ZeusQA
Start free

Known exploited vulnerabilities

Mozilla vulnerabilities attackers have used

Every Mozilla vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 13 Mozilla vulnerabilities as exploited in the wild, 0 of them added in the last 12 months and 1 used in ransomware campaigns. The most recent is CVE-2010-3765, added Oct 6, 2025. Firefox and Thunderbird has the most entries (6).

In KEV, all time
13
Added, last 12 months
0
Used in ransomware
1
New CVEs this week
0

By product

Firefox and Thunderbird (6), Firefox (5), Firefox, Firefox ESR, and Thunderbird (1), Multiple Products (1).

Every Mozilla entry in CISA KEV

  1. CVE-2010-3765

    Added · due

    Mozilla Multiple Products Remote Code Execution Vulnerability

    Mozilla Firefox, SeaMonkey, and Thunderbird contain an unspecified vulnerability when JavaScript is enabled. This allows remote attackers to execute arbitrary code via vectors related to nsCSSFrameConstructor::ContentAppended, the…

  2. CVE-2024-9680

    RansomwareAdded · due

    Mozilla Firefox Use-After-Free Vulnerability

    Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.

  3. CVE-2016-9079

    Added · due

    Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

    Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.

  4. CVE-2015-4495

    Added · due

    Mozilla Firefox Security Feature Bypass Vulnerability

    Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.

  5. CVE-2019-11708

    Added · due

    Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

    Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

  6. CVE-2019-11707

    Added · due

    Mozilla Firefox and Thunderbird Type Confusion Vulnerability

    Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

  7. CVE-2013-1690

    Added · due

    Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

    Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

  8. CVE-2022-26486

    Added · due

    Mozilla Firefox Use-After-Free Vulnerability

    Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.

  9. CVE-2022-26485

    Added · due

    Mozilla Firefox Use-After-Free Vulnerability

    Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.

  10. CVE-2013-1675

    Added · due

    Mozilla Firefox Information Disclosure Vulnerability

    Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a…

  11. CVE-2020-6820

    Added · due

    Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

    Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

  12. CVE-2020-6819

    Added · due

    Mozilla Firefox And Thunderbird Use-After-Free Vulnerability

    Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.

  13. CVE-2019-17026

    Added · due

    Mozilla Firefox And Thunderbird Type Confusion Vulnerability

    Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works