Technology · Mozilla
Mozilla Firefox ESR vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 642 vulnerabilities in Mozilla Firefox ESR: 78 in the last 7 days and 479 in the last 90 days, 93 of them critical and 12 exploited in the wild. The most recent, CVE-2026-124952, was published on 10 November 2026. 207 vulnerabilities in the last four weeks, up 64% on the four before (126). 3 critical against 20.
- Last 7 days
- 78
- Last 90 days
- 479
- Critical, all time
- 93
- Exploited in the wild
- 12
About Mozilla Firefox ESR
Firefox ESR is a version of the Firefox web browser designed for organizations and users who require extended support for mass deployments.
Latest Mozilla Firefox ESR vulnerabilities
- CVE-2026-124952: Firefox ESR use-after-free in Audio/Video componentinfo
- CVE-2026-124951: Firefox privilege escalation in Nimbus Desktop Clientinfo
- CVE-2026-124948: Mozilla Firefox use-after-free in Graphics componentinfo
- CVE-2026-124942: Firefox invalid pointer in DOM: Streams componentinfo
- CVE-2026-124941: Mozilla Firefox information disclosure in Security: RLBoxinfo
- CVE-2026-124940: Mozilla Firefox mitigation bypass in File Handlinginfo
- CVE-2026-124939: Mozilla Firefox JIT miscompilation in JavaScript Engineinfo
- CVE-2026-124938: Firefox mitigation bypass in Add-ons Managerinfo
- CVE-2026-124935: Mozilla Firefox undefined behavior in WebRTC Networkinginfo
- CVE-2026-124934: Mozilla Firefox spoofing issue in Security componentinfo
- CVE-2026-124933: Firefox sandbox escape in Console componentinfo
- CVE-2026-124932: Firefox use-after-free in Graphics componentinfo
- CVE-2026-124931: Firefox same-origin policy bypass in DOM: Core & HTMLinfo
- CVE-2026-124930: Mozilla Firefox information disclosure in Address Barinfo
- CVE-2026-124929: Mozilla Firefox information disclosure in Layout Form Controlsinfo
- CVE-2026-124927: Mozilla Firefox site isolation issue in Graphics WebRenderinfo
- CVE-2026-124926: Firefox WebRTC incorrect boundary conditionsinfo
- CVE-2026-124924: Firefox Graphics: WebRender incorrect boundary conditionsinfo
- CVE-2026-124922: Firefox use-after-free in CSS Transitions and Animationsinfo
- CVE-2026-124919: Mozilla Firefox privilege escalation in WebRTC Networkinginfo
- CVE-2026-124918: Firefox privilege escalation in Graphics: WebRenderinfo
- CVE-2026-124917: Mozilla Firefox use-after-free in Widget: Gtk sandbox escapeinfo
- CVE-2026-124915: Firefox incorrect boundary conditions in Graphics: WebGPUinfo
- CVE-2026-124914: Firefox site isolation issue in DOM Navigation componentinfo
- CVE-2026-124913: Firefox site isolation issue in Networking componentinfo
Most severe Mozilla Firefox ESR vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.6
- CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.1
- CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.1
Vulnerabilities per week
207 vulnerabilities in the last four weeks, up 64% on the four before (126). 3 critical against 20. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 49 | 12 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 19 | 7 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 64 | 12 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 62 | 8 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 61 | 3 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 145 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 78 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mozilla Firefox ESR vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/firefox-esr)<a href="https://junglewise.ai/threats/technologies/firefox-esr"><img src="https://junglewise.ai/threats/technologies/firefox-esr/badge.svg" alt="Mozilla Firefox ESR vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/firefox-esr.json, and this page as text at https://junglewise.ai/threats/technologies/firefox-esr.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mozilla Firefox ESR vulnerabilities", https://junglewise.ai/threats/technologies/firefox-esr, 13 November 2026.