Mozilla flaws being used in attacks
CISA lists 13 flaws in Mozilla products as being used in attacks, most recently on 6 Oct 2025. 1 has been used in ransomware.
MozillaBeing used in attacks
- On CISA’s list
- 13 flaws, added between 3 Nov 2021 and 6 Oct 2025
- Most recent
- CVE-2010-3765, Mozilla Multiple Products Remote Code Execution Vulnerability, added 6 Oct 2025
- Used in ransomware
- 1 flaw, according to CISA
- Products
- Firefox and Thunderbird (6), Firefox (5), Firefox, Firefox ESR, and Thunderbird (1), Multiple Products (1)
What to do
- Update every Mozilla product you use.Install the updates Mozilla offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Mozilla Multiple Products
CVE-2010-3765Mozilla Multiple Products Remote Code Execution VulnerabilityMozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the appendChild method, incorrect index tracking, and the creation of multiple frames, which triggers memory corruption.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Mozilla Firefox
CVE-2024-9680Mozilla Firefox Use-After-Free VulnerabilityMozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Mozilla Firefox, Firefox ESR, and Thunderbird
CVE-2016-9079Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free VulnerabilityMozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox
CVE-2015-4495Mozilla Firefox Security Feature Bypass VulnerabilityMoxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2019-11708Mozilla Firefox and Thunderbird Sandbox Escape VulnerabilityMozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2019-11707Mozilla Firefox and Thunderbird Type Confusion VulnerabilityMozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2013-1690Mozilla Firefox and Thunderbird Denial-of-Service VulnerabilityMozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox
CVE-2022-26486Mozilla Firefox Use-After-Free VulnerabilityMozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox
CVE-2022-26485Mozilla Firefox Use-After-Free VulnerabilityMozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox
CVE-2013-1675Mozilla Firefox Information Disclosure VulnerabilityMozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2020-6820Mozilla Firefox And Thunderbird Use-After-Free VulnerabilityMozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2020-6819Mozilla Firefox And Thunderbird Use-After-Free VulnerabilityMozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.CISA’s required actionApply updates per vendor instructions. - Mozilla Firefox and Thunderbird
CVE-2019-17026Mozilla Firefox And Thunderbird Type Confusion VulnerabilityMozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Mozilla on CISA’s site.