Vulnerabilities across Mozilla Firefox, Thunderbird, and the shared Gecko/SpiderMonkey stack — the Mozilla Foundation Security Advisories (MFSA) cadence, browser-sandbox escapes, and the JavaScript-engine bugs that Pwn2Own and in-the-wild attackers keep finding. Combined article + CVE feed for the Mozilla beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2010-3765/https://0daynews.com/cve/cve-2010-3765/Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.Thu, 03 Sep 2026 00:00:00 GMTMozillacriticalcvehttps://0daynews.com/cve/cve-2013-1675/https://0daynews.com/cve/cve-2013-1675/Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.Thu, 03 Sep 2026 00:00:00 GMTMozillamediumcvehttps://0daynews.com/cve/cve-2013-1690/https://0daynews.com/cve/cve-2013-1690/Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2015-4495/https://0daynews.com/cve/cve-2015-4495/Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2016-9079/https://0daynews.com/cve/cve-2016-9079/Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2019-11707/https://0daynews.com/cve/cve-2019-11707/Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2019-11708/https://0daynews.com/cve/cve-2019-11708/Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.Thu, 03 Sep 2026 00:00:00 GMTMozillacriticalcvehttps://0daynews.com/cve/cve-2019-17026/https://0daynews.com/cve/cve-2019-17026/Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2020-6819/https://0daynews.com/cve/cve-2020-6819/Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2020-6820/https://0daynews.com/cve/cve-2020-6820/Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2022-26485/https://0daynews.com/cve/cve-2022-26485/Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.Thu, 03 Sep 2026 00:00:00 GMTMozillahighcvehttps://0daynews.com/cve/cve-2022-26486/https://0daynews.com/cve/cve-2022-26486/Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.Thu, 03 Sep 2026 00:00:00 GMTMozillacriticalcvehttps://0daynews.com/cve/cve-2024-9680/https://0daynews.com/cve/cve-2024-9680/Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.Thu, 03 Sep 2026 00:00:00 GMTMozillacriticalcvehttps://0daynews.com/cve/cve-2026-10702/https://0daynews.com/cve/cve-2026-10702/A JIT miscompilation in Firefox's JavaScript engine allows attackers to execute code in the browser renderer via a malicious webpage. Fixed in Firefox 151.0.3; also affected Tor Browser.Thu, 03 Sep 2026 00:00:00 GMTMozillamediumcvehttps://0daynews.com/cve/cve-2026-15718/https://0daynews.com/cve/cve-2026-15718/An invalid-pointer flaw in Firefox's JavaScript / WebAssembly component. Mozilla notes exploit code is public but no in-the-wild attacks are confirmed. Fixed in Firefox 152.0.6.Thu, 03 Sep 2026 00:00:00 GMTMozillamediumcvehttps://0daynews.com/cve/cve-2026-15719/https://0daynews.com/cve/cve-2026-15719/A site-isolation flaw in Firefox's DOM Navigation component. Mozilla notes exploit code is public but no in-the-wild attacks are confirmed. Fixed in Firefox 152.0.6.Thu, 03 Sep 2026 00:00:00 GMTMozillamediumcvehttps://0daynews.com/articles/2026-07-29-firefox-jit-cve-2026-10702-tor-browser/https://0daynews.com/articles/2026-07-29-firefox-jit-cve-2026-10702-tor-browser/CVE-2026-10702: a Firefox JIT miscompilation allowing renderer code execution via a single webpage visit. Fixed in Firefox 151.0.3; Tor Browser also affected.Wed, 29 Jul 2026 09:00:00 GMTMozillaarticlehttps://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/https://0daynews.com/articles/2026-07-15-mozilla-firefox-exploit-public-chrome-adobe-coldfusion-patch-day/Mozilla says exploit code is public for two Firefox flaws fixed in 152.0.6. Chrome shipped Ozone use-after-free fixes; Adobe pushed 8 ColdFusion criticals.Wed, 15 Jul 2026 15:15:00 GMTMozillaarticle