CVE Tools
Track your stack

Firefox

3,594 CVEs tracked. 15 of them are in CISA KEV.

This hub aggregates every CVE we track for Firefox, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Firefox CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Firefox CVEs per month
MonthCVEs
2024-1120
2024-120
2025-0114
2025-0212
2025-0318
2025-0422
2025-0513
2025-0615
2025-0717
2025-0819
2025-0914
2025-1016
2025-1116
2025-1216
2026-0118
2026-0254
2026-0348
2026-0451
2026-0543
2026-0647
2026-0767
2026-0859
2026-09181
2026-1084

Severity

How the 3,594 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical99128%
  • High1,13332%
  • Medium1,39239%
  • Low712%

Latest CVEs

The 15 most recently published vulnerabilities affecting Firefox.

  1. CVE-2026-113401Denial-of-service in the PDF Viewer component6.5
  2. CVE-2026-113400Uninitialized memory in the Audio/Video: cubeb component5.4
  3. CVE-2026-113399Incorrect boundary conditions in the SVG component—
  4. CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State component5.4
  5. CVE-2026-109782Mitigation bypass in the File Handling component—
  6. CVE-2026-109783Mitigation bypass in the File Handling component—
  7. CVE-2026-109779Race condition in the Networking: DNS component4.2
  8. CVE-2026-109780Mitigation bypass in the DOM: Core & HTML component—
  9. CVE-2026-109781Denial-of-service in the Printing: Output component6.5
  10. CVE-2026-109778Privilege escalation in the WebExtensions component8.8
  11. CVE-2026-109776Race condition in the XPCOM component4.2
  12. CVE-2026-109773Denial-of-service in the Sync component6.5
  13. CVE-2026-109774Invalid pointer, undefined behavior in the DOM: Notifications component—
  14. CVE-2026-109777Information disclosure in the Storage: IndexedDB component4.3
  15. CVE-2026-109775Denial-of-service in the WebRTC component6.5

Product grouping is registry-driven, with AI assist and human review. How it works