SEC.co
Emergency

By vendor

Mozilla vulnerabilities

Known CVEs affecting Mozilla products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-10701HIGH 7.5

    Firefox's text rendering engine contains a flaw in how it validates memory boundaries when processing text data. An attacker on the network can exploit this without requiring user interaction or special permissions, allowing them to read sensitive information from the browser's memory. The vulnerability affects Firefox versions prior to 151.0.3.

  • CVE-2026-9308MEDIUM 5.4

    Firefox for iOS Reader View had a template injection vulnerability where malicious web pages could exploit the order of placeholder substitution to inject JavaScript. When the app converted page content into Reader View, it processed user-controlled content before handling internal JSON-LD data placeholders. An attacker could craft a webpage with a specially-formatted string that, after substitution, becomes executable JavaScript code. This requires user interaction—the victim must open the malicious page and enable Reader View.

  • CVE-2026-9309MEDIUM 5.4

    Firefox for iOS Reader View had a vulnerability that failed to properly sanitize HTML tags embedded in JSON-LD metadata on web pages. An attacker could craft a malicious website that injects markup into Reader View, disrupting its normal behavior and extracting sensitive URL parameters—such as authentication tokens or session identifiers—that users might not realize were being exposed. In certain scenarios, this could allow an attacker to redirect those parameters toward internal endpoints, potentially enabling arbitrary JavaScript execution within a privileged origin. Mozilla fixed this issue in Firefox for iOS version 151.2.

  • CVE-2026-10702MEDIUM 4.3

    A flaw in Firefox's JavaScript Just-In-Time (JIT) compiler can cause it to miscompile code in certain circumstances. When a user visits a malicious website, the affected browser may crash or become unstable due to incorrect code generation during compilation. This is not a memory corruption issue and does not allow attackers to steal data or take control of the system, but it does impact availability and user experience.