Class familyMozilla · Firefox
Mozilla Firefox origin Validation Error flaws, 2015–2026
21 Firefox CVEs with CWE-346 weaknesses, 8 Aug 2015 to 13 Oct 2026. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2015’15
2016’16
2017’17
2018’18
2019’19
2020’20
2021’21
1 2022’22
2023’23
2 2024’24
3 2025’25
14 2026’26
In CISA KEVNot in KEV
20151 CVE, 1 in KEV
20221 CVE
20242 CVEs
20253 CVEs
202614 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2015-4495KEV | 8 Aug 2015 | Mozilla Firefox Security Feature Bypass Vulnerability | Grouped by weakness | 69.0 |
| CVE-2022-42927 | 22 Dec 2022 | A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a… | Grouped by weakness | 13.4 |
| CVE-2024-9392 | 1 Oct 2024 | A compromised content process could have allowed for the arbitrary loading of cross-origin pages | Grouped by weakness | 15.9 |
| CVE-2024-9393 | 1 Oct 2024 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the… | Grouped by weakness | 12.0 |
| CVE-2025-5263 | 27 May 2025 | Error handling for script execution was incorrectly isolated from web content | Grouped by weakness | 6.7 |
| CVE-2025-9180 | 19 Aug 2025 | Same-origin policy bypass in the Graphics: Canvas2D component | Grouped by weakness | 9.4 |
| CVE-2025-14331 | 9 Dec 2025 | Same-origin policy bypass in the Request Handling component | Grouped by weakness | 6.2 |
| CVE-2026-2790 | 24 Feb 2026 | Same-origin policy bypass in the Networking: JAR component | Grouped by weakness | 9.6 |
| CVE-2026-3846 | 10 Mar 2026 | Same-origin policy bypass in the CSS Parsing and Computation component | Grouped by weakness | 4.9 |
| CVE-2026-8950 | 19 May 2026 | Same-origin policy bypass in the Networking: HTTP component | Grouped by weakness | 8.3 |
| CVE-2026-8971 | 19 May 2026 | Same-origin policy bypass in the Networking: JAR component | Grouped by weakness | 6.7 |
| CVE-2026-12304 | 16 Jun 2026 | Same-origin policy bypass in the Networking: Cookies component | Grouped by weakness | 8.1 |
| CVE-2026-16349 | 21 Jul 2026 | Same-origin policy bypass in the DOM: Navigation component | Grouped by weakness | 11.4 |
| CVE-2026-16381 | 21 Jul 2026 | Same-origin policy bypass in the Networking: DNS component | Grouped by weakness | 9.1 |
| CVE-2026-74963 | 18 Aug 2026 | Same-origin policy bypass in the Networking: Cookies component | Grouped by weakness | 4.9 |
| CVE-2026-74967 | 18 Aug 2026 | Same-origin policy bypass in the Audio/Video: Playback component | Grouped by weakness | 4.9 |
| CVE-2026-74974 | 18 Aug 2026 | Same-origin policy bypass in the Graphics: ImageLib component | Grouped by weakness | 5.0 |
| CVE-2026-92068 | 15 Sep 2026 | Site isolation issue in the Reader Mode component | Grouped by weakness | 4.0 |
| CVE-2026-100803 | 29 Sep 2026 | Same-origin policy bypass in the WebExtensions component | Grouped by weakness | 6.9 |
| CVE-2026-100809 | 29 Sep 2026 | Same-origin policy bypass in the DevTools component | Grouped by weakness | 6.5 |
| CVE-2026-109772 | 13 Oct 2026 | Same-origin policy bypass in the DevTools component | Grouped by weakness | 7.9 |