Vendor
Mozilla vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 952 vulnerabilities in Mozilla: 108 in the last 7 days and 627 in the last 90 days, 135 of them critical and 13 exploited in the wild. The most recent, CVE-2026-126136, was published on 10 November 2026. 269 vulnerabilities in the last four weeks, up 70% on the four before (158). 4 critical against 30. 8 technologies have a page of their own.
- Last 7 days
- 108
- Last 90 days
- 627
- Critical, all time
- 135
- Exploited in the wild
- 13
About Mozilla
A non-profit organization and its subsidiary that develop the Firefox web browser and other open-source internet technologies.
Mozilla technologies
Latest Mozilla vulnerabilities
- CVE-2026-126136: Thunderbird OAuth2 access token leak over HTTP with Exchange accountsinfo
- CVE-2026-126135: Mozilla Thunderbird SMTP/POP3 response injection via STARTTLSinfo
- CVE-2026-126134: Thunderbird NTLM credential leak via feed subscription to file URLinfo
- CVE-2026-126133: Thunderbird calendar server credentials sent to HTTP proxyinfo
- CVE-2026-126132: Thunderbird attachment replacement disclosure via link filesinfo
- CVE-2026-124952: Firefox ESR use-after-free in Audio/Video componentinfo
- CVE-2026-124951: Firefox privilege escalation in Nimbus Desktop Clientinfo
- CVE-2026-124950: Firefox same-origin policy bypass in CSS Parsing and Computationinfo
- CVE-2026-124949: Firefox other issue in SVG componentinfo
- CVE-2026-124948: Mozilla Firefox use-after-free in Graphics componentinfo
- CVE-2026-124947: Firefox incorrect boundary conditions in Graphics componentinfo
- CVE-2026-124946: Firefox invalid pointer in JavaScript Engine JIT componentinfo
- CVE-2026-124945: Firefox invalid pointer in Layout: Text and Fontsinfo
- CVE-2026-124944: Firefox Marionette information disclosureinfo
- CVE-2026-124943: Firefox use-after-free in Layout componentinfo
- CVE-2026-124942: Firefox invalid pointer in DOM: Streams componentinfo
- CVE-2026-124941: Mozilla Firefox information disclosure in Security: RLBoxinfo
- CVE-2026-124940: Mozilla Firefox mitigation bypass in File Handlinginfo
- CVE-2026-124939: Mozilla Firefox JIT miscompilation in JavaScript Engineinfo
- CVE-2026-124938: Firefox mitigation bypass in Add-ons Managerinfo
- CVE-2026-124937: Firefox for Android Media component unspecified issueinfo
- CVE-2026-124936: Firefox address bar domain highlighting spoofinginfo
- CVE-2026-124935: Mozilla Firefox undefined behavior in WebRTC Networkinginfo
- CVE-2026-124934: Mozilla Firefox spoofing issue in Security componentinfo
- CVE-2026-124933: Firefox sandbox escape in Console componentinfo
Most severe Mozilla vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructorcriticalexploited in the wildCVSS 9.8EPSS 86.6%
- CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.6
- CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.1
Vulnerabilities per week
269 vulnerabilities in the last four weeks, up 70% on the four before (158). 4 critical against 30. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 55 | 15 | |
| 24 Aug 2026 | 1 | 0 | |
| 31 Aug 2026 | 34 | 11 | |
| 7 Sep 2026 | 2 | 0 | |
| 14 Sep 2026 | 77 | 21 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 79 | 9 | |
| 5 Oct 2026 | 2 | 0 | |
| 12 Oct 2026 | 83 | 4 | |
| 19 Oct 2026 | 9 | 0 | |
| 26 Oct 2026 | 176 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 108 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mozilla vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/mozilla)<a href="https://junglewise.ai/threats/vendors/mozilla"><img src="https://junglewise.ai/threats/vendors/mozilla/badge.svg" alt="Mozilla vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/mozilla.json, and this page as text at https://junglewise.ai/threats/vendors/mozilla.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mozilla vulnerabilities", https://junglewise.ai/threats/vendors/mozilla, 13 November 2026.