Mozilla Foundation Security Advisory 2026-121
Security Vulnerabilities fixed in Thunderbird 159
- Announced
- October 27, 2026
- Impact
- high
- Products
- Thunderbird
- Fixed in
-
- Thunderbird 159
Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-118174: Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
- Reporter
- Magnus Melin
- Impact
- high
Description
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking.
References
#CVE-2026-118175: Content of other messages could be included when replying to a crafted message
- Reporter
- YuYoung Sung
- Impact
- high
Description
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients.
References
#CVE-2026-118176: Bypass of remote UNC path restriction in mailbox: URLs
- Reporter
- YuYoung Sung
- Impact
- high
Description
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected.
References
#CVE-2026-118177: Calendar discovery accepted local file and remote network share locations
- Reporter
- Magnus Melin
- Impact
- high
Description
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file.
References
#CVE-2026-118178: RSS feed could redirect its subscription to a local file or network share
- Reporter
- KhalidAlharthi
- Impact
- high
Description
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only.
References
#CVE-2026-118179: Request forgery via news: links
- Reporter
- Nguyen Tuan Hung
- Impact
- moderate
Description
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS.
References
#CVE-2026-118180: Matrix homeserver could redirect the chat session to a local file or network share
- Reporter
- Magnus Melin
- Impact
- moderate
Description
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected.
References
#CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component
- Reporter
- satyamasd
- Impact
- high
References
#CVE-2026-117861: Sandbox escape in the DOM: Navigation component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117864: Sandbox escape in the Form Manager component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117865: Use-after-free in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117867: Use-after-free in the Layout component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117868: Sandbox escape in the DOM: Networking component
- Reporter
- Yaqoub Aldurayhim
- Impact
- high
References
#CVE-2026-117869: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117870: Use-after-free in the JavaScript Engine component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117871: Invalid pointer in the Graphics component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-118005: Use-after-free in the WebRTC: Signaling component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117874: Use-after-free in the Internationalization component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-118006: Privilege escalation due to use-after-free in the WebRTC: Signaling component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-118007: Use-after-free in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-118008: Privilege escalation in the DOM: Navigation component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-117880: Use-after-free in the XML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-118009: Integer overflow, use-after-free in the Graphics: Text component
- Reporter
- Nguyen Thanh Nguyen
- Impact
- high
References
#CVE-2026-117881: Use-after-free in the DOM: Core & HTML component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-117882: Use-after-free in the Layout component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-117883: Use-after-free in the DOM: HTML Parser component
- Reporter
- Amy Burnett of OpenAI
- Impact
- high
References
#CVE-2026-117884: Use-after-free in the Networking component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117885: Use-after-free in the Layout: Grid component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component
- Reporter
- tsui
- Impact
- high
References
#CVE-2026-117887: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-118010: Use-after-free in the Disability Access APIs component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component
- Reporter
- Minseong Kim
- Impact
- high
References
#CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117895: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117896: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117899: Use-after-free in the Networking: HTTP component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117900: Use-after-free in the DOM: Editor component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117901: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117903: Use-after-free in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117904: Use-after-free in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117905: Use-after-free in the Audio/Video: Playback component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117907: Use-after-free in the Networking component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117908: Use-after-free in the Graphics: ImageLib component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117909: Use-after-free in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117910: Invalid pointer in the JavaScript Engine component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117911: Use-after-free in the Audio/Video: Playback component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component
- Reporter
- Takashi Suzuki
- Impact
- high
References
#CVE-2026-117913: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117914: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117916: Use-after-free in the XSLT component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117917: Invalid pointer in the Graphics: WebRender component
- Reporter
- Nguyen Tuan Hung
- Impact
- high
References
#CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117919: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117920: Use-after-free in the DOM: HTML Parser component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117922: Use-after-free in the Networking: WebSockets component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117923: Use-after-free in the Audio/Video component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117924: Use-after-free in the XSLT component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117925: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117926: Incorrect boundary conditions in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117927: Use-after-free in the SVG component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component
- Reporter
- Minseong Kim
- Impact
- high
References
#CVE-2026-117929: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- high
References
#CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117931: Use-after-free in the DOM: Events component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117932: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117934: Use-after-free in the Layout component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118011: Frame poisoning in the CSS Parsing and Computation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118012: Use-after-free in the DOM: Animation component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117936: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117937: Invalid pointer in the JavaScript Engine component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117938: Use-after-free in the Layout component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117939: Use-after-free in the XML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117940: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118013: Use-after-free in the Layout: Images, Video, and HTML Frames component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118014: Use-after-free in the JavaScript Engine: JIT component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117943: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117944: Use-after-free in the Layout component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118015: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117945: Incorrect boundary conditions in the XML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118016: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117947: Use-after-free in the XML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117948: Use-after-free in the SVG component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117949: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117951: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117952: Uninitialized memory in the Networking component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117953: Use-after-free in the DOM: Core & HTML component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118017: Use-after-free in the SVG component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-117954: Use-after-free in the Layout: Positioned component
- Reporter
- OpenAI Codex Security (kylebot)
- Impact
- high
References
#CVE-2026-118019: Race condition, use-after-free in the DOM: File component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-100801: Privilege escalation in the DLL Services component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117958: Site isolation issue in the Networking: HTTP component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117959: Site isolation issue in the DOM: Service Workers component
- Reporter
- Muhammad Ali
- Impact
- moderate
References
#CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component
- Reporter
- Mohamed Mbarek
- Impact
- moderate
References
#CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117964: Use-after-free in the Panning and Zooming component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117965: Same-origin policy bypass in the Address Bar component
- Reporter
- Takashi Suzuki
- Impact
- moderate
References
#CVE-2026-117966: Site isolation issue in the Networking: HTTP component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117967: Mitigation bypass in the DOM: Security component
- Reporter
- Nguyen Tuan Hung
- Impact
- moderate
References
#CVE-2026-118020: Use-after-free in the Layout component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117968: Use-after-free in the DOM: Core & HTML component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117970: Race condition in the Disability Access APIs component
- Reporter
- Nguyen Thanh Nguyen
- Impact
- moderate
References
#CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117972: Use-after-free in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117973: Use-after-free in the Networking: DNS component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117974: Use-after-free in the XML component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117976: Site isolation issue in the DOM: Navigation component
- Reporter
- Shu Takahashi of Velcore Consulting Inc.
- Impact
- moderate
References
#CVE-2026-117977: Other issue in the Console component
- Reporter
- quanhx
- Impact
- moderate
References
#CVE-2026-117978: Incorrect boundary conditions in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117980: Use-after-free in the Graphics component
- Reporter
- Massimo Palozzi
- Impact
- moderate
References
#CVE-2026-117981: Privilege escalation in the Toolkit component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117983: Use-after-free in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-118022: Sandbox escape due to use-after-free in the Disability Access APIs component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117986: Use-after-free in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117987: Use-after-free in the Graphics component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117989: Use-after-free in the Graphics component
- Reporter
- Nguyen Tuan Hung
- Impact
- moderate
References
#CVE-2026-118023: Sandbox escape due to use-after-free in the Graphics: WebRender component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component
- Reporter
- Takashi Suzuki
- Impact
- moderate
References
#CVE-2026-117993: Integer overflow in the Graphics: Text component
- Reporter
- 5up3rh3i
- Impact
- moderate
References
#CVE-2026-117994: Use-after-free in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling component
- Reporter
- haruka yamazaki
- Impact
- moderate
References
#CVE-2026-117996: Incorrect boundary conditions in the WebRTC component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-118024: Use-after-free in the Graphics: Text component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-118025: Other issue in the SVG component
- Reporter
- Mozilla
- Impact
- moderate
References
#CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component
- Reporter
- Ibuki Sato
- Impact
- low
References
#CVE-2026-117999: Race condition in the IPC component
- Reporter
- Mozilla
- Impact
- low
References
#CVE-2026-118000: Information disclosure in the Networking: HTTP component
- Reporter
- Mozilla
- Impact
- low
References
#CVE-2026-118002: Information disclosure due to race condition in the Networking component
- Reporter
- Abdulrahman Alzahrani
- Impact
- low
References
#CVE-2026-118003: Information disclosure in the Networking: DNS component
- Reporter
- eldjiikgull
- Impact
- low
References
#CVE-2026-118026: Invalid pointer in the JavaScript: GC component
- Reporter
- Mozilla
- Impact
- low
References
#CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component
- Reporter
- Mozilla
- Impact
- low