicable44
Medium44
not blocked44
Working exploit published3
No public exploit41
201135
Not applicable35
Medium35
not blocked35
Proof of concept only1
No public exploit34
201260
Not applicable60
Medium60
not blocked60
No public exploit60
201352
Outside Waratek scope1
Not applicable51
Medium52
not blocked52
Exploited2
Working exploit published1
Forecast only1
No public exploit48
201447
Outside Waratek scope1
Not applicable46
Medium47
not blocked47
Working exploit published2
No public exploit45
201591
Not applicable91
Medium91
not blocked91
Working exploit published2
Proof of concept only1
No public exploit88
201650
Not applicable50
Medium50
not blocked50
No public exploit50
20170
2018105
Not applicable105
Medium105
not blocked105
Working exploit published2
No public exploit103
201950
Not applicable50
Medium50
not blocked50
Exploited1
Working exploit published1
No public exploit48
202073
Not applicable73
Medium73
not blocked73
Exploited1
No public exploit72
202171
Not applicable71
Medium71
not blocked71
Proof of concept only1
No public exploit70
202276
Not applicable76
Medium76
not blocked76
Exploited2
Proof of concept only27
No public exploit47
202393
Not applicable93
Medium93
not blocked93
Proof of concept only18
No public exploit75
202482
Not applicable82
Medium82
not blocked82
No public exploit82
202571
Not applicable71
Medium71
not blocked71
Proof of concept only1
No public exploit70
2026107
Not applicable107
Medium107
not blocked107
No public exploit107
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-96869 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. |
| CVE-2026-100826 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100823 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157. |
| CVE-2026-100822 | Medium | 2026-09-29 | Not applicable | No public exploit | Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100821 | Medium | 2026-09-29 | Not applicable | No public exploit | Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100817 | Medium | 2026-09-29 | Not applicable | No public exploit | Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100812 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100806 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| CVE-2026-100802 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100799 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100795 | Medium | 2026-09-29 | Not applicable | No public exploit | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100793 | Medium | 2026-09-29 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
| CVE-2026-100783 | Medium | 2026-09-29 | Not applicable | No public exploit | Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-100766 | Medium | 2026-09-29 | Not applicable | No public exploit | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. |
| CVE-2026-92078 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92077 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92070 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92069 | Medium | 2026-09-15 | Not applicable | No public exploit | Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92068 | Medium | 2026-09-15 | Not applicable | No public exploit | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92063 | Medium | 2026-09-15 | Not applicable | No public exploit | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. |
| CVE-2026-92039 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. |
| CVE-2026-92031 | Medium | 2026-09-15 | Not applicable | No public exploit | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92030 | Medium | 2026-09-15 | Not applicable | No public exploit | Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-92005 | Medium | 2026-09-15 | Not applicable | No public exploit | Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. |
| CVE-2026-86853 | Medium | 2026-09-08 | Not applicable | No public exploit | A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1. |
| CVE-2026-84127 | Medium | 2026-09-01 | Not applicable | No public exploit | Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155. |
| CVE-2026-84126 | Medium | 2026-09-01 | Not applicable | No public exploit | Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. |
| CVE-2026-84125 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-84124 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84122 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84120 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. |
| CVE-2026-84118 | Medium | 2026-09-01 | Not applicable | No public exploit | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. |
| CVE-2026-81267 | Medium | 2026-08-31 | Not applicable | No public exploit | A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0. |
| CVE-2026-74984 | Medium | 2026-08-18 | Not applicable | No public exploit | Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74980 | Medium | 2026-08-18 | Not applicable | No public exploit | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. |
| CVE-2026-74976 | Medium | 2026-08-18 | Not applicable | No public exploit | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74975 | Medium | 2026-08-18 | Not applicable | No public exploit | Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. |
| CVE-2026-74974 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74973 | Medium | 2026-08-18 | Not applicable | No public exploit | Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74972 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74971 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74970 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74968 | Medium | 2026-08-18 | Not applicable | No public exploit | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
| CVE-2026-74967 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74963 | Medium | 2026-08-18 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74951 | Medium | 2026-08-18 | Not applicable | No public exploit | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. |
| CVE-2026-74948 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-74945 | Medium | 2026-08-18 | Not applicable | No public exploit | Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. |
| CVE-2026-16403 | Medium | 2026-07-21 | Not applicable | No public exploit | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
| CVE-2026-16397 | Medium | 2026-07-21 | Not applicable | No public exploit | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. |
| CVE-2026-15719 | Medium | 2026-07-14 | Not applicable | No public exploit | We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13. |
| CVE-2026-15718 | Medium | 2026-07-14 | Not applicable | No public exploit | We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. |
| CVE-2026-14906 | Medium | 2026-07-13 | Not applicable | No public exploit | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4. |
| CVE-2026-13356 | Medium | 2026-07-07 | Not applicable | No public exploit | A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 152.3. |
| CVE-2026-53900 | Medium | 2026-06-16 | Not applicable | No public exploit | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject arbitrary cookies into requests to an unrelated target domain. This vulnerability was fixed in Firefox for iOS 152.0. |
| CVE-2026-53899 | Medium | 2026-06-16 | Not applicable | No public exploit | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0. |
| CVE-2026-12330 | Medium | 2026-06-16 | Not applicable | No public exploit | Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. |
| CVE-2026-12325 | Medium | 2026-06-16 | Not applicable | No public exploit | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12323 | Medium | 2026-06-16 | Not applicable | No public exploit | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12322 | Medium | 2026-06-16 | Not applicable | No public exploit | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12321 | Medium | 2026-06-16 | Not applicable | No public exploit | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12320 | Medium | 2026-06-16 | Not applicable | No public exploit | Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12319 | Medium | 2026-06-16 | Not applicable | No public exploit | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12313 | Medium | 2026-06-16 | Not applicable | No public exploit | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12311 | Medium | 2026-06-16 | Not applicable | No public exploit | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12309 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12308 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12307 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12306 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12303 | Medium | 2026-06-16 | Not applicable | No public exploit | Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12302 | Medium | 2026-06-16 | Not applicable | No public exploit | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. |
| CVE-2026-12301 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-12300 | Medium | 2026-06-16 | Not applicable | No public exploit | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152. |
| CVE-2026-9309 | Medium | 2026-06-01 | Not applicable | No public exploit | Firefox for iOS Reader View did not properly escape HTML tags in JSON-LD metadata. A malicious page could inject markup that changed Reader View behavior and leaked sensitive URL parameters. These parameters could then be used to access internal pages, potentially resulting in arbitrary JavaScript execution in an internal origin. This vulnerability was fixed in Firefox for iOS 151.2. |
| CVE-2026-9308 | Medium | 2026-06-01 | Not applicable | No public exploit | Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. This vulnerability was fixed in Firefox for iOS 151.2. |
| CVE-2026-9078 | Medium | 2026-05-25 | Not applicable | No public exploit | Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1. |
| CVE-2026-8971 | Medium | 2026-05-19 | Not applicable | No public exploit | Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. |
| CVE-2026-8961 | Medium | 2026-05-19 | Not applicable | No public exploit | Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. |
| CVE-2026-8951 | Medium | 2026-05-19 | Not applicable | No public exploit | Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151. |
| CVE-2026-8706 | Medium | 2026-05-19 | Not applicable | No public exploit | Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0. |
| CVE-2026-6783 | Medium | 2026-04-21 | Not applicable | No public exploit | Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6779 | Medium | 2026-04-21 | Not applicable | No public exploit | Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6778 | Medium | 2026-04-21 | Not applicable | No public exploit | Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6777 | Medium | 2026-04-21 | Not applicable | No public exploit | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6775 | Medium | 2026-04-21 | Not applicable | No public exploit | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6774 | Medium | 2026-04-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-6770 | Medium | 2026-04-21 | Not applicable | No public exploit | Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6767 | Medium | 2026-04-21 | Not applicable | No public exploit | Other issue in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6765 | Medium | 2026-04-21 | Not applicable | No public exploit | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6764 | Medium | 2026-04-21 | Not applicable | No public exploit | Incorrect boundary conditions in the DOM: Device Interfaces component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6763 | Medium | 2026-04-21 | Not applicable | No public exploit | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6762 | Medium | 2026-04-21 | Not applicable | No public exploit | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6757 | Medium | 2026-04-21 | Not applicable | No public exploit | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
| CVE-2026-6755 | Medium | 2026-04-21 | Not applicable | No public exploit | Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. |
| CVE-2026-4728 | Medium | 2026-03-24 | Not applicable | No public exploit | Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 149 and Thunderbird 149. |
| CVE-2026-3846 | Medium | 2026-03-10 | Not applicable | No public exploit | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2. |
| CVE-2026-2919 | Medium | 2026-03-09 | Not applicable | No public exploit | Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an invalid port and triggering an iframe redirect, causing the UI to display a trusted domain without user interaction. This vulnerability was fixed in Focus for iOS 148.2. |
| CVE-2026-2804 | Medium | 2026-02-24 | Not applicable | No public exploit | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
| CVE-2026-2802 | Medium | 2026-02-24 | Not applicable | No public exploit | Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. |
| CVE-2026-2032 | Medium | 2026-02-16 | Not applicable | No public exploit | Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1. |