{"meta":{"title":"KEV entries: Mozilla","description":"All KEV entries for vendor Mozilla.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":13,"vendor":"Mozilla","entries":13,"shareOfCatalogPercent":0.8,"ransomwareKnown":1,"firstDateAdded":"2021-11-03","latestDateAdded":"2025-10-06","rank":21},"data":[{"cveID":"CVE-2010-3765","vendorProject":"Mozilla","product":"Multiple Products","vulnerabilityName":"Mozilla Multiple Products Remote Code Execution Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2010-73 ; https://nvd.nist.gov/vuln/detail/CVE-2010-3765","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2010-3765"},{"cveID":"CVE-2024-9680","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Use-After-Free Vulnerability","dateAdded":"2024-10-15","dueDate":"2024-11-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-9680"},{"cveID":"CVE-2016-9079","vendorProject":"Mozilla","product":"Firefox, Firefox ESR, and Thunderbird","vulnerabilityName":"Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability","dateAdded":"2023-06-22","dueDate":"2023-07-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079; https://nvd.nist.gov/vuln/detail/CVE-2016-9079","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2016-9079"},{"cveID":"CVE-2015-4495","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Security Feature Bypass Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-200"],"shortDescription":"Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-4495","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-4495"},{"cveID":"CVE-2019-11708","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11708","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-11708"},{"cveID":"CVE-2019-11707","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-11707"},{"cveID":"CVE-2013-1690","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-1690","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-1690"},{"cveID":"CVE-2022-26486","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Use-After-Free Vulnerability","dateAdded":"2022-03-07","dueDate":"2022-03-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26486","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26486"},{"cveID":"CVE-2022-26485","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Use-After-Free Vulnerability","dateAdded":"2022-03-07","dueDate":"2022-03-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26485","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26485"},{"cveID":"CVE-2013-1675","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Information Disclosure Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-119"],"shortDescription":"Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-1675","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-1675"},{"cveID":"CVE-2020-6820","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-362"],"shortDescription":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6820","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-6820"},{"cveID":"CVE-2020-6819","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox And Thunderbird Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-362","CWE-416"],"shortDescription":"Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-6819","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-6819"},{"cveID":"CVE-2019-17026","vendorProject":"Mozilla","product":"Firefox and Thunderbird","vulnerabilityName":"Mozilla Firefox And Thunderbird Type Confusion Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-843"],"shortDescription":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-17026","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-17026"}]}