# Mozilla Firefox ESR vulnerabilities Source: https://junglewise.ai/threats/technologies/firefox-esr Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/firefox-esr.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 642 vulnerabilities in Mozilla Firefox ESR: 78 in the last 7 days and 479 in the last 90 days, 93 of them critical and 12 exploited in the wild. The most recent, CVE-2026-124952, was published on 10 November 2026. 207 vulnerabilities in the last four weeks, up 64% on the four before (126). 3 critical against 20. ## Counts - Last 7 days: 78 - Last 30 days: 224 - Last 90 days: 479 - All time: 642 (93 critical, 12 exploited in the wild) ## About Mozilla Firefox ESR Firefox ESR is a version of the Firefox web browser designed for organizations and users who require extended support for mass deployments. ## Latest Mozilla Firefox ESR vulnerabilities - [CVE-2026-124952: Firefox ESR use-after-free in Audio/Video component](https://junglewise.ai/threats/cve-2026-124952-use-after-free-in-the-audio-video-component-this-vulnerability) (info, published 10 Nov 2026) - [CVE-2026-124951: Firefox privilege escalation in Nimbus Desktop Client](https://junglewise.ai/threats/cve-2026-124951-privilege-escalation-in-the-nimbus-desktop-client-component-this) (info, published 10 Nov 2026) - [CVE-2026-124948: Mozilla Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-124948-incorrect-boundary-conditions-use-after-free-in-the-graphics) (info, published 10 Nov 2026) - [CVE-2026-124942: Firefox invalid pointer in DOM: Streams component](https://junglewise.ai/threats/cve-2026-124942-invalid-pointer-in-the-dom-streams-component-this-vulnerability) (info, published 10 Nov 2026) - [CVE-2026-124941: Mozilla Firefox information disclosure in Security: RLBox](https://junglewise.ai/threats/cve-2026-124941-information-disclosure-in-the-security-rlbox-component-this) (info, published 10 Nov 2026) - [CVE-2026-124940: Mozilla Firefox mitigation bypass in File Handling](https://junglewise.ai/threats/cve-2026-124940-mitigation-bypass-in-the-file-handling-component-this) (info, published 10 Nov 2026) - [CVE-2026-124939: Mozilla Firefox JIT miscompilation in JavaScript Engine](https://junglewise.ai/threats/cve-2026-124939-jit-miscompilation-in-the-javascript-engine-jit-component-this) (info, published 10 Nov 2026) - [CVE-2026-124938: Firefox mitigation bypass in Add-ons Manager](https://junglewise.ai/threats/cve-2026-124938-mitigation-bypass-in-the-add-ons-manager-component-this) (info, published 10 Nov 2026) - [CVE-2026-124935: Mozilla Firefox undefined behavior in WebRTC Networking](https://junglewise.ai/threats/cve-2026-124935-undefined-behavior-in-the-webrtc-networking-component-this) (info, published 10 Nov 2026) - [CVE-2026-124934: Mozilla Firefox spoofing issue in Security component](https://junglewise.ai/threats/cve-2026-124934-spoofing-issue-in-the-security-component-this-vulnerability-was) (info, published 10 Nov 2026) - [CVE-2026-124933: Firefox sandbox escape in Console component](https://junglewise.ai/threats/cve-2026-124933-sandbox-escape-in-the-console-component-this-vulnerability-was) (info, published 10 Nov 2026) - [CVE-2026-124932: Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-124932-use-after-free-in-the-graphics-component-this-vulnerability-was) (info, published 10 Nov 2026) - [CVE-2026-124931: Firefox same-origin policy bypass in DOM: Core & HTML](https://junglewise.ai/threats/cve-2026-124931-same-origin-policy-bypass-in-the-dom-core-html-component-this) (info, published 10 Nov 2026) - [CVE-2026-124930: Mozilla Firefox information disclosure in Address Bar](https://junglewise.ai/threats/cve-2026-124930-information-disclosure-in-the-address-bar-component-this) (info, published 10 Nov 2026) - [CVE-2026-124929: Mozilla Firefox information disclosure in Layout Form Controls](https://junglewise.ai/threats/cve-2026-124929-information-disclosure-in-the-layout-form-controls-component) (info, published 10 Nov 2026) - [CVE-2026-124927: Mozilla Firefox site isolation issue in Graphics WebRender](https://junglewise.ai/threats/cve-2026-124927-site-isolation-issue-in-the-graphics-webrender-component-this) (info, published 10 Nov 2026) - [CVE-2026-124926: Firefox WebRTC incorrect boundary conditions](https://junglewise.ai/threats/cve-2026-124926-incorrect-boundary-conditions-in-the-webrtc-component-this) (info, published 10 Nov 2026) - [CVE-2026-124924: Firefox Graphics: WebRender incorrect boundary conditions](https://junglewise.ai/threats/cve-2026-124924-incorrect-boundary-conditions-in-the-graphics-webrender) (info, published 10 Nov 2026) - [CVE-2026-124922: Firefox use-after-free in CSS Transitions and Animations](https://junglewise.ai/threats/cve-2026-124922-use-after-free-in-the-css-transitions-and-animations-component) (info, published 10 Nov 2026) - [CVE-2026-124919: Mozilla Firefox privilege escalation in WebRTC Networking](https://junglewise.ai/threats/cve-2026-124919-privilege-escalation-due-to-use-after-free-in-the-webrtc) (info, published 10 Nov 2026) - [CVE-2026-124918: Firefox privilege escalation in Graphics: WebRender](https://junglewise.ai/threats/cve-2026-124918-privilege-escalation-due-to-incorrect-boundary-conditions-in-the) (info, published 10 Nov 2026) - [CVE-2026-124917: Mozilla Firefox use-after-free in Widget: Gtk sandbox escape](https://junglewise.ai/threats/cve-2026-124917-sandbox-escape-due-to-use-after-free-in-the-widget-gtk-component) (info, published 10 Nov 2026) - [CVE-2026-124915: Firefox incorrect boundary conditions in Graphics: WebGPU](https://junglewise.ai/threats/cve-2026-124915-incorrect-boundary-conditions-in-the-graphics-webgpu-component) (info, published 10 Nov 2026) - [CVE-2026-124914: Firefox site isolation issue in DOM Navigation component](https://junglewise.ai/threats/cve-2026-124914-site-isolation-issue-in-the-dom-navigation-component-this) (info, published 10 Nov 2026) - [CVE-2026-124913: Firefox site isolation issue in Networking component](https://junglewise.ai/threats/cve-2026-124913-site-isolation-issue-in-the-networking-component-this) (info, published 10 Nov 2026) ## Most severe Mozilla Firefox ESR vulnerabilities - [CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability](https://junglewise.ai/threats/cve-2019-11708-mozilla-firefox-and-thunderbird-sandbox-escape-vulnerability) (critical, exploited in the wild, CVSS 10, published 23 May 2022) - [CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2024-9680-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Oct 2024) - [CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26486-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.6, published 7 Mar 2022) - [CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2015-4495-mozilla-firefox-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 25 May 2022) - [CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-11707-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 23 May 2022) - [CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability](https://junglewise.ai/threats/cve-2013-1690-mozilla-firefox-and-thunderbird-denial-of-service-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Mar 2022) - [CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26485-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 7 Mar 2022) - [CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-17026-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Nov 2021) - [CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2020-6819-mozilla-firefox-and-thunderbird-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 3 Nov 2021) - [CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2020-6820-mozilla-firefox-and-thunderbird-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 3 Nov 2021) ## Vulnerabilities per week 207 vulnerabilities in the last four weeks, up 64% on the four before (126). 3 critical against 20. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 49 | 12 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 19 | 7 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 64 | 12 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 62 | 8 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 61 | 3 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 145 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 78 | 0 | 0 | ## Other Mozilla technologies - [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox): 869 vulnerabilities - [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird): 396 vulnerabilities - [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr): 86 vulnerabilities - [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios): 17 vulnerabilities - [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android): 11 vulnerabilities - [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile): 7 vulnerabilities - [Mozilla Firefox Focus](https://junglewise.ai/threats/technologies/firefox-focus-for-android): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mozilla Firefox ESR vulnerabilities", https://junglewise.ai/threats/technologies/firefox-esr, 13 November 2026.