Mozilla — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Mozilla with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 13 Mozilla vulnerabilities confirmed as exploited in the wild across 4 products; 1 of them (7.7%) is flagged as used in known ransomware campaigns. Firefox and Thunderbird is the most-affected product, with 6 entries (46% of the total). CISA added 1 entry in 2025, compared with 1 in 2024. Across the 13 entries with an NVD CVSS score (100% of the total), the average score is 8.7; 4 entries are rated critical by NVD. The most recent addition is CVE-2010-3765 (Mozilla Multiple Products Remote Code Execution Vulnerability), added on 2025-10-06.
Affected products
| Product | Entries | Share |
|---|---|---|
| Firefox and Thunderbird | 6 | 46% |
| Firefox | 5 | 38% |
| Multiple Products | 1 | 7.7% |
| Firefox, Firefox ESR, and Thunderbird | 1 | 7.7% |
Entries added per year
By date added to the KEV catalog
Exploited Mozilla vulnerabilities (13)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2010-3765 | Multiple Products | Mozilla Multiple Products Remote Code Execution Vulnerability | 2025-10-06 | — | CRITICAL9.8 |
| CVE-2024-9680 | Firefox | Mozilla Firefox Use-After-Free Vulnerability | 2024-10-15 | Known | CRITICAL9.8 |
| CVE-2016-9079 | Firefox, Firefox ESR, and Thunderbird | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability | 2023-06-22 | — | HIGH7.5 |
| CVE-2015-4495 | Firefox | Mozilla Firefox Security Feature Bypass Vulnerability | 2022-05-25 | — | HIGH8.8 |
| CVE-2019-11707 | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Type Confusion Vulnerability | 2022-05-23 | — | HIGH8.8 |
| CVE-2019-11708 | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability | 2022-05-23 | — | CRITICAL10.0 |
| CVE-2013-1690 | Firefox and Thunderbird | Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability | 2022-03-28 | — | HIGH8.8 |
| CVE-2022-26486 | Firefox | Mozilla Firefox Use-After-Free Vulnerability | 2022-03-07 | — | CRITICAL9.6 |
| CVE-2022-26485 | Firefox | Mozilla Firefox Use-After-Free Vulnerability | 2022-03-07 | — | HIGH8.8 |
| CVE-2013-1675 | Firefox | Mozilla Firefox Information Disclosure Vulnerability | 2022-03-03 | — | MEDIUM6.5 |
| CVE-2020-6819 | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.1 |
| CVE-2020-6820 | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Use-After-Free Vulnerability | 2021-11-03 | — | HIGH8.1 |
| CVE-2019-17026 | Firefox and Thunderbird | Mozilla Firefox And Thunderbird Type Confusion Vulnerability | 2021-11-03 | — | HIGH8.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.