Technology · Mozilla
Mozilla Firefox vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 869 vulnerabilities in Mozilla Firefox: 98 in the last 7 days and 570 in the last 90 days, 128 of them critical and 13 exploited in the wild. The most recent, CVE-2026-124951, was published on 10 November 2026. 247 vulnerabilities in the last four weeks, up 67% on the four before (148). 4 critical against 28.
- Last 7 days
- 98
- Last 90 days
- 570
- Critical, all time
- 128
- Exploited in the wild
- 13
About Mozilla Firefox
Firefox is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation.
Latest Mozilla Firefox vulnerabilities
- CVE-2026-124951: Firefox privilege escalation in Nimbus Desktop Clientinfo
- CVE-2026-124950: Firefox same-origin policy bypass in CSS Parsing and Computationinfo
- CVE-2026-124949: Firefox other issue in SVG componentinfo
- CVE-2026-124948: Mozilla Firefox use-after-free in Graphics componentinfo
- CVE-2026-124947: Firefox incorrect boundary conditions in Graphics componentinfo
- CVE-2026-124946: Firefox invalid pointer in JavaScript Engine JIT componentinfo
- CVE-2026-124945: Firefox invalid pointer in Layout: Text and Fontsinfo
- CVE-2026-124944: Firefox Marionette information disclosureinfo
- CVE-2026-124943: Firefox use-after-free in Layout componentinfo
- CVE-2026-124942: Firefox invalid pointer in DOM: Streams componentinfo
- CVE-2026-124941: Mozilla Firefox information disclosure in Security: RLBoxinfo
- CVE-2026-124940: Mozilla Firefox mitigation bypass in File Handlinginfo
- CVE-2026-124939: Mozilla Firefox JIT miscompilation in JavaScript Engineinfo
- CVE-2026-124938: Firefox mitigation bypass in Add-ons Managerinfo
- CVE-2026-124936: Firefox address bar domain highlighting spoofinginfo
- CVE-2026-124935: Mozilla Firefox undefined behavior in WebRTC Networkinginfo
- CVE-2026-124934: Mozilla Firefox spoofing issue in Security componentinfo
- CVE-2026-124933: Firefox sandbox escape in Console componentinfo
- CVE-2026-124932: Firefox use-after-free in Graphics componentinfo
- CVE-2026-124931: Firefox same-origin policy bypass in DOM: Core & HTMLinfo
- CVE-2026-124930: Mozilla Firefox information disclosure in Address Barinfo
- CVE-2026-124929: Mozilla Firefox information disclosure in Layout Form Controlsinfo
- CVE-2026-124928: Firefox SVG component mitigation bypassinfo
- CVE-2026-124927: Mozilla Firefox site isolation issue in Graphics WebRenderinfo
- CVE-2026-124926: Firefox WebRTC incorrect boundary conditionsinfo
Most severe Mozilla Firefox vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructorcriticalexploited in the wildCVSS 9.8EPSS 86.6%
- CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.6
- CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.1
Vulnerabilities per week
247 vulnerabilities in the last four weeks, up 67% on the four before (148). 4 critical against 28. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 52 | 14 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 24 | 8 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 72 | 19 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 75 | 9 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 77 | 4 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 165 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 98 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mozilla Firefox vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/firefox)<a href="https://junglewise.ai/threats/technologies/firefox"><img src="https://junglewise.ai/threats/technologies/firefox/badge.svg" alt="Mozilla Firefox vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/firefox.json, and this page as text at https://junglewise.ai/threats/technologies/firefox.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mozilla Firefox vulnerabilities", https://junglewise.ai/threats/technologies/firefox, 13 November 2026.