# Mozilla vulnerabilities Source: https://junglewise.ai/threats/vendors/mozilla Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/mozilla.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 952 vulnerabilities in Mozilla: 108 in the last 7 days and 627 in the last 90 days, 135 of them critical and 13 exploited in the wild. The most recent, CVE-2026-126136, was published on 10 November 2026. 269 vulnerabilities in the last four weeks, up 70% on the four before (158). 4 critical against 30. 8 technologies have a page of their own. ## Counts - Last 7 days: 108 - Last 30 days: 294 - Last 90 days: 627 - All time: 952 (135 critical, 13 exploited in the wild) ## About Mozilla A non-profit organization and its subsidiary that develop the Firefox web browser and other open-source internet technologies. ## Latest Mozilla vulnerabilities - [CVE-2026-126136: Thunderbird OAuth2 access token leak over HTTP with Exchange accounts](https://junglewise.ai/threats/cve-2026-126136-for-exchange-accounts-using-ews-or-microsoft-graph-with-oauth2) (info, published 10 Nov 2026) - [CVE-2026-126135: Mozilla Thunderbird SMTP/POP3 response injection via STARTTLS](https://junglewise.ai/threats/cve-2026-126135-if-an-attacker-was-able-to-perform-a-man-in-the-middle-attack-on) (info, published 10 Nov 2026) - [CVE-2026-126134: Thunderbird NTLM credential leak via feed subscription to file URL](https://junglewise.ai/threats/cve-2026-126134-thunderbird-allowed-feed-subscriptions-to-file-urls-that-point) (info, published 10 Nov 2026) - [CVE-2026-126133: Thunderbird calendar server credentials sent to HTTP proxy](https://junglewise.ai/threats/cve-2026-126133-when-a-caldav-or-ics-calendar-was-accessed-through-an-http-proxy) (info, published 10 Nov 2026) - [CVE-2026-126132: Thunderbird attachment replacement disclosure via link files](https://junglewise.ai/threats/cve-2026-126132-when-a-message-was-forwarded-inline-edited-as-new-or-had-an) (info, published 10 Nov 2026) - [CVE-2026-124952: Firefox ESR use-after-free in Audio/Video component](https://junglewise.ai/threats/cve-2026-124952-use-after-free-in-the-audio-video-component-this-vulnerability) (info, published 10 Nov 2026) - [CVE-2026-124951: Firefox privilege escalation in Nimbus Desktop Client](https://junglewise.ai/threats/cve-2026-124951-privilege-escalation-in-the-nimbus-desktop-client-component-this) (info, published 10 Nov 2026) - [CVE-2026-124950: Firefox same-origin policy bypass in CSS Parsing and Computation](https://junglewise.ai/threats/cve-2026-124950-same-origin-policy-bypass-in-the-css-parsing-and-computation) (info, published 10 Nov 2026) - [CVE-2026-124949: Firefox other issue in SVG component](https://junglewise.ai/threats/cve-2026-124949-other-issue-in-the-svg-component-this-vulnerability-was-fixed-in) (info, published 10 Nov 2026) - [CVE-2026-124948: Mozilla Firefox use-after-free in Graphics component](https://junglewise.ai/threats/cve-2026-124948-incorrect-boundary-conditions-use-after-free-in-the-graphics) (info, published 10 Nov 2026) - [CVE-2026-124947: Firefox incorrect boundary conditions in Graphics component](https://junglewise.ai/threats/cve-2026-124947-incorrect-boundary-conditions-in-the-graphics-component-this) (info, published 10 Nov 2026) - [CVE-2026-124946: Firefox invalid pointer in JavaScript Engine JIT component](https://junglewise.ai/threats/cve-2026-124946-invalid-pointer-in-the-javascript-engine-jit-component-this) (info, published 10 Nov 2026) - [CVE-2026-124945: Firefox invalid pointer in Layout: Text and Fonts](https://junglewise.ai/threats/cve-2026-124945-invalid-pointer-in-the-layout-text-and-fonts-component-this) (info, published 10 Nov 2026) - [CVE-2026-124944: Firefox Marionette information disclosure](https://junglewise.ai/threats/cve-2026-124944-information-disclosure-in-the-marionette-component-this) (info, published 10 Nov 2026) - [CVE-2026-124943: Firefox use-after-free in Layout component](https://junglewise.ai/threats/cve-2026-124943-use-after-free-in-the-layout-component-this-vulnerability-was) (info, published 10 Nov 2026) - [CVE-2026-124942: Firefox invalid pointer in DOM: Streams component](https://junglewise.ai/threats/cve-2026-124942-invalid-pointer-in-the-dom-streams-component-this-vulnerability) (info, published 10 Nov 2026) - [CVE-2026-124941: Mozilla Firefox information disclosure in Security: RLBox](https://junglewise.ai/threats/cve-2026-124941-information-disclosure-in-the-security-rlbox-component-this) (info, published 10 Nov 2026) - [CVE-2026-124940: Mozilla Firefox mitigation bypass in File Handling](https://junglewise.ai/threats/cve-2026-124940-mitigation-bypass-in-the-file-handling-component-this) (info, published 10 Nov 2026) - [CVE-2026-124939: Mozilla Firefox JIT miscompilation in JavaScript Engine](https://junglewise.ai/threats/cve-2026-124939-jit-miscompilation-in-the-javascript-engine-jit-component-this) (info, published 10 Nov 2026) - [CVE-2026-124938: Firefox mitigation bypass in Add-ons Manager](https://junglewise.ai/threats/cve-2026-124938-mitigation-bypass-in-the-add-ons-manager-component-this) (info, published 10 Nov 2026) - [CVE-2026-124937: Firefox for Android Media component unspecified issue](https://junglewise.ai/threats/cve-2026-124937-other-issue-in-the-media-component-in-firefox-for-android-this) (info, published 10 Nov 2026) - [CVE-2026-124936: Firefox address bar domain highlighting spoofing](https://junglewise.ai/threats/cve-2026-124936-spoofing-issue-in-the-address-bar-component-this-vulnerability) (info, published 10 Nov 2026) - [CVE-2026-124935: Mozilla Firefox undefined behavior in WebRTC Networking](https://junglewise.ai/threats/cve-2026-124935-undefined-behavior-in-the-webrtc-networking-component-this) (info, published 10 Nov 2026) - [CVE-2026-124934: Mozilla Firefox spoofing issue in Security component](https://junglewise.ai/threats/cve-2026-124934-spoofing-issue-in-the-security-component-this-vulnerability-was) (info, published 10 Nov 2026) - [CVE-2026-124933: Firefox sandbox escape in Console component](https://junglewise.ai/threats/cve-2026-124933-sandbox-escape-in-the-console-component-this-vulnerability-was) (info, published 10 Nov 2026) ## Most severe Mozilla vulnerabilities - [CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability](https://junglewise.ai/threats/cve-2019-11708-mozilla-firefox-and-thunderbird-sandbox-escape-vulnerability) (critical, exploited in the wild, CVSS 10, published 23 May 2022) - [CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructor](https://junglewise.ai/threats/cve-2010-3765-mozilla-multiple-products-memory-corruption-in) (critical, exploited in the wild, CVSS 9.8, published 6 Oct 2025) - [CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2024-9680-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Oct 2024) - [CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26486-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 9.6, published 7 Mar 2022) - [CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability](https://junglewise.ai/threats/cve-2015-4495-mozilla-firefox-security-feature-bypass-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 25 May 2022) - [CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-11707-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 23 May 2022) - [CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability](https://junglewise.ai/threats/cve-2013-1690-mozilla-firefox-and-thunderbird-denial-of-service-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 28 Mar 2022) - [CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2022-26485-mozilla-firefox-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 7 Mar 2022) - [CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerability](https://junglewise.ai/threats/cve-2019-17026-mozilla-firefox-and-thunderbird-type-confusion-vulnerability) (critical, exploited in the wild, CVSS 8.8, published 3 Nov 2021) - [CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability](https://junglewise.ai/threats/cve-2020-6819-mozilla-firefox-and-thunderbird-use-after-free-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 3 Nov 2021) ## Vulnerabilities per week 269 vulnerabilities in the last four weeks, up 70% on the four before (158). 4 critical against 30. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 55 | 15 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 34 | 11 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 77 | 21 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 79 | 9 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 83 | 4 | 0 | | 19 Oct 2026 | 9 | 0 | 0 | | 26 Oct 2026 | 176 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 108 | 0 | 0 | ## Mozilla technologies - [Mozilla Firefox](https://junglewise.ai/threats/technologies/firefox): 869 vulnerabilities - [Mozilla Firefox ESR](https://junglewise.ai/threats/technologies/firefox-esr): 642 vulnerabilities - [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird): 396 vulnerabilities - [Mozilla Thunderbird-Esr](https://junglewise.ai/threats/technologies/thunderbird-esr): 86 vulnerabilities - [Mozilla Firefox for iOS](https://junglewise.ai/threats/technologies/firefox-for-ios): 17 vulnerabilities - [Mozilla Firefox for Android](https://junglewise.ai/threats/technologies/firefox-for-android): 11 vulnerabilities - [Mozilla Firefox Mobile](https://junglewise.ai/threats/technologies/firefox-mobile): 7 vulnerabilities - [Mozilla Firefox Focus](https://junglewise.ai/threats/technologies/firefox-focus-for-android): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mozilla vulnerabilities", https://junglewise.ai/threats/vendors/mozilla, 13 November 2026.