Mozilla Firefox

• CVE-2024-9680 Critical 9.8 Exploited An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This 23.2%
• CVE-2022-26486 Critical 9.6 Exploited An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affect 2.4%
• CVE-2022-26485 High 8.8 Exploited Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2 14.3%
• CVE-2020-6819 High 8.1 Exploited Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affect 3.0%
• CVE-2020-6820 High 8.1 Exploited Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunde 7.1%
• CVE-2019-17026 High 8.8 Exploited Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affe 46.3%
• CVE-2019-11707 High 8.8 Exploited A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing 38.0%
• CVE-2019-11708 Critical 10.0 Exploited Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised 55.9%
• CVE-2016-9079 High 7.5 Exploited A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vul 87.4%
• CVE-2026-120572 High 8.8 Incorrect boundary conditions in the Layout: Block and Inline component 0.3%
• CVE-2026-118027 Critical 9.1 Frame poisoning in the Layout component 0.3%
• CVE-2026-118026 High 8.8 Invalid pointer in the JavaScript: GC component 0.2%
• CVE-2026-118025 High 8.8 Other issue in the SVG component 0.2%
• CVE-2026-118024 High 8.8 Use-after-free in the Graphics: Text component 0.2%
• CVE-2026-118023 High 8.8 Sandbox escape due to use-after-free in the Graphics: WebRender component 0.2%
• CVE-2026-118022 High 8.8 Sandbox escape due to use-after-free in the Disability Access APIs component 0.2%
• CVE-2026-118021 High 8.8 Sandbox escape due to use-after-free in the XPCOM component 0.2%
• CVE-2026-118020 High 8.8 Use-after-free in the Layout component 0.2%
• CVE-2026-118019 High 8.8 Race condition, use-after-free in the DOM: File component 0.2%
• CVE-2026-118018 High 8.8 Spoofing issue in the Downloads component in Firefox for Android 0.2%
• CVE-2026-118017 High 8.8 Use-after-free in the SVG component 0.2%
• CVE-2026-118016 High 8.8 Use-after-free in the DOM: Core & HTML component 0.2%
• CVE-2026-118015 High 8.8 Use-after-free in the DOM: Core & HTML component 0.3%
• CVE-2026-118014 High 8.8 Use-after-free in the JavaScript Engine: JIT component 0.3%
• CVE-2026-118013 High 8.8 Use-after-free in the Layout: Images, Video, and HTML Frames component 0.3%
• CVE-2026-118012 High 8.8 Use-after-free in the DOM: Animation component 0.3%
• CVE-2026-118011 High 8.8 Frame poisoning in the CSS Parsing and Computation component 0.3%
• CVE-2026-118010 High 8.8 Use-after-free in the Disability Access APIs component 0.3%
• CVE-2026-118009 High 8.8 Integer overflow, use-after-free in the Graphics: Text component 0.3%
• CVE-2026-118008 High 8.8 Privilege escalation in the DOM: Navigation component 0.4%
• CVE-2026-118007 High 8.8 Use-after-free in the JavaScript: GC component 0.3%
• CVE-2026-118006 High 8.8 Privilege escalation due to use-after-free in the WebRTC: Signaling component 0.3%
• CVE-2026-118005 High 8.8 Use-after-free in the WebRTC: Signaling component 0.3%
• CVE-2026-118004 High 8.1 Incorrect boundary conditions in the CSS Transitions and Animations component 0.4%
• CVE-2026-118003 High 8.1 Information disclosure in the Networking: DNS component 0.4%
• CVE-2026-118002 High 8.1 Information disclosure due to race condition in the Networking component 0.4%
• CVE-2026-118000 High 8.1 Information disclosure in the Networking: HTTP component 0.4%
• CVE-2026-117999 High 8.8 Race condition in the IPC component 0.3%
• CVE-2026-117998 High 8.8 Mitigation bypass in the DOM: Push Subscriptions component 0.4%
• CVE-2026-117997 Critical 9.6 Sandbox escape due to use-after-free in the Widget component 0.4%
• CVE-2026-117996 High 8.1 Incorrect boundary conditions in the WebRTC component 0.4%
• CVE-2026-117995 High 8.8 Privilege escalation in the DOM: UI Events & Focus Handling component 0.4%
• CVE-2026-117994 High 8.8 Use-after-free in the JavaScript: GC component 0.4%
• CVE-2026-117993 High 8.8 Integer overflow in the Graphics: Text component 0.4%
• CVE-2026-117992 Medium 6.5 Information disclosure in the CSS Parsing and Computation component 0.4%
• CVE-2026-117991 High 8.8 Incorrect boundary conditions in the Layout: Text and Fonts component 0.4%
• CVE-2026-117990 Critical 9.6 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component 0.4%
• CVE-2026-117989 High 8.8 Use-after-free in the Graphics component 0.4%
• CVE-2026-117988 Critical 9.6 Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component 0.4%
• CVE-2026-117987 High 8.8 Use-after-free in the Graphics component 0.4%