Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8JIT miscompilation, use-after-free in the JavaScript Engine: JIT component.Check if you run itEPSS 0.61%Feb 24, 2026
- Critical9.8Use-after-free in the JavaScript Engine component.Check if you run itEPSS 0.61%Feb 24, 2026
- Critical9.8Integer overflow in the JavaScript: Standard Library component.Check if you run itEPSS 0.71%Feb 24, 2026
- Critical10.0Sandbox escape in the Graphics: WebRender component.Check if you run itEPSS 0.63%Feb 24, 2026
- Critical10.0Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.Check if you run itEPSS 0.63%Feb 24, 2026
- Critical9.8Incorrect boundary conditions in the Graphics: ImageLib component.Check if you run itEPSS 0.63%Feb 24, 2026
- Critical9.8Use-after-free in the JavaScript: GC component.Check if you run itEPSS 0.61%Feb 24, 2026
- Critical9.8Incorrect boundary conditions in the WebRTC: Audio/Video component.Check if you run itEPSS 0.63%Feb 24, 2026
- Critical9.8Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled page…Check if you run itEPSS 0.48%Feb 24, 2026
- UnknownFirefox Incorrect Handle Sandbox EscapePatch nowKEVEPSS 1.94%Jan 20, 2026
- Medium5.5Rhino is an open-source implementation of JavaScript written entirely in Java.Open the advisoryDec 3, 2025
- Critical9.4Ray-Project Ray Code Injection VulnerabilityPatch nowKEVEPSS 62.46%Nov 26, 2025
- High8.1Memory safety bugs present in Firefox 139 and Thunderbird 139.Check if you run itEPSS 4.26%Jun 24, 2025
- High8.1If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the file extension.Check this weekEPSS 46.00%Jun 24, 2025
- Medium4.3The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user intoCheck this weekEPSS 28.00%Jun 24, 2025
- Critical9.8If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complCheck this weekEPSS 30.00%Jun 24, 2025
- High8.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding.Check this weekEPSS 35.00%Jun 24, 2025
- Medium6.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so.Check this weekEPSS 25.00%Jun 24, 2025
- Medium4.3When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.Check this weekEPSS 23.00%Jun 24, 2025
- Medium6.1When a file download is specified via the header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scrCheck this weekEPSS 27.00%Jun 24, 2025
- Critical9.1An attacker was able to bypass the directive of a Content Security Policy by manipulating subdocuments.Check this weekEPSS 37.00%Jun 24, 2025
- Medium6.5Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an tag.Check this weekEPSS 36.00%Jun 24, 2025
- High8.8The executable file warning did not warn users before opening files with the extension.Check this weekEPSS 21.00%Jun 24, 2025
- Medium4.3An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/priCheck this weekEPSS 31.00%Jun 24, 2025
- Critical9.8A use-after-free in FontFaceSet resulted in a potentially exploitable crash.Check if you run itEPSS 4.39%Jun 24, 2025