PatchFirst · Latest vulnerabilities

mozjs38 vulnerabilities · Page 39

Vulnerabilities published for mozjs38 in the last 30 days: 257. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1740

CVE-2026-2793
Critical · CVSS 9.8EPSS 0.38%No fix published
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2792
Critical · CVSS 9.8EPSS 0.38%No fix published
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2791
Critical · CVSS 9.8EPSS 0.6%No fix published
Mitigation bypass in the Networking: Cache component
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2790
High · CVSS 8.8EPSS 0.25%No fix published
Same-origin policy bypass in the Networking: JAR component
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2789
High · CVSS 8.8EPSS 0.53%No fix published
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2788
Critical · CVSS 9.8EPSS 0.68%No fix published
Incorrect boundary conditions in the Audio/Video: GMP component
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2787
High · CVSS 8.8EPSS 0.64%No fix published
Use-after-free in the DOM: Window and Location component
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2786
High · CVSS 8.8EPSS 0.51%No fix published
Use-after-free in the JavaScript Engine component
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated May 10, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2785
High · CVSS 8.8EPSS 0.58%No fix published
Invalid pointer in the JavaScript Engine component
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2784
Critical · CVSS 9.8EPSS 0.49%No fix published
Mitigation bypass in the DOM: Security component
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2783
Medium · CVSS 6.5EPSS 0.34%No fix published
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2782
High · CVSS 8.8EPSS 0.34%No fix published
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2780
High · CVSS 8.8EPSS 0.4%No fix published
Privilege escalation in the Netmonitor component
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 13, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2779
Critical · CVSS 9.8EPSS 0.69%No fix published
Incorrect boundary conditions in the Networking: JAR component
Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated April 16, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2778
Critical · CVSS 10EPSS 0.56%No fix published
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2777
Critical · CVSS 9.8EPSS 0.44%No fix published
Privilege escalation in the Messaging System component
Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2776
Critical · CVSS 10EPSS 0.56%No fix published
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2775
Critical · CVSS 9.8EPSS 0.84%No fix published
Mitigation bypass in the DOM: HTML Parser component
Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2774
High · CVSS 8.8EPSS 0.85%No fix published
Integer overflow in the Audio/Video component
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-2773
Critical · CVSS 9.8EPSS 0.92%No fix published
Incorrect boundary conditions in the Web Audio component
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
mozjs38 Operating systems
Published February 24, 2026Updated July 15, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

mozjs38 vulnerabilities · Page 39

Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Mitigation bypass in the Networking: Cache component

Same-origin policy bypass in the Networking: JAR component

Use-after-free in the Graphics: ImageLib component

Incorrect boundary conditions in the Audio/Video: GMP component

Use-after-free in the DOM: Window and Location component

Use-after-free in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component

Mitigation bypass in the DOM: Security component

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

Privilege escalation in the Netmonitor component

Privilege escalation in the Netmonitor component

Incorrect boundary conditions in the Networking: JAR component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Privilege escalation in the Messaging System component

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Check your server