{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Mozilla vulnerabilities","home_page_url":"https://patchfirst.co/vendor/mozilla/","feed_url":"https://patchfirst.co/feed/vendor/mozilla.json","description":"New and newly exploited Mozilla CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-113399","url":"https://patchfirst.co/cve/CVE-2026-113399/","title":"CVE-2026-113399: Incorrect boundary conditions in the SVG component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.5% (higher than 42% of CVEs). CVSS 9.8 CRITICAL. Priority 17.2 of 100.","summary":"Incorrect boundary conditions in the SVG component","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-29T18:17:23.000Z","tags":[],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.00489,"percentile":0.4205},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-113867","url":"https://patchfirst.co/cve/CVE-2026-113867/","title":"CVE-2026-113867: Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas","content_text":"Mozilla · Thunderbird. Not in CISA KEV. EPSS 0.4% (higher than 34.1% of CVEs). CVSS 9.1 CRITICAL. Priority 15.1 of 100.","summary":"Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas","date_published":"2026-10-20T00:00:00.000Z","date_modified":"2026-10-29T19:17:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.1,"kev":null,"epss":{"score":0.00399,"percentile":0.34074},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109750","url":"https://patchfirst.co/cve/CVE-2026-109750/","title":"CVE-2026-109750: Site isolation issue in the DOM: Web Authentication component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.4% (higher than 32% of CVEs). CVSS 9.6 CRITICAL. Priority 15.4 of 100.","summary":"Site isolation issue in the DOM: Web Authentication component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-19T21:17:04.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.0038,"percentile":0.31993},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109780","url":"https://patchfirst.co/cve/CVE-2026-109780/","title":"CVE-2026-109780: Mitigation bypass in the DOM: Core & HTML component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.4% (higher than 30.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.2 of 100.","summary":"Mitigation bypass in the DOM: Core & HTML component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T20:17:47.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.00363,"percentile":0.3013},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109774","url":"https://patchfirst.co/cve/CVE-2026-109774/","title":"CVE-2026-109774: Invalid pointer, undefined behavior in the DOM: Notifications component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 27.7% of CVEs). CVSS 9.8 CRITICAL. Priority 14.7 of 100.","summary":"Invalid pointer, undefined behavior in the DOM: Notifications component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-26T20:17:46.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.7,"kev":null,"epss":{"score":0.00342,"percentile":0.27725},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109745","url":"https://patchfirst.co/cve/CVE-2026-109745/","title":"CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.7 of 100.","summary":"Sandbox escape due to uninitialized memory in the DOM: Web Serial component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-19T13:16:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.7,"kev":null,"epss":{"score":0.00349,"percentile":0.28577},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109740","url":"https://patchfirst.co/cve/CVE-2026-109740/","title":"CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 28.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.7 of 100.","summary":"Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-19T12:16:59.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.7,"kev":null,"epss":{"score":0.00349,"percentile":0.28577},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109755","url":"https://patchfirst.co/cve/CVE-2026-109755/","title":"CVE-2026-109755: Sandbox escape in the DOM: Content Processes component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 27.2% of CVEs). CVSS 9.6 CRITICAL. Priority 14.4 of 100.","summary":"Sandbox escape in the DOM: Content Processes component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-15T20:17:08.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00338,"percentile":0.27235},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109708","url":"https://patchfirst.co/cve/CVE-2026-109708/","title":"CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 26.8% of CVEs). CVSS 9.6 CRITICAL. Priority 14.4 of 100.","summary":"Sandbox escape due to incorrect boundary conditions in the Networking component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-27T14:16:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00334,"percentile":0.26823},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109707","url":"https://patchfirst.co/cve/CVE-2026-109707/","title":"CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 25.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.1 of 100.","summary":"Sandbox escape due to use-after-free in the Networking component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-27T14:16:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.1,"kev":null,"epss":{"score":0.00325,"percentile":0.25572},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-109705","url":"https://patchfirst.co/cve/CVE-2026-109705/","title":"CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 25.6% of CVEs). CVSS 9.6 CRITICAL. Priority 14.1 of 100.","summary":"Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component","date_published":"2026-10-13T00:00:00.000Z","date_modified":"2026-10-27T14:16:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.1,"kev":null,"epss":{"score":0.00325,"percentile":0.25573},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-106016","url":"https://patchfirst.co/cve/CVE-2026-106016/","title":"CVE-2026-106016: Mitigation bypass in the File Handling component","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.3% (higher than 24.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.1 of 100.","summary":"Mitigation bypass in the File Handling component","date_published":"2026-10-06T00:00:00.000Z","date_modified":"2026-10-13T19:18:01.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.1,"kev":null,"epss":{"score":0.00319,"percentile":0.24834},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2010-3765#kev","url":"https://patchfirst.co/cve/CVE-2010-3765/","title":"[KEV] CVE-2010-3765: Mozilla Multiple Products Remote Code Execution Vulnerability","content_text":"Mozilla · Multiple Products. In CISA KEV since 2025-10-06. ENISA EUVD lists it as exploited. EPSS 83.2% (higher than 99.68% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059.007 JavaScript. Priority 69.8 of 100.","summary":"Mozilla Multiple Products Remote Code Execution Vulnerability","date_published":"2025-10-06T00:00:00.000Z","date_modified":"2026-06-16T23:23:28.000Z","tags":["kev","public-exploit","T1059.007"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2025-10-06","ransomware":false},"epss":{"score":0.83156,"percentile":0.99676},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Multiple Products","techniqueIds":["T1059.007"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-2857","url":"https://patchfirst.co/cve/CVE-2025-2857/","title":"CVE-2025-2857: Incorrect handle could lead to sandbox escapes","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 2.0% (higher than 80.5% of CVEs). CVSS 10.0 CRITICAL. Priority 64.7 of 100.","summary":"Incorrect handle could lead to sandbox escapes","date_published":"2025-03-27T00:00:00.000Z","date_modified":"2026-06-09T16:23:02.000Z","tags":[],"_patchfirst":{"reason":"published","priority":64.7,"kev":null,"epss":{"score":0.01976,"percentile":0.80471},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-9680#kev","url":"https://patchfirst.co/cve/CVE-2024-9680/","title":"[KEV] CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerability","content_text":"Mozilla · Firefox. In CISA KEV since 2024-10-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 23.2% (higher than 97.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 79.4 of 100.","summary":"Mozilla Firefox Use-After-Free Vulnerability","date_published":"2024-10-15T00:00:00.000Z","date_modified":"2026-08-04T05:16:32.000Z","tags":["kev","ransomware","public-exploit"],"_patchfirst":{"reason":"kev","priority":79.4,"kev":{"dateAdded":"2024-10-15","ransomware":true},"epss":{"score":0.23184,"percentile":0.97766},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-4367","url":"https://patchfirst.co/cve/CVE-2024-4367/","title":"CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 70.7% (higher than 99.39% of CVEs). CVSS 5.6 MEDIUM. Public exploit code exists. Priority 30.4 of 100.","summary":"A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js…","date_published":"2024-05-14T00:00:00.000Z","date_modified":"2026-05-12T11:30:41.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":30.4,"kev":null,"epss":{"score":0.7066,"percentile":0.99392},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2016-9079#kev","url":"https://patchfirst.co/cve/CVE-2016-9079/","title":"[KEV] CVE-2016-9079: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability","content_text":"Mozilla · Firefox, Firefox ESR, and Thunderbird. In CISA KEV since 2023-06-22. ENISA EUVD lists it as exploited. EPSS 87.4% (higher than 99.76% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 68.2 of 100.","summary":"Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability","date_published":"2023-06-22T00:00:00.000Z","date_modified":"2026-06-17T00:55:29.000Z","tags":["kev","public-exploit"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2023-06-22","ransomware":false},"epss":{"score":0.87357,"percentile":0.99755},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox, Firefox ESR, and Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-26485","url":"https://patchfirst.co/cve/CVE-2022-26485/","title":"CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerability","content_text":"Mozilla · Firefox. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 14.3% (higher than 96.6% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.5 of 100.","summary":"Mozilla Firefox Use-After-Free Vulnerability","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2026-08-19T15:29:21.000Z","tags":["kev","public-exploit","T1189","T1203"],"_patchfirst":{"reason":"published","priority":68.5,"kev":{"dateAdded":"2022-03-07","ransomware":false},"epss":{"score":0.14261,"percentile":0.96592},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":["T1189","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-1802","url":"https://patchfirst.co/cve/CVE-2022-1802/","title":"CVE-2022-1802: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…","content_text":"Mozilla · Firefox ESR. Not in CISA KEV. EPSS 28.5% (higher than 98.1% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 67.2 of 100.","summary":"If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could…","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2025-04-16T15:17:14.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.2,"kev":null,"epss":{"score":0.28493,"percentile":0.98126},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox ESR","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-26486","url":"https://patchfirst.co/cve/CVE-2022-26486/","title":"CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerability","content_text":"Mozilla · Firefox. In CISA KEV since 2022-03-07. ENISA EUVD lists it as exploited. EPSS 2.4% (higher than 83.8% of CVEs). CVSS 9.6 CRITICAL. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1068 Exploitation for Privilege Escalation. Priority 66.5 of 100.","summary":"Mozilla Firefox Use-After-Free Vulnerability","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2026-08-19T15:29:21.000Z","tags":["kev","public-exploit","T1189","T1068"],"_patchfirst":{"reason":"published","priority":66.5,"kev":{"dateAdded":"2022-03-07","ransomware":false},"epss":{"score":0.02362,"percentile":0.83768},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":["T1189","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-28281","url":"https://patchfirst.co/cve/CVE-2022-28281/","title":"CVE-2022-28281: If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent…","content_text":"Mozilla · Thunderbird. Not in CISA KEV. EPSS 2.8% (higher than 86.4% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 65.0 of 100.","summary":"If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent…","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2025-04-15T20:09:53.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65,"kev":null,"epss":{"score":0.02781,"percentile":0.86361},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-1529","url":"https://patchfirst.co/cve/CVE-2022-1529/","title":"CVE-2022-1529: An attacker could have sent a message to the parent process where the contents were used to double-index into a…","content_text":"Mozilla · Firefox ESR. Not in CISA KEV. EPSS 17.6% (higher than 97.1% of CVEs). CVSS 8.8 HIGH. Priority 62.0 of 100.","summary":"An attacker could have sent a message to the parent process where the contents were used to double-index into a…","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2025-04-16T15:19:47.000Z","tags":[],"_patchfirst":{"reason":"published","priority":62,"kev":null,"epss":{"score":0.17608,"percentile":0.97144},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox ESR","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-1097","url":"https://patchfirst.co/cve/CVE-2022-1097/","title":"CVE-2022-1097: <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on…","content_text":"Mozilla · Thunderbird. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 6.5 MEDIUM. Priority 53.7 of 100.","summary":"<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on…","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2025-04-16T15:30:37.000Z","tags":[],"_patchfirst":{"reason":"published","priority":53.7,"kev":null,"epss":{"score":0.00952,"percentile":0.61288},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Mozilla","product":"Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-34478","url":"https://patchfirst.co/cve/CVE-2022-34478/","title":"CVE-2022-34478: The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.8% (higher than 56.6% of CVEs). CVSS 6.5 MEDIUM. Priority 52.2 of 100.","summary":"The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft…","date_published":"2022-12-22T00:00:00.000Z","date_modified":"2025-04-15T18:14:28.000Z","tags":[],"_patchfirst":{"reason":"published","priority":52.2,"kev":null,"epss":{"score":0.00801,"percentile":0.56582},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2015-4495#kev","url":"https://patchfirst.co/cve/CVE-2015-4495/","title":"[KEV] CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerability","content_text":"Mozilla · Firefox. In CISA KEV since 2022-05-25. ENISA EUVD lists it as exploited. EPSS 68.6% (higher than 99.34% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1005 Data from Local System. Priority 69.0 of 100.","summary":"Mozilla Firefox Security Feature Bypass Vulnerability","date_published":"2022-05-25T00:00:00.000Z","date_modified":"2026-06-17T00:27:24.000Z","tags":["kev","public-exploit","T1189","T1005"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2022-05-25","ransomware":false},"epss":{"score":0.68558,"percentile":0.99337},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":["T1189","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11708#kev","url":"https://patchfirst.co/cve/CVE-2019-11708/","title":"[KEV] CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 55.9% (higher than 99.04% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1068 Exploitation for Privilege Escalation. Priority 69.8 of 100.","summary":"Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability","date_published":"2022-05-23T00:00:00.000Z","date_modified":"2026-06-17T02:13:28.000Z","tags":["kev","public-exploit","T1068"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2022-05-23","ransomware":false},"epss":{"score":0.55874,"percentile":0.99043},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":["T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-11707#kev","url":"https://patchfirst.co/cve/CVE-2019-11707/","title":"[KEV] CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2022-05-23. ENISA EUVD lists it as exploited. EPSS 38.0% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.9 of 100.","summary":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","date_published":"2022-05-23T00:00:00.000Z","date_modified":"2026-06-17T02:13:28.000Z","tags":["kev","public-exploit","T1189","T1203"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2022-05-23","ransomware":false},"epss":{"score":0.37951,"percentile":0.98547},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":["T1189","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2013-1690#kev","url":"https://patchfirst.co/cve/CVE-2013-1690/","title":"[KEV] CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2022-03-28. ENISA EUVD lists it as exploited. EPSS 69.0% (higher than 99.35% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1059 Command and Scripting Interpreter; T1499 Endpoint Denial of Service. Priority 69.0 of 100.","summary":"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","date_published":"2022-03-28T00:00:00.000Z","date_modified":"2026-06-16T23:51:55.000Z","tags":["kev","public-exploit","T1189","T1059","T1499"],"_patchfirst":{"reason":"kev","priority":69,"kev":{"dateAdded":"2022-03-28","ransomware":false},"epss":{"score":0.69021,"percentile":0.9935},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":["T1189","T1059","T1499"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2013-1675#kev","url":"https://patchfirst.co/cve/CVE-2013-1675/","title":"[KEV] CVE-2013-1675: Mozilla Firefox Information Disclosure Vulnerability","content_text":"Mozilla · Firefox. In CISA KEV since 2022-03-03. ENISA EUVD lists it as exploited. EPSS 6.7% (higher than 93.9% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1005 Data from Local System. Priority 66.3 of 100.","summary":"Mozilla Firefox Information Disclosure Vulnerability","date_published":"2022-03-03T00:00:00.000Z","date_modified":"2026-06-16T23:51:53.000Z","tags":["kev","public-exploit","T1189","T1005"],"_patchfirst":{"reason":"kev","priority":66.3,"kev":{"dateAdded":"2022-03-03","ransomware":false},"epss":{"score":0.06696,"percentile":0.93902},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Mozilla","product":"Firefox","techniqueIds":["T1189","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-17026#kev","url":"https://patchfirst.co/cve/CVE-2019-17026/","title":"[KEV] CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 46.3% (higher than 98.8% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1189 Drive-by Compromise; T1203 Exploitation for Client Execution. Priority 68.9 of 100.","summary":"Mozilla Firefox And Thunderbird Type Confusion Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:23:11.000Z","tags":["kev","public-exploit","T1059","T1189","T1203"],"_patchfirst":{"reason":"kev","priority":68.9,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.46311,"percentile":0.98816},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":["T1059","T1189","T1203"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-6819#kev","url":"https://patchfirst.co/cve/CVE-2020-6819/","title":"[KEV] CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 3.0% (higher than 87.5% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 66.2 of 100.","summary":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:23:51.000Z","tags":["kev","public-exploit"],"_patchfirst":{"reason":"kev","priority":66.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.03039,"percentile":0.87497},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-6820#kev","url":"https://patchfirst.co/cve/CVE-2020-6820/","title":"[KEV] CVE-2020-6820: Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","content_text":"Mozilla · Firefox and Thunderbird. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 7.1% (higher than 94.2% of CVEs). CVSS 8.1 HIGH. Priority 62.5 of 100.","summary":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:23:51.000Z","tags":["kev"],"_patchfirst":{"reason":"kev","priority":62.5,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.07063,"percentile":0.94199},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"Mozilla","product":"Firefox and Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-23957","url":"https://patchfirst.co/cve/CVE-2021-23957/","title":"CVE-2021-23957: Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.8% (higher than 56.3% of CVEs). Priority 46.3 of 100.","summary":"Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox","date_published":"2021-02-26T00:00:00.000Z","date_modified":"2024-08-03T19:14:09.000Z","tags":[],"_patchfirst":{"reason":"published","priority":46.3,"kev":null,"epss":{"score":0.00793,"percentile":0.56331},"cvss":null,"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-15654","url":"https://patchfirst.co/cve/CVE-2020-15654/","title":"CVE-2020-15654: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is…","content_text":"Mozilla · Firefox ESR. Not in CISA KEV. EPSS 1.4% (higher than 72.9% of CVEs). Priority 49.6 of 100.","summary":"When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is…","date_published":"2020-08-10T00:00:00.000Z","date_modified":"2024-08-04T13:22:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":49.6,"kev":null,"epss":{"score":0.01423,"percentile":0.72866},"cvss":null,"vendor":"Mozilla","product":"Firefox ESR","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-6808","url":"https://patchfirst.co/cve/CVE-2020-6808/","title":"CVE-2020-6808: When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 1.1% (higher than 65.7% of CVEs). Priority 13.1 of 100.","summary":"When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML…","date_published":"2020-03-25T00:00:00.000Z","date_modified":"2024-08-04T09:11:05.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.1,"kev":null,"epss":{"score":0.01103,"percentile":0.65713},"cvss":null,"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-11695","url":"https://patchfirst.co/cve/CVE-2019-11695/","title":"CVE-2019-11695: A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 0.7% (higher than 54.4% of CVEs). Priority 45.9 of 100.","summary":"A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when…","date_published":"2019-07-23T00:00:00.000Z","date_modified":"2024-08-04T23:03:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":45.9,"kev":null,"epss":{"score":0.00733,"percentile":0.5435},"cvss":null,"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-9810","url":"https://patchfirst.co/cve/CVE-2019-9810/","title":"CVE-2019-9810: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 27.2% (higher than 98.1% of CVEs). Public exploit code exists. Priority 61.2 of 100.","summary":"Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds…","date_published":"2019-04-26T00:00:00.000Z","date_modified":"2024-08-04T22:01:54.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":61.2,"kev":null,"epss":{"score":0.27207,"percentile":0.98051},"cvss":null,"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-9806","url":"https://patchfirst.co/cve/CVE-2019-9806/","title":"CVE-2019-9806: A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed…","content_text":"Mozilla · Firefox. Not in CISA KEV. EPSS 1.1% (higher than 65.1% of CVEs). Priority 48.0 of 100.","summary":"A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed…","date_published":"2019-04-26T00:00:00.000Z","date_modified":"2024-08-04T22:01:54.000Z","tags":[],"_patchfirst":{"reason":"published","priority":48,"kev":null,"epss":{"score":0.01081,"percentile":0.65112},"cvss":null,"vendor":"Mozilla","product":"Firefox","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-9791","url":"https://patchfirst.co/cve/CVE-2019-9791/","title":"CVE-2019-9791: The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects…","content_text":"Mozilla · Thunderbird. Not in CISA KEV. EPSS 19.9% (higher than 97.4% of CVEs). Public exploit code exists. Priority 24.5 of 100.","summary":"The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects…","date_published":"2019-04-26T00:00:00.000Z","date_modified":"2024-08-04T22:01:54.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":24.5,"kev":null,"epss":{"score":0.19915,"percentile":0.97424},"cvss":null,"vendor":"Mozilla","product":"Thunderbird","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}