Multiple vulnerabilities in Mozilla Firefox

Description

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. Security vulnerability in Firefox and Firefox Focus for Android can be exploited to bypass security restrictions.
2. Denial of service vulnerability in the Audio/Video: Web Codecs component can be exploited remotely to cause denial of service.
3. A remote code execution vulnerability in the DOM: Bindings (WebIDL) component can be exploited remotely to execute arbitrary code.
4. Security vulnerability in the DOM: Networking component can be exploited to bypass security restrictions.
5. A remote code execution vulnerability in the Widget: Win32 component can be exploited remotely to execute arbitrary code.
6. Security vulnerability in the Networking: HTTP component can be exploited to bypass security restrictions.
7. Security UI vulnerability in the Toolbar component in Firefox for Android can be exploited to spoof user interface.
8. Security vulnerability in the Application Update component can be exploited to bypass security restrictions.
9. A remote code execution vulnerability in the Disability Access APIs component can be exploited remotely to execute arbitrary code.
10. A remote code execution vulnerability in the Audio/Video component can be exploited remotely to execute arbitrary code.
11. Security vulnerability in the DOM: Workers component can be exploited to bypass security restrictions.
12. A remote code execution vulnerability in the Networking: JAR component can be exploited remotely to execute arbitrary code.
13. Security vulnerability in the Enterprise Policies component can be exploited to bypass security restrictions.
14. Security vulnerability in the Security: Process Sandboxing component can be exploited to bypass security restrictions.
15. Denial of service vulnerability in the Widget: Win32 component can be exploited remotely to cause denial of service.
16. Security UI vulnerability in WebExtensions can be exploited to spoof user interface.
17. Security UI vulnerability in the Form Autofill component can be exploited to spoof user interface.
18. Security vulnerability in the DOM: Security component can be exploited to bypass security restrictions.
19. Security UI vulnerability in the Web Speech component can be exploited to spoof user interface.
20. Security UI vulnerability in the Popup Blocker component can be exploited to spoof user interface.
21. Information disclosure vulnerability in the DOM: Security component can be exploited to obtain sensitive information.
22. Information disclosure vulnerability in the IP Protection component can be exploited to obtain sensitive information.
23. Information disclosure vulnerability in the Graphics: WebGPU component can be exploited to obtain sensitive information.
24. Security vulnerability in the Security component can be exploited to bypass security restrictions.
25. Security vulnerability in the Networking: JAR component can be exploited to bypass security restrictions.
26. Security vulnerability in the WebRTC: Audio/Video component can be exploited to bypass security restrictions.
27. A remote code execution vulnerability in Thunderbird 151 can be exploited remotely to execute arbitrary code.
28. A remote code execution vulnerability in Thunderbird 140 can be exploited remotely to execute arbitrary code.

Original advisories

• MFSA2026-46

Exploitation

Related products

• Mozilla-Firefox

CVE list

• CVE-2026-8945
  critical
• CVE-2026-8946
  critical
• CVE-2026-8947
  high
• CVE-2026-8948
  critical
• CVE-2026-8949
  critical
• CVE-2026-8950
  critical
• CVE-2026-8951
  high
• CVE-2026-8952
  high
• CVE-2026-8953
  critical
• CVE-2026-8954
  critical
• CVE-2026-8955
  high
• CVE-2026-8956
  critical
• CVE-2026-8957
  high
• CVE-2026-8958
  critical
• CVE-2026-8959
  critical
• CVE-2026-8960
  critical
• CVE-2026-8961
  unknown
• CVE-2026-8962
  unknown
• CVE-2026-8963
  critical
• CVE-2026-8964
  critical
• CVE-2026-8965
  unknown
• CVE-2026-8966
  unknown
• CVE-2026-8967
  unknown
• CVE-2026-8968
  critical
• CVE-2026-8969
  critical
• CVE-2026-8970
  high
• CVE-2026-8971
  high
• CVE-2026-8972
  high
• CVE-2026-8973
  critical
• CVE-2026-8974
  critical
• CVE-2026-8975
  critical

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com