Thunderbird

Multiple vulnerabilities in Mozilla Firefox, Firefox ESR, and Thunderbird could allow a remote attacker to execute arbitrary code, disclose information, bypass security restrictions, deceive the user, escalate privileges, or cause a denial-of-service condition.

Multiple vulnerabilities exist in Mozilla Firefox, Firefox ESR, and Thunderbird that could allow a remote attacker to execute arbitrary code, disclose sensitive information, bypass security measures, or conduct cross-site scripting or spoofing attacks.

Firefox 148 and Thunderbird 148 contain memory safety bugs that could potentially be exploited to execute arbitrary code, impacting versions prior to 149.

A memory safety vulnerability (CVE-2026-4720) in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 could lead to memory corruption and potential arbitrary code execution if successfully exploited.

A use-after-free vulnerability, CVE-2026-4723, in the JavaScript Engine of Mozilla Firefox and Thunderbird before version 149 could allow arbitrary code execution if successfully exploited by an attacker.

A use-after-free vulnerability in the Canvas2D component of Mozilla Firefox and Thunderbird versions before 149 allows for a potential sandbox escape.

CVE-2026-4715 is a critical vulnerability involving uninitialized memory in the Graphics: Canvas2D component of Firefox, Firefox ESR, and Thunderbird, potentially leading to information disclosure or arbitrary code execution.

CVE-2026-4719 describes an incorrect boundary condition in the Graphics: Text component of Mozilla Firefox and Thunderbird, potentially leading to a denial-of-service condition in vulnerable versions.

CVE-2026-4717 is a critical privilege escalation vulnerability in the Netmonitor component of Firefox, Firefox ESR, and Thunderbird, potentially allowing an attacker to gain elevated privileges on a vulnerable system.

CVE-2026-4704 is a denial-of-service vulnerability in the WebRTC Signaling component affecting Firefox, Firefox ESR, and Thunderbird, potentially disrupting service availability.

CVE-2026-4700 is a critical vulnerability in the Networking: HTTP component of Firefox, Firefox ESR, and Thunderbird, allowing a mitigation bypass in versions prior to Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

An incorrect boundary condition in the Audio/Video Web Codecs component in Mozilla Firefox and Thunderbird (CVE-2026-4695) could lead to a denial-of-service (DoS) condition due to a vulnerability that affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

CVE-2026-4697 is a denial-of-service vulnerability due to incorrect boundary conditions in the Audio/Video Web Codecs component of Mozilla Firefox and Thunderbird, potentially leading to application crashes.

CVE-2026-4693 is a vulnerability due to incorrect boundary conditions in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird, potentially leading to a denial-of-service condition.

A critical JIT miscompilation vulnerability (CVE-2026-4698) in the JavaScript engine affects Firefox and Thunderbird, potentially leading to remote code execution.

An improper boundary condition vulnerability in the Canvas2D component of Mozilla Firefox, Firefox ESR, and Thunderbird (CVE-2026-4685) could allow for a denial-of-service condition.

CVE-2026-4687 is a sandbox escape vulnerability in Firefox and Thunderbird due to incorrect boundary conditions in the Telemetry component, potentially allowing an attacker to execute arbitrary code outside the sandbox.

CVE-2026-4714 is a high-severity vulnerability affecting Firefox, Firefox ESR, and Thunderbird due to incorrect boundary conditions in the Audio/Video component, potentially leading to denial-of-service.

A vulnerability exists in the Audio/Video: GMP component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions, potentially leading to a denial-of-service condition.

CVE-2026-4712 is an information disclosure vulnerability in the Widget: Cocoa component affecting Firefox versions less than 149, Firefox ESR versions less than 140.9, Thunderbird versions less than 149, and Thunderbird versions less than 140.9, potentially allowing a remote attacker to access sensitive information.

CVE-2026-4686 is a high-severity vulnerability due to incorrect boundary conditions in the Canvas2D component of Mozilla Firefox and Thunderbird, potentially leading to a denial-of-service condition.

CVE-2026-4713 is a high-severity vulnerability due to incorrect boundary conditions in the Graphics component of Mozilla Firefox, Firefox ESR, and Thunderbird, potentially leading to denial of service.

CVE-2026-4708 is a high-severity vulnerability involving incorrect boundary conditions in the Graphics component, impacting Firefox versions earlier than 149, Firefox ESR versions before 140.9, Thunderbird versions before 149, and Thunderbird versions prior to 140.9, potentially leading to a denial-of-service.

CVE-2026-4684 is a race condition and use-after-free vulnerability in the Graphics: WebRender component affecting Firefox versions less than 149, Firefox ESR versions less than 115.34 and 140.9, and Thunderbird versions less than 149 and 140.9, potentially leading to arbitrary code execution.

A critical JIT miscompilation vulnerability (CVE-2026-4702) in the JavaScript Engine affects Firefox and Thunderbird, potentially allowing remote code execution.

An undefined behavior vulnerability in the WebRTC signaling component affects Mozilla Firefox and Thunderbird, potentially leading to arbitrary code execution.

A use-after-free vulnerability in the Widget: Cocoa component of Mozilla Firefox (versions less than 149), Firefox ESR (less than 140.9), Thunderbird (less than 149), and Thunderbird (less than 140.9) could lead to arbitrary code execution.

CVE-2026-4699 describes an improper check for unusual or exceptional conditions in the Layout: Text and Fonts component of Mozilla Firefox and Thunderbird leading to a potential denial-of-service.

CVE-2026-4722 is a privilege escalation vulnerability in the IPC component of Mozilla Firefox and Thunderbird versions less than 149, potentially allowing an attacker to gain elevated privileges on a compromised system.

A use-after-free vulnerability (CVE-2026-4691) in the CSS Parsing and Computation component affects Firefox versions prior to 149, Firefox ESR versions prior to 115.34 and 140.9, and Thunderbird versions prior to 149 and 140.9, potentially leading to arbitrary code execution.