BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox ESR 153.6

MFSA2026-120 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-120. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

145 lines
All 145 CVEs 145 Additional recognition 0 Unclaimed only
Showing 51–100 of 145 , page 2 of 3
CVE-2026-117910 BR2026-0000-036878 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117911 BR2026-0000-036879 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117912 BR2026-0000-036880 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Takashi Suzuki
CVE-2026-117913 BR2026-0000-036881 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117914 BR2026-0000-036882 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117915 BR2026-0000-036883 unclaimed
High: Incorrect boundary conditions in the Layout: Block and Inline component
Credited as Mozilla
CVE-2026-117916 BR2026-0000-036884 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117917 BR2026-0000-036885 unclaimed
High: Invalid pointer in the Graphics: WebRender component
Credited as Nguyen Tuan Hung
CVE-2026-117918 BR2026-0000-036886 unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117919 BR2026-0000-036887 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117920 BR2026-0000-036888 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Mozilla
CVE-2026-117921 BR2026-0000-036889 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117922 BR2026-0000-036890 unclaimed
High: Use-after-free in the Networking: WebSockets component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117923 BR2026-0000-036891 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117924 BR2026-0000-036892 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117925 BR2026-0000-036893 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117926 BR2026-0000-036894 unclaimed
High: Incorrect boundary conditions in the SVG component
Credited as Mozilla
CVE-2026-117927 BR2026-0000-036895 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117928 BR2026-0000-036896 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Minseong Kim
CVE-2026-117929 BR2026-0000-036897 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117930 BR2026-0000-036898 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117931 BR2026-0000-036899 unclaimed
High: Use-after-free in the DOM: Events component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117932 BR2026-0000-036900 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117933 BR2026-0000-036901 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117934 BR2026-0000-036902 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117935 BR2026-0000-036903 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117936 BR2026-0000-036904 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117937 BR2026-0000-036905 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117938 BR2026-0000-036906 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117939 BR2026-0000-036907 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117940 BR2026-0000-036908 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117941 BR2026-0000-036909 unclaimed
High: Use-after-free in the DOM: CSS Object Model component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117942 BR2026-0000-036910 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117943 BR2026-0000-036911 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117944 BR2026-0000-036912 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117945 BR2026-0000-036913 unclaimed
High: Incorrect boundary conditions in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117946 BR2026-0000-036914 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117947 BR2026-0000-036915 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117948 BR2026-0000-036916 unclaimed
High: Use-after-free in the SVG component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117949 BR2026-0000-036917 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117950 BR2026-0000-036918 unclaimed
High: Incorrect boundary conditions in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117951 BR2026-0000-036919 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117952 BR2026-0000-036920 unclaimed
High: Uninitialized memory in the Networking component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117953 BR2026-0000-036921 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117954 BR2026-0000-036922 unclaimed
High: Use-after-free in the Layout: Positioned component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117955 BR2026-0000-036923 unclaimed
Moderate: JIT miscompilation in the JavaScript: WebAssembly component
Credited as Mozilla
CVE-2026-100801 BR2026-0000-036924 unclaimed
Moderate: Privilege escalation in the DLL Services component
Credited as Mozilla
CVE-2026-117956 BR2026-0000-036925 unclaimed
Moderate: Invalid pointer in the Nimbus Desktop Client component
Credited as Mozilla
CVE-2026-117957 BR2026-0000-036926 unclaimed
Moderate: Cryptographic issue in the WebRTC: Networking component
Credited as Mozilla
CVE-2026-117958 BR2026-0000-036927 unclaimed
Moderate: Site isolation issue in the Networking: HTTP component
Credited as Mozilla