Mozilla known exploited vulnerabilities
CISA lists 13 Mozilla CVEs as exploited in the wild. 1 were added in the last 12 months (latest 2025-10-06), and 1 are known to be used in ransomware campaigns.
Year = when CISA added the CVE to the catalog (KEV started in November 2021).
Patch first: highest EPSS right now
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days.
- CVE-2016-9079 (Firefox, Firefox ESR, and Thunderbird): EPSS 87.4%, added 2023-06-22
- CVE-2010-3765 (Multiple Products): EPSS 83.2%, added 2025-10-06
- CVE-2013-1690 (Firefox and Thunderbird): EPSS 69.0%, added 2022-03-28
- CVE-2015-4495 (Firefox): EPSS 68.6%, added 2022-05-25
- CVE-2019-11708 (Firefox and Thunderbird): EPSS 55.9%, added 2022-05-23
Most affected Mozilla products
Firefox and Thunderbird (6), Firefox (5), Multiple Products (1), Firefox, Firefox ESR, and Thunderbird (1).
All Mozilla CVEs in KEV
| CVE | Product | Flaw | Added | Federal due | EPSS | Ransomware |
|---|---|---|---|---|---|---|
| CVE-2010-3765 | Multiple Products | Multiple Products Remote Code Execution | 2025-10-06 | 2025-10-27 | 83.2% | – |
| CVE-2024-9680 | Firefox | Firefox Use-After-Free | 2024-10-15 | 2024-11-05 | 23.2% | Yes |
| CVE-2016-9079 | Firefox, Firefox ESR, and Thunderbird | Firefox, Firefox ESR, and Thunderbird Use-After-Free | 2023-06-22 | 2023-07-13 | 87.4% | – |
| CVE-2015-4495 | Firefox | Firefox Security Feature Bypass | 2022-05-25 | 2022-06-15 | 68.6% | – |
| CVE-2019-11708 | Firefox and Thunderbird | Firefox and Thunderbird Sandbox Escape | 2022-05-23 | 2022-06-13 | 55.9% | – |
| CVE-2019-11707 | Firefox and Thunderbird | Firefox and Thunderbird Type Confusion | 2022-05-23 | 2022-06-13 | 37.7% | – |
| CVE-2013-1690 | Firefox and Thunderbird | Firefox and Thunderbird Denial-of-Service | 2022-03-28 | 2022-04-18 | 69.0% | – |
| CVE-2022-26486 | Firefox | Firefox Use-After-Free | 2022-03-07 | 2022-03-21 | 2.3% | – |
| CVE-2022-26485 | Firefox | Firefox Use-After-Free | 2022-03-07 | 2022-03-21 | 14.3% | – |
| CVE-2013-1675 | Firefox | Firefox Information Disclosure | 2022-03-03 | 2022-03-24 | 6.7% | – |
| CVE-2020-6820 | Firefox and Thunderbird | Firefox And Thunderbird Use-After-Free | 2021-11-03 | 2022-05-03 | 7.1% | – |
| CVE-2020-6819 | Firefox and Thunderbird | Firefox And Thunderbird Use-After-Free | 2021-11-03 | 2022-05-03 | 3.0% | – |
| CVE-2019-17026 | Firefox and Thunderbird | Firefox And Thunderbird Type Confusion | 2021-11-03 | 2022-05-03 | 46.3% | – |
Federal due dates bind US federal civilian agencies (CISA binding operational directives); everyone else can use them as a priority hint. Sources: CISA KEV, FIRST EPSS.
Read next: Which CVEs to patch first this week · All vendors