Mozilla Firefox known exploited vulnerabilities, ranked
CISA lists 5 Mozilla Firefox CVEs as exploited in the wild. 0 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2015-4495: EPSS 68.6%, added 2022-05-25
- CVE-2024-9680: EPSS 23.2%, used in ransomware, added 2024-10-15
- CVE-2022-26485: EPSS 14.3%, added 2022-03-07
- CVE-2013-1675: EPSS 6.7%, added 2022-03-03
- CVE-2022-26486: EPSS 2.4%, added 2022-03-07
All 5 Mozilla Firefox CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2015-4495 | Firefox Security Feature Bypass | 68.6% | – | 2022-05-25 | 2022-06-15 |
| 2 | CVE-2024-9680 | Firefox Use-After-Free | 23.2% | Yes | 2024-10-15 | 2024-11-05 |
| 3 | CVE-2022-26485 | Firefox Use-After-Free | 14.3% | – | 2022-03-07 | 2022-03-21 |
| 4 | CVE-2013-1675 | Firefox Information Disclosure | 6.7% | – | 2022-03-03 | 2022-03-24 |
| 5 | CVE-2022-26486 | Firefox Use-After-Free | 2.4% | – | 2022-03-07 | 2022-03-21 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Mozilla KEV CVEs · other Mozilla products: Firefox and Thunderbird · free KEV badge for Mozilla · all vendors