CVE Tools
Track your stack

Firefox

3,762 CVEs tracked. 15 of them are in CISA KEV.

This hub aggregates every CVE we track for Firefox, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Firefox CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Firefox CVEs per month
MonthCVEs
2024-120
2025-0114
2025-0212
2025-0318
2025-0422
2025-0513
2025-0615
2025-0717
2025-0819
2025-0914
2025-1016
2025-1116
2025-1216
2026-0118
2026-0254
2026-0348
2026-0451
2026-0543
2026-0647
2026-0767
2026-0859
2026-09181
2026-10251
2026-111

Severity

How the 3,762 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical1,01227%
  • High1,24633%
  • Medium1,43338%
  • Low712%

Latest CVEs

The 15 most recently published vulnerabilities affecting Firefox.

  1. CVE-2026-120572Incorrect boundary conditions in the Layout: Block and Inline component8.8
  2. CVE-2026-118027Frame poisoning in the Layout component9.1
  3. CVE-2026-118024Use-after-free in the Graphics: Text component8.8
  4. CVE-2026-118025Other issue in the SVG component8.8
  5. CVE-2026-118026Invalid pointer in the JavaScript: GC component8.8
  6. CVE-2026-118022Sandbox escape due to use-after-free in the Disability Access APIs component8.8
  7. CVE-2026-118021Sandbox escape due to use-after-free in the XPCOM component8.8
  8. CVE-2026-118023Sandbox escape due to use-after-free in the Graphics: WebRender component8.8
  9. CVE-2026-118019Race condition, use-after-free in the DOM: File component8.8
  10. CVE-2026-118020Use-after-free in the Layout component8.8
  11. CVE-2026-118018Spoofing issue in the Downloads component in Firefox for Android8.8
  12. CVE-2026-118016Use-after-free in the DOM: Core & HTML component8.8
  13. CVE-2026-118017Use-after-free in the SVG component8.8
  14. CVE-2026-118014Use-after-free in the JavaScript Engine: JIT component8.8
  15. CVE-2026-118013Use-after-free in the Layout: Images, Video, and HTML Frames component8.8

Product grouping is registry-driven, with AI assist and human review. How it works