BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Firefox ESR 153.6

MFSA2026-120 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-120. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

145 lines
All 145 CVEs 145 Additional recognition 0 Unclaimed only
Showing 101–145 of 145 matching , page 3 of 3 , clear filters
CVE-2026-117959 BR2026-0000-036928 unclaimed
Moderate: Site isolation issue in the DOM: Service Workers component
Credited as Muhammad Ali
CVE-2026-117960 BR2026-0000-036929 unclaimed
Moderate: Spoofing issue in the DOM: Core & HTML component
Credited as Mohamed Mbarek
CVE-2026-117961 BR2026-0000-036930 unclaimed
Moderate: Incorrect boundary conditions in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117962 BR2026-0000-036931 unclaimed
Moderate: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component
Credited as Mozilla
CVE-2026-117963 BR2026-0000-036932 unclaimed
Moderate: Incorrect boundary conditions in the DOM: Service Workers component
Credited as Mozilla
CVE-2026-117964 BR2026-0000-036933 unclaimed
Moderate: Use-after-free in the Panning and Zooming component
Credited as Mozilla
CVE-2026-117965 BR2026-0000-036934 unclaimed
Moderate: Same-origin policy bypass in the Address Bar component
Credited as Takashi Suzuki
CVE-2026-117966 BR2026-0000-036935 unclaimed
Moderate: Site isolation issue in the Networking: HTTP component
Credited as Mozilla
CVE-2026-117967 BR2026-0000-036936 unclaimed
Moderate: Mitigation bypass in the DOM: Security component
Credited as Nguyen Tuan Hung
CVE-2026-117968 BR2026-0000-036937 unclaimed
Moderate: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117969 BR2026-0000-036938 unclaimed
Moderate: Invalid pointer in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117970 BR2026-0000-036939 unclaimed
Moderate: Race condition in the Disability Access APIs component
Credited as Nguyen Thanh Nguyen
CVE-2026-117971 BR2026-0000-036940 unclaimed
Moderate: Sandbox escape due to use-after-free in the Print Preview component
Credited as Mozilla
CVE-2026-117972 BR2026-0000-036941 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-117973 BR2026-0000-036942 unclaimed
Moderate: Use-after-free in the Networking: DNS component
Credited as Mozilla
CVE-2026-117974 BR2026-0000-036943 unclaimed
Moderate: Use-after-free in the XML component
Credited as Mozilla
CVE-2026-117975 BR2026-0000-036944 unclaimed
Moderate: Sandbox escape due to invalid pointer in the Graphics: WebRender component
Credited as Mozilla
CVE-2026-117976 BR2026-0000-036945 unclaimed
Moderate: Site isolation issue in the DOM: Navigation component
Credited as Shu Takahashi of Velcore Consulting Inc.
CVE-2026-117977 BR2026-0000-036946 unclaimed
Moderate: Other issue in the Console component
Credited as quanhx
CVE-2026-117978 BR2026-0000-036947 unclaimed
Moderate: Incorrect boundary conditions in the Graphics component
Credited as Mozilla
CVE-2026-117979 BR2026-0000-036948 unclaimed
Moderate: Incorrect boundary conditions in the Graphics: WebRender component
Credited as Mozilla
CVE-2026-117980 BR2026-0000-036949 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Massimo Palozzi
CVE-2026-117981 BR2026-0000-036950 unclaimed
Moderate: Privilege escalation in the Toolkit component
Credited as Mozilla
CVE-2026-117982 BR2026-0000-036951 unclaimed
Moderate: Invalid pointer in the JavaScript Engine: JIT component
Credited as Mozilla
CVE-2026-117983 BR2026-0000-036952 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-117984 BR2026-0000-036953 unclaimed
Moderate: Incorrect boundary conditions in the Layout: Scrolling and Overflow component
Credited as Mozilla
CVE-2026-117985 BR2026-0000-036954 unclaimed
Moderate: Sandbox escape due to use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-117986 BR2026-0000-036955 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-117987 BR2026-0000-036956 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Mozilla
CVE-2026-117988 BR2026-0000-036957 unclaimed
Moderate: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Credited as Mozilla
CVE-2026-117989 BR2026-0000-036958 unclaimed
Moderate: Use-after-free in the Graphics component
Credited as Nguyen Tuan Hung
CVE-2026-117990 BR2026-0000-036959 unclaimed
Moderate: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
Credited as Mozilla
CVE-2026-117991 BR2026-0000-036960 unclaimed
Moderate: Incorrect boundary conditions in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117992 BR2026-0000-036961 unclaimed
Moderate: Information disclosure in the CSS Parsing and Computation component
Credited as Takashi Suzuki
CVE-2026-117993 BR2026-0000-036962 unclaimed
Moderate: Integer overflow in the Graphics: Text component
Credited as 5up3rh3i
CVE-2026-117994 BR2026-0000-036963 unclaimed
Moderate: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117995 BR2026-0000-036964 unclaimed
Moderate: Privilege escalation in the DOM: UI Events & Focus Handling component
Credited as haruka yamazaki
CVE-2026-117996 BR2026-0000-036965 unclaimed
Moderate: Incorrect boundary conditions in the WebRTC component
Credited as Mozilla
CVE-2026-117997 BR2026-0000-036966 unclaimed
Moderate: Sandbox escape due to use-after-free in the Widget component
Credited as Mozilla
CVE-2026-117998 BR2026-0000-036967 unclaimed
Low: Mitigation bypass in the DOM: Push Subscriptions component
Credited as Ibuki Sato
CVE-2026-117999 BR2026-0000-036968 unclaimed
Low: Race condition in the IPC component
Credited as Mozilla
CVE-2026-118000 BR2026-0000-036969 unclaimed
Low: Information disclosure in the Networking: HTTP component
Credited as Mozilla
CVE-2026-118002 BR2026-0000-036970 unclaimed
Low: Information disclosure due to race condition in the Networking component
Credited as Abdulrahman Alzahrani
CVE-2026-118003 BR2026-0000-036971 unclaimed
Low: Information disclosure in the Networking: DNS component
Credited as eldjiikgull
CVE-2026-118004 BR2026-0000-036972 unclaimed
Low: Incorrect boundary conditions in the CSS Transitions and Animations component
Credited as Mozilla