Refine your search
2485 vulnerabilities found for Firefox by Mozilla
CERTFR-2026-AVI-1406
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox | Firefox versions antérieures à 159 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 153.6 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.44 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153.6 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 159 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 159",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.6",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.44",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153.6",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 159",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-117907",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117907"
},
{
"name": "CVE-2026-117889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117889"
},
{
"name": "CVE-2026-117988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117988"
},
{
"name": "CVE-2026-117865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117865"
},
{
"name": "CVE-2026-117967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117967"
},
{
"name": "CVE-2026-117914",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117914"
},
{
"name": "CVE-2026-117956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117956"
},
{
"name": "CVE-2026-117900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117900"
},
{
"name": "CVE-2026-117868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117868"
},
{
"name": "CVE-2026-117960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117960"
},
{
"name": "CVE-2026-117882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117882"
},
{
"name": "CVE-2026-117953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117953"
},
{
"name": "CVE-2026-118179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118179"
},
{
"name": "CVE-2026-117996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117996"
},
{
"name": "CVE-2026-117962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117962"
},
{
"name": "CVE-2026-117948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117948"
},
{
"name": "CVE-2026-117910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117910"
},
{
"name": "CVE-2026-117915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117915"
},
{
"name": "CVE-2026-117888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117888"
},
{
"name": "CVE-2026-117935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117935"
},
{
"name": "CVE-2026-117899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117899"
},
{
"name": "CVE-2026-118027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118027"
},
{
"name": "CVE-2026-118026",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118026"
},
{
"name": "CVE-2026-117983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117983"
},
{
"name": "CVE-2026-117972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117972"
},
{
"name": "CVE-2026-117920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117920"
},
{
"name": "CVE-2026-118014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118014"
},
{
"name": "CVE-2026-117979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117979"
},
{
"name": "CVE-2026-117871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117871"
},
{
"name": "CVE-2026-117973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117973"
},
{
"name": "CVE-2026-118017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118017"
},
{
"name": "CVE-2026-117878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117878"
},
{
"name": "CVE-2026-118174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118174"
},
{
"name": "CVE-2026-117965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117965"
},
{
"name": "CVE-2026-117952",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117952"
},
{
"name": "CVE-2026-118005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118005"
},
{
"name": "CVE-2026-117863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117863"
},
{
"name": "CVE-2026-118006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118006"
},
{
"name": "CVE-2026-117969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117969"
},
{
"name": "CVE-2026-118024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118024"
},
{
"name": "CVE-2026-117867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117867"
},
{
"name": "CVE-2026-117997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117997"
},
{
"name": "CVE-2026-117925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117925"
},
{
"name": "CVE-2026-117860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117860"
},
{
"name": "CVE-2026-117864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117864"
},
{
"name": "CVE-2026-118004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118004"
},
{
"name": "CVE-2026-109707",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109707"
},
{
"name": "CVE-2026-117934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117934"
},
{
"name": "CVE-2026-117879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117879"
},
{
"name": "CVE-2026-117872",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117872"
},
{
"name": "CVE-2026-117869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117869"
},
{
"name": "CVE-2026-117942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117942"
},
{
"name": "CVE-2026-117957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117957"
},
{
"name": "CVE-2026-117912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117912"
},
{
"name": "CVE-2026-117950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117950"
},
{
"name": "CVE-2026-117990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117990"
},
{
"name": "CVE-2026-117991",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117991"
},
{
"name": "CVE-2026-109708",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109708"
},
{
"name": "CVE-2026-117924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117924"
},
{
"name": "CVE-2026-117931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117931"
},
{
"name": "CVE-2026-117911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117911"
},
{
"name": "CVE-2026-118019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118019"
},
{
"name": "CVE-2026-110247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110247"
},
{
"name": "CVE-2026-118012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118012"
},
{
"name": "CVE-2026-117982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117982"
},
{
"name": "CVE-2026-117909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117909"
},
{
"name": "CVE-2026-117984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117984"
},
{
"name": "CVE-2026-100801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100801"
},
{
"name": "CVE-2026-117901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117901"
},
{
"name": "CVE-2026-117897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117897"
},
{
"name": "CVE-2026-117964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117964"
},
{
"name": "CVE-2026-117978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117978"
},
{
"name": "CVE-2026-117999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117999"
},
{
"name": "CVE-2026-118008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118008"
},
{
"name": "CVE-2026-117939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117939"
},
{
"name": "CVE-2026-118007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118007"
},
{
"name": "CVE-2026-118011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118011"
},
{
"name": "CVE-2026-117946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117946"
},
{
"name": "CVE-2026-117913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117913"
},
{
"name": "CVE-2026-118016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118016"
},
{
"name": "CVE-2026-117898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117898"
},
{
"name": "CVE-2026-117922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117922"
},
{
"name": "CVE-2026-117977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117977"
},
{
"name": "CVE-2026-117992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117992"
},
{
"name": "CVE-2026-117885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117885"
},
{
"name": "CVE-2026-117927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117927"
},
{
"name": "CVE-2026-117976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117976"
},
{
"name": "CVE-2026-117928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117928"
},
{
"name": "CVE-2026-117894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117894"
},
{
"name": "CVE-2026-117937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117937"
},
{
"name": "CVE-2026-117921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117921"
},
{
"name": "CVE-2026-109705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109705"
},
{
"name": "CVE-2026-117987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117987"
},
{
"name": "CVE-2026-117874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117874"
},
{
"name": "CVE-2026-118009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118009"
},
{
"name": "CVE-2026-117974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117974"
},
{
"name": "CVE-2026-117981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117981"
},
{
"name": "CVE-2026-117963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117963"
},
{
"name": "CVE-2026-117970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117970"
},
{
"name": "CVE-2026-117884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117884"
},
{
"name": "CVE-2026-118022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118022"
},
{
"name": "CVE-2026-118177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118177"
},
{
"name": "CVE-2026-117929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117929"
},
{
"name": "CVE-2026-117985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117985"
},
{
"name": "CVE-2026-117891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117891"
},
{
"name": "CVE-2026-117959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117959"
},
{
"name": "CVE-2026-117883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117883"
},
{
"name": "CVE-2026-117892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117892"
},
{
"name": "CVE-2026-117866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117866"
},
{
"name": "CVE-2026-117861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117861"
},
{
"name": "CVE-2026-117938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117938"
},
{
"name": "CVE-2026-117933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117933"
},
{
"name": "CVE-2026-117943",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117943"
},
{
"name": "CVE-2026-117923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117923"
},
{
"name": "CVE-2026-117954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117954"
},
{
"name": "CVE-2026-117966",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117966"
},
{
"name": "CVE-2026-117945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117945"
},
{
"name": "CVE-2026-118178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118178"
},
{
"name": "CVE-2026-117989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117989"
},
{
"name": "CVE-2026-117890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117890"
},
{
"name": "CVE-2026-118010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118010"
},
{
"name": "CVE-2026-117873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117873"
},
{
"name": "CVE-2026-118020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118020"
},
{
"name": "CVE-2026-117862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117862"
},
{
"name": "CVE-2026-117944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117944"
},
{
"name": "CVE-2026-117881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117881"
},
{
"name": "CVE-2026-118176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118176"
},
{
"name": "CVE-2026-117896",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117896"
},
{
"name": "CVE-2026-117994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117994"
},
{
"name": "CVE-2026-117968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117968"
},
{
"name": "CVE-2026-117875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117875"
},
{
"name": "CVE-2026-113869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113869"
},
{
"name": "CVE-2026-117876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117876"
},
{
"name": "CVE-2026-117919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117919"
},
{
"name": "CVE-2026-117932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117932"
},
{
"name": "CVE-2026-117918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117918"
},
{
"name": "CVE-2026-117940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117940"
},
{
"name": "CVE-2026-117993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117993"
},
{
"name": "CVE-2026-117955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117955"
},
{
"name": "CVE-2026-117887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117887"
},
{
"name": "CVE-2026-117903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117903"
},
{
"name": "CVE-2026-118002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118002"
},
{
"name": "CVE-2026-117880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117880"
},
{
"name": "CVE-2026-118175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118175"
},
{
"name": "CVE-2026-117904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117904"
},
{
"name": "CVE-2026-118015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118015"
},
{
"name": "CVE-2026-117975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117975"
},
{
"name": "CVE-2026-117986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117986"
},
{
"name": "CVE-2026-117895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117895"
},
{
"name": "CVE-2026-118180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118180"
},
{
"name": "CVE-2026-117958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117958"
},
{
"name": "CVE-2026-118003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118003"
},
{
"name": "CVE-2026-117917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117917"
},
{
"name": "CVE-2026-117947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117947"
},
{
"name": "CVE-2026-117906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117906"
},
{
"name": "CVE-2026-117936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117936"
},
{
"name": "CVE-2026-117995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117995"
},
{
"name": "CVE-2026-118023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118023"
},
{
"name": "CVE-2026-117908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117908"
},
{
"name": "CVE-2026-117916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117916"
},
{
"name": "CVE-2026-117961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117961"
},
{
"name": "CVE-2026-118000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118000"
},
{
"name": "CVE-2026-117941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117941"
},
{
"name": "CVE-2026-118013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118013"
},
{
"name": "CVE-2026-117951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117951"
},
{
"name": "CVE-2026-117980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117980"
},
{
"name": "CVE-2026-117930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117930"
},
{
"name": "CVE-2026-117926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117926"
},
{
"name": "CVE-2026-117870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117870"
},
{
"name": "CVE-2026-117998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117998"
},
{
"name": "CVE-2026-117877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117877"
},
{
"name": "CVE-2026-117949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117949"
},
{
"name": "CVE-2026-117886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117886"
},
{
"name": "CVE-2026-117902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117902"
},
{
"name": "CVE-2026-117905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117905"
},
{
"name": "CVE-2026-117893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117893"
},
{
"name": "CVE-2026-118025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118025"
},
{
"name": "CVE-2026-118021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118021"
},
{
"name": "CVE-2026-117971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117971"
},
{
"name": "CVE-2026-118018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118018"
}
],
"initial_release_date": "2026-10-28T00:00:00",
"last_revision_date": "2026-10-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1406",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-120",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-121",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-121/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-122",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-119",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-118",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/"
}
]
}
CVE-2026-118027 (GCVE-0-2026-118027)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 14:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "115.44",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44."
}
],
"value": "Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:06:06.303Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2045606"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-119/"
}
],
"title": "Frame poisoning in the Layout component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118027",
"datePublished": "2026-10-27T14:06:06.303Z",
"dateReserved": "2026-10-27T14:06:06.134Z",
"dateUpdated": "2026-10-27T14:06:06.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118026 (GCVE-0-2026-118026)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:37.886Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077075"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Invalid pointer in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118026",
"datePublished": "2026-10-27T14:06:05.943Z",
"dateReserved": "2026-10-27T14:06:05.746Z",
"dateUpdated": "2026-10-27T18:18:37.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118025 (GCVE-0-2026-118025)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:33.578Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082311"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Other issue in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118025",
"datePublished": "2026-10-27T14:06:05.536Z",
"dateReserved": "2026-10-27T14:06:05.334Z",
"dateUpdated": "2026-10-27T18:18:33.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118024 (GCVE-0-2026-118024)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:32.888Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081959"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118024",
"datePublished": "2026-10-27T14:06:05.145Z",
"dateReserved": "2026-10-27T14:06:04.918Z",
"dateUpdated": "2026-10-27T18:18:32.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118023 (GCVE-0-2026-118023)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:26.392Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079499"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the Graphics: WebRender component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118023",
"datePublished": "2026-10-27T14:06:04.734Z",
"dateReserved": "2026-10-27T14:06:04.563Z",
"dateUpdated": "2026-10-27T18:18:26.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118022 (GCVE-0-2026-118022)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:21.367Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2078941"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118022",
"datePublished": "2026-10-27T14:06:04.383Z",
"dateReserved": "2026-10-27T14:06:04.213Z",
"dateUpdated": "2026-10-27T18:18:21.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118021 (GCVE-0-2026-118021)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:11.169Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076695"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the XPCOM component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118021",
"datePublished": "2026-10-27T14:06:04.037Z",
"dateReserved": "2026-10-27T14:06:03.867Z",
"dateUpdated": "2026-10-27T18:18:11.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118020 (GCVE-0-2026-118020)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:06.754Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075977"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Layout component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118020",
"datePublished": "2026-10-27T14:06:03.687Z",
"dateReserved": "2026-10-27T14:06:03.527Z",
"dateUpdated": "2026-10-27T18:18:06.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118019 (GCVE-0-2026-118019)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:56.498Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2025386"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Race condition, use-after-free in the DOM: File component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118019",
"datePublished": "2026-10-27T14:06:03.344Z",
"dateReserved": "2026-10-27T14:06:03.150Z",
"dateUpdated": "2026-10-27T18:17:56.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118018 (GCVE-0-2026-118018)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 14:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
References
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "haxatron1"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159."
}
],
"value": "Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:06:02.952Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1822968"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
}
],
"title": "Spoofing issue in the Downloads component in Firefox for Android"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118018",
"datePublished": "2026-10-27T14:06:02.952Z",
"dateReserved": "2026-10-27T14:06:02.789Z",
"dateUpdated": "2026-10-27T14:06:02.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118017 (GCVE-0-2026-118017)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:55.060Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082200"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118017",
"datePublished": "2026-10-27T14:06:02.550Z",
"dateReserved": "2026-10-27T14:06:02.382Z",
"dateUpdated": "2026-10-27T18:17:55.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118016 (GCVE-0-2026-118016)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:48.307Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082086"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118016",
"datePublished": "2026-10-27T14:06:02.197Z",
"dateReserved": "2026-10-27T14:06:02.018Z",
"dateUpdated": "2026-10-27T18:17:48.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118015 (GCVE-0-2026-118015)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:46.874Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082072"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118015",
"datePublished": "2026-10-27T14:06:01.814Z",
"dateReserved": "2026-10-27T14:06:01.650Z",
"dateUpdated": "2026-10-27T18:17:46.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118014 (GCVE-0-2026-118014)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:44.493Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082051"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118014",
"datePublished": "2026-10-27T14:06:01.470Z",
"dateReserved": "2026-10-27T14:06:01.298Z",
"dateUpdated": "2026-10-27T18:17:44.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118013 (GCVE-0-2026-118013)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:42.258Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082040"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Layout: Images, Video, and HTML Frames component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118013",
"datePublished": "2026-10-27T14:06:01.113Z",
"dateReserved": "2026-10-27T14:06:00.944Z",
"dateUpdated": "2026-10-27T18:17:42.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118012 (GCVE-0-2026-118012)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:36.916Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081998"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Animation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118012",
"datePublished": "2026-10-27T14:06:00.756Z",
"dateReserved": "2026-10-27T14:06:00.596Z",
"dateUpdated": "2026-10-27T18:17:36.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118011 (GCVE-0-2026-118011)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:36.146Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081985"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Frame poisoning in the CSS Parsing and Computation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118011",
"datePublished": "2026-10-27T14:06:00.409Z",
"dateReserved": "2026-10-27T14:06:00.241Z",
"dateUpdated": "2026-10-27T18:17:36.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118010 (GCVE-0-2026-118010)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:59.477Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077770"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Disability Access APIs component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118010",
"datePublished": "2026-10-27T14:06:00.056Z",
"dateReserved": "2026-10-27T14:05:59.883Z",
"dateUpdated": "2026-10-27T18:16:59.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118009 (GCVE-0-2026-118009)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Thanh Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:52.906Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076098"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Integer overflow, use-after-free in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118009",
"datePublished": "2026-10-27T14:05:59.709Z",
"dateReserved": "2026-10-27T14:05:59.546Z",
"dateUpdated": "2026-10-27T18:16:52.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118008 (GCVE-0-2026-118008)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-28 03:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:51.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amy Burnett of OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:51.508Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075440"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Privilege escalation in the DOM: Navigation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118008",
"datePublished": "2026-10-27T14:05:59.374Z",
"dateReserved": "2026-10-27T14:05:59.210Z",
"dateUpdated": "2026-10-28T03:55:51.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118007 (GCVE-0-2026-118007)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:49.281Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075296"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118007",
"datePublished": "2026-10-27T14:05:59.029Z",
"dateReserved": "2026-10-27T14:05:58.863Z",
"dateUpdated": "2026-10-27T18:16:49.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118006 (GCVE-0-2026-118006)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:47.829Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074202"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Privilege escalation due to use-after-free in the WebRTC: Signaling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118006",
"datePublished": "2026-10-27T14:05:58.678Z",
"dateReserved": "2026-10-27T14:05:58.516Z",
"dateUpdated": "2026-10-27T18:16:47.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118005 (GCVE-0-2026-118005)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:44.947Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073653"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the WebRTC: Signaling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118005",
"datePublished": "2026-10-27T14:05:58.322Z",
"dateReserved": "2026-10-27T14:05:58.162Z",
"dateUpdated": "2026-10-27T18:16:44.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118004 (GCVE-0-2026-118004)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:31.194Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077756"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Incorrect boundary conditions in the CSS Transitions and Animations component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118004",
"datePublished": "2026-10-27T14:05:57.018Z",
"dateReserved": "2026-10-27T14:05:56.855Z",
"dateUpdated": "2026-10-27T18:30:31.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118003 (GCVE-0-2026-118003)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "eldjiikgull"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:30.106Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076744"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Information disclosure in the Networking: DNS component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118003",
"datePublished": "2026-10-27T14:05:56.677Z",
"dateReserved": "2026-10-27T14:05:56.492Z",
"dateUpdated": "2026-10-27T18:30:30.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118002 (GCVE-0-2026-118002)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Abdulrahman Alzahrani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:29.034Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073584"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Information disclosure due to race condition in the Networking component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118002",
"datePublished": "2026-10-27T14:05:56.271Z",
"dateReserved": "2026-10-27T14:05:56.095Z",
"dateUpdated": "2026-10-27T18:30:29.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118000 (GCVE-0-2026-118000)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:27.970Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2072436"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Information disclosure in the Networking: HTTP component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118000",
"datePublished": "2026-10-27T14:05:55.917Z",
"dateReserved": "2026-10-27T14:05:55.751Z",
"dateUpdated": "2026-10-27T18:30:27.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117999 (GCVE-0-2026-117999)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:26.874Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071379"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Race condition in the IPC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-117999",
"datePublished": "2026-10-27T14:05:55.569Z",
"dateReserved": "2026-10-27T14:05:55.394Z",
"dateUpdated": "2026-10-27T18:30:26.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117998 (GCVE-0-2026-117998)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ibuki Sato"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:25.821Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2042021"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Mitigation bypass in the DOM: Push Subscriptions component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-117998",
"datePublished": "2026-10-27T14:05:55.174Z",
"dateReserved": "2026-10-27T14:05:54.996Z",
"dateUpdated": "2026-10-27T18:30:25.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}