Skip to main content
Waterfox
Download

Changelog

Every release, on the record.

Find Waterfox releases, upstream engine fixes, and public CVEs.

Subscribe via RSS

6.7.7 JPEG XL improvements and update fixes

Desktop

Multi-core JPEG XL loading, browser engine version details and fixes for updates, tab previews and JPEG XL images.

  • Uses multiple processor cores automatically when loading JPEG XL images.
  • Shows the browser engine version in the About Waterfox window.
  • Updates Spanish (Spain), Brazilian Portuguese, Simplified Chinese, German, Irish and Ukrainian translations.
  • Replaces the C implementation of Brotli with Rust for better memory safety.
  • Fixes update prompts and release note links when an update is waiting for a restart.
  • Fixes outdated update status after clearing an old or unusable update.
  • Skips unusable tab preview images, including when pages change during preview preparation.
  • Fixes incorrect transparency in some JPEG XL images.
  • Fixes a crash when opening JPEG XL images with certain unusual colour profiles.
View full notes

1.2.10 Security update for compromised eMudhra certificates

Android

Protects against compromised eMudhra intermediate certificates, fixes certificate blocklist loading at startup and updates Gecko to 159.0.

  • Protects against compromised eMudhra intermediate certificates and fixes loading of the bundled certificate blocklist at startup.
  • Updates the Gecko browser engine to version 159.0.
  • Removes Sentry and keeps crash records on your device, without upload settings or prompts.
  • Includes inherited platform fixes for PDF sharing, download filenames, media playback and Sync.
  • Brings inherited platform fixes for webpage display, screen rotation and connection retries.
  • Updates the optional Google Lens widget and upload screen. Lens remains off by default.
View full notes

1.2.9 Shortcut controls, bookmark export and browser fixes

Android

Gecko 158, more shortcut options, bookmark export, extension update controls, separate website themes and privacy and security improvements.

  • Updates the underlying Gecko browser engine to version 158.0.
  • Fully removes Nimbus SDK, the inactive software for feature experiments, from Android packages.
  • Enables memory safety checks on supported Android devices and encrypts Mozilla Account sign-in data in release builds.
  • Adds a choice of 1–16 homepage shortcut rows and an option to reuse open tabs for Android home-screen website shortcuts.
  • Adds HTML bookmark export, preserves imported bookmark dates and brings the current folder into view when moving a bookmark.
  • Adds manual extension update checks and fixes extension language support.
  • Adds Refresh toolbar shortcuts, an optional Delete browsing data menu entry and a fullscreen exit hint setting.
  • Adds copying suggested links, an 'only modified' about:config filter and custom Sync server settings.
  • Adds website appearance settings that are separate from the app theme.
  • Fixes startup crashes with some language settings, updates Waterfox artwork and prevents unwanted navigation away from tracking protection settings.
  • Improves background session saving and homepage tab handling.
View full notes

6.7.6 Feed controls and browser fixes

Desktop

More control over feeds and a multitude of fixes.

  • Adds separate settings for the Live Bookmarks menu and feed previews.
  • Adds options to open original feed articles in a new tab or window.
  • Adds a setting to close ordinary tabs with a double-click.
  • Switches to Noto Color Emoji with Unicode 18.0 support for missing or unsupported emoji.
  • Fixes duplicate feed tabs, feed name tooltips and the about:feeds favicon.
  • Fixes a startup hang involving Waterfox Ultra Protection and DNS prefetching.
  • Improves Firefox and Chromium browser imports.
  • Fixes fallback language display and remembers multiple spellcheck dictionaries.
  • Improves compact tab and menu layouts, auto-hidden toolbars and tab appearance.
  • Fixes theme switching, palette highlights and bookmark menu icons.
  • Corrects Linux profile paths, dictionary discovery and default browser detection.
  • Restores compatibility with older Windows Group Policy settings.
View full notes

6.7.5 Read the Feed

Desktop

A new feed manager and built-in reader are now available natively within Waterfox.

  • Adds a new feed manager with folders, article search, unread filters and list or grid views.
  • Adds a built-in reader for feed articles, with adjustable text and layout.
  • Keeps track of read and unread articles and lets you save posts for later.
  • Adds previews for supported feed documents opened directly in Waterfox.
  • Adds a Feeds settings page for discovery, article opening, image loading and OPML import or export.
  • Preserves bookmark folder structure when importing and exporting OPML subscriptions.
  • Checks discovered feeds before offering them in the address bar.
View full notes

6.7.4 RSS returns and AI search controls

Desktop

RSS feeds and Live Bookmarks are back with new search options to hide AI answers, plus a Windows media overlay toggle and JPEG-XL improvements.

  • Restores RSS and Atom feed discovery.
  • Adds 'Disable AI in search results' under Settings → Search, enabled by default.
  • Adds a toggle for proxied search suggestions under Settings → Search; the proxy remains enabled by default.
  • Removes the 1.org Charitable Search engine and refreshes the Bing and Ecosia icons.
  • Adds a Windows option to keep media keys working while hiding the 'now playing' overlay.
  • Updates the JPEG-XL decoder from 0.6.0 to 0.7.4.
  • Disables an old, weak encryption cipher that prevented some websites from loading.
  • Stops bundling the ONNX runtime.
View full notes

1.2.8 Historical app icons, homepage controls and tab fixes

Android

Features include the Gecko 156.0 engine, historical Waterfox app icons, new homepage and theme controls, extension installation from file, and fixes for widgets, collections, private browsing and file uploads.

  • Updates the underlying Gecko browser engine to version 156.0.
  • Adds historical Waterfox app icons, a Black system-theme option and theme navigation fixes.
  • Exposes homepage-as-new-tab and Show more shortcuts in Home settings, and fixes the search widget overwriting the current tab.
  • Exposes extension installation from file and adds confirmation before removing tabs from collections.
  • Fixes private erase leaving stray tabs and notifications, and file selection failing when permissions are denied.
  • Preserves existing choices for configurable features.
View full notes

1.2.8.1 Emergency fix for website loading

Android

Disables Ultra DNS by default to address website loading failures reported after updating to 1.2.8.

  • Disables Ultra DNS by default to address website loading failures.
  • Returns users who have not manually selected a DNS protection level to Default protection.
  • Preserves manually selected DNS settings, including Ultra DNS.
View full notes

6.7.3 Auto-hide vertical tabs and appearance fixes

Desktop

Auto-hide vertical tabs, prevent tabs from widening when audio plays, and benefit from fixes for older extensions, sidebar controls and tab appearance.

  • Adds an option to hide vertical tabs automatically until you move your mouse to the edge of the window.
  • Adds a setting to prevent audio indicators from changing tab widths.
  • Restores country flag emoji on Windows and fixes loading issues with older extensions.
  • Fixes active tab highlighting, close buttons and the New Private Tab button in the vertical sidebar.
  • Corrects menu spacing, button appearance, custom new tab address entry and Waterfox branding.
  • Improves JPEG XL compatibility and restores the standard new tab page layout, with recommended stories and sponsored content still disabled.
View full notes

6.7.2 Improvements to tree tabs and the vertical sidebar

Desktop

Tree tabs are more reliable, with more control over their behaviour, fixes for the vertical sidebar, and security updates.

  • Improves the restoration, visibility, dragging and alignment of tab trees, as well as the handling of bookmarked trees.
  • The option to automatically collapse other trees when switching between them is now off by default, and any explicitly chosen settings are preserved.
  • Adds more tree controls directly to the Settings menu, including options for indentation, nesting limits, selecting tabs after closing a tab and handling dropped links.
  • Fixes issues with pinned tabs, hover expansion, full-screen video and the collapsed sidebar layout.
  • Unloaded tabs keep their colourful icons, and the titles of unread background tabs are no longer italicised by default. Greyscale icons and italic titles can be re-enabled in Settings.
View full notes

1.2.7 Tab groups, homepage improvements and privacy controls

Android

Features include the Firefox 155.0.1 engine, tab groups enabled by default, a customisable homepage, classic Fennec wallpapers, importing and PDF tools, and stronger privacy safeguards.

  • Updates the underlying Firefox browser engine to version 155.0.1.
  • Enables tab groups and homepage customisation, as well as swipeable shortcut pages and toolbar animations, while keeping Collections available.
  • Adds five classic Fennec wallpapers, with offline portrait and landscape versions, as well as theme and branding fixes.
  • Enables the import of bookmarks and passwords by default, as well as the new PDF viewer tools.
  • Enables Local Network Access protections and strengthens safeguards against unwanted telemetry, experiments and marketing notifications.
  • Preserves existing choices for configurable features, while ensuring that features disabled by Waterfox’s privacy policy remain unavailable.
View full notes

6.7.1 Fine Tuning

Desktop

This release restores the full set of interface customisation controls missing in version 6.7, as well as the last four missing privacy toggles. It also extends the tree tabs feature with group tabs, split view, native tab groups, and bookmark folder trees.

  • Restores over 120 interface customisation options to the Settings menu, grouped by tab bar, tabs, toolbars, bookmarks, icons, rounding, theme, content, new tab and video player.
  • Brings back the WebRTC peer connection toggle, the referrer header policy menu, and the `Load images` and `Enable JavaScript` checkboxes, all of which are now located in the Privacy pane.
  • Adds group tabs to tree tabs: a named placeholder tab that stands in for a parent and can be closed when empty.
  • Tree tabs now work with split view and native tab groups, and bookmark folders can restore a saved tree structure when opened.
  • Adds a new tab position chooser to the tab strip, as well as a dialogue for links dropped onto a tab.
  • Moves the density picker into Appearance alongside the browser style and palette controls.
  • DRM playback is now disabled by default, and form autofill is available in every region.
  • The browser style is no longer lost when upgrading a profile from 6.7.
View full notes

6.7.0 Supernova

Desktop

Waterfox 6.7 has moved to the ESR 153 platform and now features native tree tabs, the Nova style, and twelve colour palettes. It also boasts a rebuilt ad blocker panel, legacy extension support, a new setup flow, and update controls that finally deliver on their promises.

  • Upgrades the underlying platform from ESR 140 to ESR 153, incorporating a year's worth of improvements to the engine, performance and security.
  • Rebuilds tree-style tabs as a native feature of the vertical tab strip, replacing the 6.6 bundled Tree Style Tab fork.
  • Adds Nova, a new browser style to sit alongside Proton and Photon, plus twelve colour palettes with light and dark variants.
  • Redesigns the ad blocker panel to include a status hero, separate ad, tracker and pop-up counts, and a breakdown of what was blocked on the page.
  • Restores legacy extension support, covering restartless, overlay-based and restart-required add-ons with integration in about:addons.
  • Rebuilds the onboarding setup as a five-step process covering language, import options, appearance, tab layout and privacy settings.
  • Adds update controls under Settings and fixes `Check for updates` so that it only checks.
  • Adds ARM64 builds for every platform, plus official Linux package repositories with DEB and RPM packages.
View full notes

6.7.0-beta.3 Ultra Protection returns and Linux package repositories

Desktop
Beta

Third 6.7.0 beta re-enabling DNS over Oblivious HTTP by default, adding ARM64 Linux packages and a redesigned About dialog, and extending legacy extension support to overlay-based add-ons.

  • Re-enables Ultra Protection by defaulr
  • Extends legacy extension support to overlay-based extensions using `chrome.manifest` overlay entries.
  • Publishes ARM64 DEB and RPM packages alongside x86_64 through the Waterfox package repositories, now hosted under `isv:BrowserWorks`.
  • Adds a redesigned About dialog built on the Waterfox design.
  • Enables the global menu bar on Linux desktops that provide one, including on Wayland.
  • Lets the disk cache's in-memory layer grow with available RAM instead of stopping at a fixed ceiling.
  • Fixes opening links in a new private tab from the context menu.
View full notes

6.6.17 Security and regional search follow-up

Desktop

Includes fixes from the forthcoming MFSA 2026-70, attempts to correct regional search defaults, and adds a privacy-enhancing search suggestion proxy alongside compatibility fixes.

  • Includes security fixes covered by the forthcoming Mozilla Foundation Security Advisory 2026-70.
  • Attempts to correct the previous country based search configuration, using Qwant in supported regions and DuckDuckGo elsewhere.
  • Migrates users affected by earlier automatically selected defaults to the appropriate regional search engine.
  • Removes obsolete search overrides that could interfere with regional defaults and Waterfox search attribution.
  • Routes Google-backed search suggestion requests through Waterfox Private Search to prevent a direct connection to Google.
  • Stops forcing the experimental HTTP `Idempotency-Key` header on POST requests.
  • Fixes Chase compatibility when Waterfox's built-in content blocker is enabled.
  • Highlights Waterfox 6.7.0-beta.2 and invites users to help test and report regressions.
View full notes

6.7.0-beta.2 Legacy extensions and Tree Tabs improvements

Desktop
Beta

Second 6.7.0 beta adding initial support for restartless legacy extensions and prerelease Linux packages, alongside extensive Tree Tabs, compatibility, and palette fixes.

  • Adds initial support for restartless legacy extensions using `install.rdf`, `bootstrap.js`, and compatible `chrome.manifest` entries.
  • Enables publication of prerelease x86_64 DEB and RPM packages through the Waterfox OBS repositories.
  • Significantly improves Tree Tabs session restoration, ordering, tree operations, and cross-window tab movement.
  • Updates Qwant's regional availability, search parameters, and branding.
  • Stops automatically enforcing soft-blocked add-ons while retaining hard-block protections, including for unsigned legacy extensions.
  • Disables automatic generation of HTTP `Idempotency-Key` headers by default.
  • Fixes Chase compatibility when the built-in content blocker is enabled.
  • Prevents selected Waterfox colour palettes from being overwritten by later default-theme updates.
View full notes

1.2.6 Gecko 153 and search updates

Android

Gecko 153, regional search availability updates, and Qwant AI Answers disabled by default

  • Upgraded the browser engine to Gecko 153, bringing in the latest upstream fixes and improvements.
  • Replaced Qwant with DuckDuckGo in regions where Qwant is not supported.
  • Ensured Qwant's 'AI Answers' feature is disabled by default when Qwant is selected.
View full notes

6.6.16 Qwant becomes the default search engine

Desktop

Qwant is now the default search engine, the 6.6.16.1 hotfix corrects default-region and query handling issues, and security fixes shipped ahead of the next ESR 140 release.

  • Waterfox 6.6.16.1 corrects Qwant defaults in unsupported regions, requests AI answers off by default, and fixes locale-country query handling for values such as `es_US`.
  • Fixed multiple security vulnerabilities, including all fixes landed to date for the upcoming Firefox ESR 140.13, shipped ahead of Mozilla's release schedule.
  • Qwant is now the default search engine in 26 regions, with DuckDuckGo as the default everywhere else, replacing 1.org.
  • If you've set your own search engine, your choice is respected and nothing changes.
  • The built-in ad blocker's search ads allowance now follows the new default to Qwant.
  • Waterfox 6.7.0-beta.1 is now available for testing.
View full notes

6.7.0-beta.1 Supernova

Desktop
Beta

First 6.7.0 beta moving Waterfox to the ESR 153 platform, with tree tabs built natively into vertical tabs, a new Nova style and colour system, ad blocker improvements, and a reworked first-run setup.

  • Upgrades the underlying platform from ESR 140 to ESR 153, rolling up a year of upstream engine, performance, and security work.
  • Rebuilds tree-style tabs as a native part of the vertical tab strip, replacing the bundled Tree Style Tab fork from 6.6.
  • Adds Nova, a new browser style alongside Proton and Photon, plus twelve colour palettes, each with light and dark variants.
  • Moves the built-in ad blocker to its own Settings pane, injects anti-adblock scriptlets before page scripts run, and grows the redirect resource list from 17 to 62.
  • Changes the default search engine to Qwant in 26 regions and DuckDuckGo elsewhere, replacing 1.org as the global default.
  • Rebuilds first-run setup and the Firefox profile migrator, and adds native messaging support for companion apps on macOS and Linux.
  • Resumes network updates for certificate revocation data (OneCRL, CRLite) and the add-on blocklist, and adds Settings controls for Ultra Protection.
  • Adds ARM64 builds for every platform, including the Debian and RPM packages on Linux.
View full notes

1.2.5 Gecko 152 update

Android

Gecko 152, security updates and search provider changes

  • Upgraded the browser engine to Gecko 152, bringing in the latest upstream fixes and improvements
  • Qwant is now the default search
View full notes

6.6.15 Security follow-up release

Desktop

A follow-up security release for Mozilla Foundation Security Advisory 2026-58, covering the remaining fixes not already included in Waterfox 6.6.14.

  • Fixed the remaining security issues relevant to Waterfox from Mozilla Foundation Security Advisory 2026-58.
  • Most fixes associated with this advisory were already included in Waterfox 6.6.14; this release completes the remaining follow-up work.
  • A beta release for the next major Waterfox version will be available soon.
View full notes

6.6.14 Web compatibility and ad blocker refinements

Desktop

Compatibility improvements for Discord and Chase, a macOS crash workaround, and reliability improvements for the built-in ad blocker.

  • Attempted user agent compatibility improvements for Discord.
  • Attempted user agent compatibility improvements for Chase bank.
  • Worked around a macOS 26.5 issue that could cause Waterfox to crash.
  • Added a site information panel toggle to always allow cookies and site data for the current site.
  • Improved built-in ad blocker reliability with modern filter lists and site specific rules.
  • Reduced the chance of ads or annoyances briefly appearing on pages loaded immediately after startup.
  • Reduced background work performed by the blocker when a page starts loading.
View full notes

1.2.4 Gecko 151 update

Android

Gecko 151, security updates, search provider changes, What's New menu behavior, and custom wallpaper improvements

  • Upgraded the browser engine to Gecko 151, bringing in the latest upstream fixes and improvements.
  • Removed Startpage as a search option at Startpage's request; Yahoo is currently set as the default search engine.
  • Fixed the What's New menu item so it stays hidden after reading release notes until the next release.
  • Improved custom wallpaper handling.
View full notes

6.6.13 Default ad blocker & search updates

Desktop

Security fixes, the built-in ad blocker now enabled by default, a new temporary default search engine, and several web compatibility improvements.

  • Fixed multiple security vulnerabilities as described in Mozilla Foundation Security Advisory 2026-48.
  • The built-in ad blocker is now enabled by default.
  • Fixed tracking protection not blocking properly due to missing bundled assets.
  • Startpage has been removed as a search provider, with 1.org set as the temporary default.
  • Waterfox Private Search is now $5/month for unmetered, ad free searches.
  • Internationalised domain names are now displayed as unicode instead of punycode for better legibility.
  • CSS dithering is now enabled, reducing colour banding on gradients.
  • Attempted compatibility improvements for websites such as LinkedIn.
View full notes

1.2.3 Gecko 150 update

Android

Gecko 150 and a note on classic menu style requests

  • Upgraded the browser engine to Gecko 150, bringing in the latest upstream fixes and improvements.
  • Acknowledged community requests for a classic menu style, investigating how best to implement it.
View full notes

6.6.12 Security fixes and ad blocker improvements

Desktop

Security fixes and major improvements to the built-in ad blocker in preview testing.

  • Fixed multiple security vulnerabilities as described in Mozilla Foundation Security Advisory 2026-32.
  • Added a Custom Filter Lists manager so you can add and remove your own filter list URLs from the UI.
  • Improved the Filter Lists screen with search, manual refresh, configurable refresh intervals, and per list status information.
  • Smarter blocker update logic with per list refresh handling, caching, and better error handling.
  • Better cosmetic filtering on web pages.
  • Stricter detection of conflicting ad blocker extensions to reduce false positives.
View full notes

6.6.11 Security fixes and feature preview

Desktop

This release includes the latest security fixes and a built-in ad blocker available for testing

  • Security fixes from upcoming Gecko 140.10 ESR
  • Built-in ad blocker available for early testing
View full notes

6.6.10 Discord compatibility and security fixes

Desktop

Security fixes and a Discord compatibility fix.

  • Fixed multiple security vulnerabilities as described in Mozilla Foundation Security Advisory 2026-22.
  • Backported a fix to resolve a requirement for Discord voice and video compatibility.
View full notes

1.2.2 Stability and cleanup

Android

Gecko 149 and a fix for deleting data on quit

  • Upgraded the browser engine to Gecko 149, bringing in the latest upstream fixes and improvements.
  • Fixed an issue where the 'Quit' button wouldn't delete your data when 'Delete browsing data on quit' was enabled.
View full notes

1.2.1 Stability and cleanup

Android

Gecko 148.0.3 and a fix for deleting data on quit

  • Upgraded the browser engine to Gecko 148.0.3, bringing in the latest upstream fixes and improvements.
  • Fixed an issue where the 'Quit' button wouldn't delete your data when 'Delete browsing data on quit' was enabled.
View full notes

6.6.9 Security and stability improvements

Desktop

Security fixes, certificate reliability improvements, and JPEG-XL performance gains.

  • Fixed multiple security vulnerabilities as described in Mozilla Foundation Security Advisory 2026-15.
  • Fixed 3 CVEs in the JPEG-XL image decoder.
  • Fixed an issue that could cause 'Unknown Issuer' certificate errors on certain sites, most commonly on Linux.
  • Small performance improvement in JPEG-XL image decoding.
  • Ogg Theora support can be experimentally re-enabled.
  • Printer driver isolation on Windows for improved stability.
View full notes

1.2.0 A stronger foundation

Android

Less deps, and expanded theme customisation

  • Updated base from Gecko 140 to 148, bringing in newer browser improvements and fixes.
  • Enabled GeckoView Lite which trims out extra built in components the app doesn't need, which keeps the app smaller and reduces background overhead.
  • Implemented a dummy version of Mozilla's Glean telemetry SDK and fully removed the Adjust SDK.
  • Improved themes customisation is now under Settings > Customize, with separate light and dark colors and an option to match your device theme automatically.
View full notes

1.1.9 Security fixes

Android

Fixes for various security issues

  • (MFSA 2026-03) Security Vulnerabilities fixed in Firefox ESR 140.7
  • (MFSA 2025-94) Security Vulnerabilities fixed in Firefox ESR 140.6
View full notes

6.6.8 Tab unloading & passkeys

Desktop

Manual tab unloading with improved unloaded tab previews, macOS passkeys, Windows redist bundling, and assorted import/UI fixes.

  • Manually unload tabs from the tab context menu, with improved unloaded tab previews.
  • Web Authentication (passkeys) support on macOS.
  • Windows builds now bundle the required Visual Studio redistributables for easier fresh installs.
View full notes

6.6.7 Import & Linux video fixes

Desktop

Fixes Windows Firefox import issues, resolves Linux HDR playback problems, and ships a verified Flathub Flatpak.

  • Fixed issue importing Firefox data on Windows (Settings > Import browser data).
  • Fixed an issue on Linux where HDR would be broken on YouTube videos.
  • Linux has now been verified on Flathub, so you can trust the provenance of it.
View full notes

1.1.8 Security fixes

Android

Fixes for various security issues

  • (MFSA 2025-94) Security Vulnerabilities fixed in Firefox ESR 140.6
View full notes

6.6.6 Privacy hardening

Desktop

Explicitly disables some settings and fixes some feature implementations.

  • Explicitly disables network-based region and geo-IP lookups, fixing region to a non-dynamic value.
  • Turns off the local ML/AI runtime, AI link previews and related Labs plumbing so they can’t re-enable themselves from old Firefox profiles.
  • Translations remain available, and fixes Private Tab search and status bar Bookmarks widget behaviour."
View full notes

6.6.5.1 Startpage default search and Tree Vertical Tabs fix

Desktop

Small 6.6.5.1 patch that switches the default search back to Startpage and fixes Tree Vertical Tabs behaviour and options visibility.

  • Switches the default search engine back to Startpage, without affecting users who have already changed their default.
  • Fixes Tree Vertical Tabs continuing to run in the background when disabled, so turning it off actually unloads the feature and can reduce memory usage.
  • Fixes Tree Vertical Tabs options appearing at the bottom of Preferences/Settings → General on first load so they now only appear under the dedicated Tree Vertical Tabs category.
View full notes

1.1.7 Startup crash fixes

Android

Android 1.1.7 fixes crashes and ANR issues on startup for certain devices.

  • Fixes crashes and ANR issues during startup on certain Android devices.
  • Improves overall stability at application launch.
View full notes

1.1.6 Search defaults and security update

Android

Updates search defaults on Android and brings in the latest security fixes from Mozilla Foundation Security Advisory 2025-88.

  • Changes the default search engine back to Startpage for users who have not customised their default.
  • Includes all security fixes from Mozilla Foundation Security Advisory 2025-88.
View full notes

6.6.5 Ukrainian locale and quick URL copy

Desktop

Adds a Ukrainian UI locale, a quick shortcut to copy the current tab URL, and the latest security fixes for Waterfox 6.6.5.

  • Adds Ukrainian as a UI language.
  • Introduces a keyboard shortcut to quickly copy the current tab URL on macOS (Command+Shift+U) and Windows/Linux (Ctrl+Shift+U).
  • Includes the latest security advisories from MFSA 2025-89.
View full notes

1.1.5 Ecosia partnership and search fixes

Android

Android release that renews the Ecosia search partnership, fixes Mojeek search queries, and pulls in the latest security and stability fixes.

  • Renews the Ecosia search partnership on Android with a focus on climate-positive, privacy-friendly search.
  • Keeps existing non-Ecosia default search choices unchanged while offering Ecosia as an improved default.
  • Fixes malformed search queries when using Mojeek.
  • Updates to GeckoView ESR 140.4 and Android Components 140.4 for upstream security and stability fixes.
View full notes

6.6.4 Ecosia partnership, Waterfox Private Search, and search fixes

Desktop

Waterfox 6.6.4 restores canonical app naming on Linux, renews the Ecosia partnership, adds Waterfox Private Search, adjusts tab grouping defaults, and fixes several search provider and security issues.

  • Renews the Ecosia partnership and makes Ecosia the default search engine again.
  • Introduces Waterfox Private Search as an optional subscription-based, ad-free search provider.
  • Fixes Mojeek search queries and restores Google search autocomplete when set as default.
  • Applies all security advisories from Mozilla MFSA 2025-83.
  • Restores the Linux app name and window class to 'waterfox' for better desktop integration.
  • Disables automatic tab grouping by default due to a group-merging issue, with a preference to re-enable it.
View full notes

6.6.3 Theming polish and tab group refinements

Desktop

Polish-focused 6.6.3 update that fixes theme style leakage, improves contrast, refines tab group behavior, and updates emoji support.

  • Fixes a long-standing issue where Waterfox interface styles could bleed into website content.
  • Improves theme colouring to avoid contrast issues and enables the active tab context line by default.
  • Refines tab group behavior at startup and when collapsing the only group, keeping layout stable.
  • Updates emoji rendering to Emoji 16.0.1 on platforms without native support.
View full notes

1.1.4 OLED black theme

Android

Android 1.1.4 adds a black theme optimized for OLED devices and updates core libraries for the latest security and performance fixes.

  • Adds a Black theme specifically designed for OLED displays.
  • Updates to the latest development libraries for improved security and performance.
View full notes

6.6.2 Theme refinements, Windows Mica/Acrylic, and tab group improvements

Desktop

Waterfox 6.6.2 polishes the theme, refines vertical tabs and Windows translucency, and improves tab grouping behavior while restoring recent history and top sites in the address bar.

  • Refines the default Waterfox UI theme, including restoring tab shapes and improving contrast between active/inactive tabs and the navigation bar.
  • Adds Windows 11 Mica-style translucency with optional stronger Acrylic effects via about:config.
  • Improves tab grouping behavior so new tabs stay in the correct group, collapsing the only group works intuitively, and the cancel auto-grouping shortcut behaves reliably.
  • Makes auto-grouping more resilient by cleaning up timers and listeners and handling edge cases across windows.
  • Restores recent history and top sites in the address bar and fixes middle-click paste behavior on Linux.
  • Begins addressing a long-standing issue where some users saw an empty or hidden profile after updating.
View full notes

6.6.1 WebGPU enablement and private tab improvements

Desktop

Patch release that enables WebGPU on stable builds, fixes several Linux and Windows UI issues, and adds new privacy and control options for Private Tabs.

  • Enables WebGPU on release channel builds by removing code that previously blocked it.
  • Restores Unity global menu support on Linux and fixes issues with the Restart command and its alignment on Linux and Windows.
  • Fixes the missing Install update option in about:addons when automatic updates are disabled.
  • Disables captive portal detection so the operating system handles it, removing an extra network request to Mozilla.
  • Reorganizes Waterfox language strings and restores missing Tree Vertical Tabs labels.
  • Adds a preference to control the New Private Tab button and tightens privacy for Private Tabs by disabling suggestions and not saving search terms.
View full notes

6.6.0 Major ESR 140 upgrade with vertical tabs, tab groups, and new tab experience

Desktop

Waterfox 6.6.0 upgrades the underlying platform from ESR 128 to 140 and introduces first-party vertical tabs, private tabs, tab grouping, new tab wallpapers, expanded media and hardware acceleration, and privacy-friendly defaults.

  • Upgrades the underlying platform from ESR 128 to ESR 140, rolling up twelve months of upstream changes.
  • Adds first-party vertical tabs with optional tree-style layout and a quick New Private Tab button.
  • Introduces automatic tab grouping, customizable placement, and a redesigned new tab page with wallpapers, search bar, and optional weather.
  • Enables Firefox profile import for bookmarks, history, cookies, form data, and passwords.
  • Turns on WebGPU, Web Share API, VP8/VP9 hardware acceleration for WebRTC, improved MathML rendering, and other modern platform features.
  • Refines the UI with layout and theming options, status bar, compact density, and platform-specific polish on Windows and macOS.
  • Tightens privacy defaults by reducing promos, speculative connections, remote config fetches, and bundled A/B testing code.
View full notes

1.1.3 JPEG-XL animations and theme stability

Android

Adds support for animated and alpha-transparent JPEG-XL images and fixes crashes when using custom themes on Android.

  • Adds support for JPEG-XL images with animations and alpha transparency on Android.
  • Fixes experimental crashes when a custom theme is selected due to missing colour definitions.
View full notes

6.6.0 Beta 6 Theming and stability fixes before 6.6.0 final

Desktop
Beta

Final 6.6.0 beta that polishes theming and fixes crashes caused by optimization flags on some systems.

  • Fixes various small theming issues introduced in earlier 6.6 betas.
  • Resolves crashes on certain systems caused by aggressive optimization flags.
View full notes

1.1.2 Experimental themes, wallpapers, and x86_64 support

Android

Adds experimental theme and wallpaper support on Android and reintroduces support for x86_64 Android devices.

  • Adds experimental theme support so users can try alternate UI themes.
  • Introduces experimental custom wallpapers to personalize the app background.
  • Reintroduces support for x86_64 Android devices.
View full notes

6.6.0 Beta 5 Private tab button and privacy fixes

Desktop
Beta

Fifth 6.6.0 beta adding an easily accessible New Private Tab button and fixing private tab history, translation model downloads, password autofill, and the screenshot tool.

  • Adds a clearly visible New Private Tab button next to the New Tab button.
  • Ensures Private Tabs no longer retain browsing history.
  • Fixes translation model downloads so language packs are no longer blocked.
  • Restores password autofill behavior.
  • Returns the screenshot tool to the context menu.
View full notes

6.6.0 Beta 4 Onboarding and new tab personalization

Desktop
Beta

Fourth 6.6.0 beta reintroducing the about:welcome setup experience and adds search, weather, and wallpaper customization to the new tab page.

  • Brings back the about:welcome onboarding flow for new or reset profiles.
  • Adds a toggle to show or hide a search bar on the new tab page.
  • Adds an optional weather widget for your location on the new tab page (opt-in, requires sending your IP to Mozilla).
  • Lets you set custom new tab wallpapers using your own image, predefined colors, or a custom color.
View full notes

6.5.11 Final ESR 128 security update

Desktop

Final 6.5.x release on ESR 128 delivering the latest security fixes before the move to ESR 140 in Waterfox 6.6.

  • Includes the latest security fixes (MFSA 2025-58).
  • Marks the final Waterfox release based on ESR 128 before moving to ESR 140 in the 6.6 release series.
View full notes

1.1.1 DuckDuckGo fix and menu improvements

Android

Android release that fixes the DuckDuckGo default search engine bug and adds a Quit button plus a menu redesign toggle.

  • Fixes an issue where DuckDuckGo could not be set correctly as the default search engine.
  • Adds a Quit button to the main menu for easier app exit.
  • Introduces a toggle to switch between the new menu design and the classic layout.
View full notes

6.6.0 Beta 3 macOS auto-update fix and logo, privacy, and classic extensions tweaks

Desktop
Beta

Third 6.6.0 beta that fixes a macOS auto-update bug, refreshes the liquid glass logo, tightens speculative connections and remote config behavior, and restores classic extension compatibility.

  • Fixes a macOS auto-update bug in earlier beta builds by requiring a one-time manual reinstall and cache cleanup.
  • Updates the Waterfox logo and dock icon on macOS 26 and standardizes icons across platforms.
  • Disables speculative connections when typing in the address bar and uses bundled offline copies of remote settings instead of contacting Mozilla.
  • Removes packaged A/B testing code that was already disabled.
  • Fixes duplicate tab creation when opening a duplicate and restores compatibility with classic-style extensions such as TabMixPlus.
View full notes

1.1.0 ESR-based rebuild of Waterfox for Android

Android

Major rebuild of Waterfox for Android on the ESR codebase with everything compiled from source for better stability, performance, and privacy-friendly defaults.

  • Rebuilds Waterfox for Android on the ESR codebase with Android Components, Gecko, and SpiderMonkey compiled from scratch.
  • Removes telemetry, sponsored content, experimentation frameworks, and tracking services in favour of strict privacy defaults.
  • Adds advanced privacy features such as enhanced DNS over HTTPS with Ultra Protection (Oblivious HTTP) and full about:config access.
  • Greatly expands add-on support: browse and install from the full Mozilla Add-ons store, use Android-only views, custom AMO collections, and install .xpi files.
  • Updates search and navigation with privacy-focused engines, Waterfox-specific top sites, and JPEG-XL support.
  • Simplifies the app by removing unnecessary integrations and preparing new distribution channels like GitHub APKs and alternative app stores.
View full notes

6.6.0 Beta 2 Tree vertical tabs and automatic tab grouping

Desktop
Beta

Second 6.6.0 beta focusing on tree-style vertical tabs, automatic tab grouping, and Firefox profile import on the ESR 140 platform.

  • Introduces tree-style vertical tabs in the vertical tab sidebar.
  • Adds automatic tab grouping with configurable placement, delay, and a cancel shortcut.
  • Allows importing bookmarks, history, cookies, form history, and passwords directly from a Firefox profile.
  • Exposes fine-grained control over auto-grouping behavior via about:config preferences.
View full notes

6.5.10 Security fixes and Startpage default search

Desktop

Patch release that includes the latest security fixes and temporarily switches the default search engine to Startpage while Bing syndication is being retired.

  • Includes the latest security fixes from Mozilla's MFSA 2025-53 advisory.
  • Temporarily switches the default search engine to Startpage while Bing search syndication and APIs are discontinued.
  • Highlights the availability of Waterfox 6.6.0 Beta 1 for testing on ESR 140.
View full notes

6.6.0 Beta 1 ESR 140 beta: platform upgrade and modern web features

Desktop
Beta

First 6.6.0 beta upgrading Waterfox to the ESR 140 platform with WebGPU, modern CSS/DOM/SVG features, improved media and WebRTC, and UI/network/privacy refinements.

  • Upgrades the underlying platform from version 128.0 to 140.0 for beta testing.
  • Enables experimental web platform features including CSS Masonry layout, new CSS and SVG capabilities, and modern DOM APIs such as CloseWatcher and screen orientation lock.
  • Improves media and graphics with WebGPU, VP8/VP9 hardware acceleration for WebRTC, MathML updates, and enhanced autoplay controls.
  • Refines UI defaults such as smooth scrolling, updated Proton colors, and layout and bookmark tweaks.
  • Introduces network and cookie handling improvements like CHIPS, SameSite enhancements, and HTTP/3-related optimizations.
  • Reduces promotions and tightens extension and privacy behavior in line with upstream platform changes.
View full notes

6.5.8 Security update and media crash hotfix

Desktop

Security-focused 6.5.8 release with the latest upstream fixes, a short-lived media crash issue resolved in 6.5.9, and continued promotion of the Waterfox Private Search open beta.

  • Includes the latest security fixes from Mozilla advisories MFSA 2025-37 and MFSA 2025-43.
  • Documents a temporary crash affecting certain media-heavy sites, resolved in follow-up release 6.5.9.
  • Continues the open beta promotion of Waterfox Private Search as a more private, ad-light search option.
View full notes

6.5.9 Security fixes and media crash patch

Desktop

Patch release that addresses media playback crashes and includes the latest upstream security fixes, while continuing the Waterfox Private Search open beta.

  • Includes the latest security fixes from MFSA 2025-37 and MFSA 2025-44.
  • Fixes crashes when playing certain media files.
  • Highlights the ongoing open beta for Waterfox Private Search.
View full notes

6.5.7 Vertical tabs improvements and security fixes

Desktop

Patch release focusing on vertical tabs polish, stability, and the latest security updates, plus an open beta of Waterfox Private Search.

  • Includes the latest security fixes (MFSA 2025-29).
  • Improves vertical tabs favicon handling, bookmarks sidebar and library integration, popup menus, tab previews, private window stability, and drag-and-drop behavior.
  • Announces the open beta of Waterfox Private Search, a privacy-focused meta-search engine.
View full notes

6.5.6 JPEG-XL security fixes and WASM sandbox restoration

Desktop

Patch release that updates JPEG-XL to address security issues, restores WASM sandboxed libraries, and includes the latest security fixes.

  • Updated the JPEG-XL library to resolve reported security issues.
  • Re-enabled WASM sandboxed libraries after fixing underlying build issues.
  • Includes the latest upstream security fixes (MFSA 2025-17).
View full notes

6.5.5 Restart button and status bar fixes

Desktop

Patch release that restores the Restart button on Linux and Windows, cleans up the status bar text, and includes the latest security updates.

  • Includes the latest security fixes from Mozilla (MFSA 2025-13).
  • Restores the Restart button on Linux and Windows.
  • Removes the unexpected `(NULL)` label from the status bar text on Linux and Windows.
View full notes

6.5.4 Security update for 6.5.4

Desktop

This patch release delivers the latest upstream security fixes for Waterfox 6.5.4 and documents the remaining known issue with the Restart button on Linux and Windows.

  • Includes the latest security fixes from Mozilla's MFSA 2025-09 advisory.
  • Restart button remains missing on Linux and Windows (known issue).
View full notes

6.5.3 Stability and theming fixes

Desktop

Maintenance release with theming polish, configuration clean-up, and the latest security updates.

  • Polished various theming issues.
  • Updated base configuration defaults and removed unused values.
  • Includes the latest security fixes (MFSA 2025-02).
  • Restart button remains missing on Linux and Windows.
  • Some users may still experience session restore issues (Bug 1901899).
View full notes

6.5.2 Theming, vertical tabs, and security fixes

Desktop

Patch release focusing on theming improvements, vertical tab stability, and the latest security updates.

  • Fixes various theming issues across the browser UI.
  • Resolves multiple problems with vertical tabs.
  • Includes the latest upstream security fixes (MFSA 2024-64).
View full notes

6.5.1 JPEG-XL stability and Look & Feel fixes

Desktop

Bugfix release that updates the JPEG-XL library to prevent crashes and restores missing Look & Feel strings.

  • Updated the JPEG-XL library to the latest version to stop crashes on sites serving .jxl images.
  • Restored missing strings on the Look & Feel preferences page so theme settings can be changed again.
  • Known issues remain: missing Restart button on Linux/Windows, status bar colour mismatches, and occasional session restore problems.
View full notes

6.5.0 ESR 128 stable and architecture overhaul

Desktop

First stable Waterfox 6.5 release on the ESR 128 branch with updated system requirements, performance tuning, and classic tools like the legacy password and config managers.

  • First stable release of the ESR 128 branch (6.5.x) with updated versioning and dropping the 'G' prefix
  • Raised minimum system requirements to match modern Windows 10-era hardware (SSE3-class CPUs)
  • Retuned CPU code generation for Skylake-class and newer processors for better performance
  • Added a Table of Contents to the Preferences page for easier navigation
  • Reintroduced the classic password manager and configuration manager
View full notes

6.5.0 Beta 3 CPU compatibility, security patches, and DRM fixes

Desktop
Beta

Third 6.5.0 beta improving compatibility with older CPUs, applying security patches, and fixing DRM playback on macOS.

  • Improves compatibility with older CPUs.
  • Includes additional security patches for this beta.
  • Fixes DRM playback on macOS.
View full notes

6.5.0 Beta 2 Fixes for vertical tabs and default browser issues

Desktop
Beta

Second 6.5.0 beta focusing on fixing the initial round of vertical tab bugs and default browser handling on Windows.

  • Fixes setting Waterfox as the default browser on Windows.
  • Corrects vertical tabs autohide behavior in F11 fullscreen.
  • Resolves errors and missing functionality in the vertical tabs options page and sidebar menu.
  • Restores tab preview and F1 toggling behavior for Waterfox vertical tabs.
  • Fixes toolbar customisation issues that could remove the vertical tabs button.
View full notes

6.5.0 Beta 1 ESR 128 beta and architecture overhaul

Desktop
Beta

First Waterfox 6.5.0 beta on the ESR 128 branch with updated system requirements, performance tuning, and classic tools returning.

  • First beta release on the ESR 128 branch (6.5.x) and dropping the 'G' prefix from version numbers.
  • Raises minimum system requirements to match modern Windows 10-era hardware (SSE3-class CPUs).
  • Retunes CPU code generation for Skylake-class and newer processors for improved performance.
  • Adds a Table of Contents to the Preferences page for easier navigation.
  • Allows setting any URL as the new tab page via the browser.newtab.url preference in about:config.
  • Reintroduces the classic password manager implementation.
View full notes

Security advisories

MFSA 2026-120Gecko 153.6 ESRDesktop6.7.7145 CVEs
Mozilla advisory
Desktop release notes6.7.7
MFSA 2026-118Gecko 159Android1.2.10167 CVEs
Mozilla advisory
Android release notes1.2.10
MFSA 2026-108Gecko 153.5 ESRDesktop6.7.661 CVEs
Mozilla advisory
Desktop release notes6.7.6
MFSA 2026-106Gecko 158Android1.2.977 CVEs
Mozilla advisory
Android release notes1.2.9
MFSA 2026-100Gecko 153.4 ESRDesktop6.7.562 CVEs
Mozilla advisory
Desktop release notes6.7.5
MFSA 2026-93Gecko 153.3 ESRDesktop6.7.363 CVEs
Mozilla advisory
Desktop release notes6.7.3 6.7.4
  • CVE-2026-92005

    Use-after-free in the Audio/Video: Web Codecs component

  • CVE-2026-92006

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92007

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92008

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92009

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92010

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92011

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92012

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92013

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92015

    Privilege escalation in the WebExtensions component

  • CVE-2026-92035

    Sandbox escape due to incorrect boundary conditions in the Graphics component

  • CVE-2026-92016

    Use-after-free in the Disability Access APIs component

  • CVE-2026-92017

    Privilege escalation in the DOM: Service Workers component

  • CVE-2026-92018

    Sandbox escape in the DOM: Core & HTML component

  • CVE-2026-92020

    Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

  • CVE-2026-92022

    Use-after-free in the DOM: HTML Parser component

  • CVE-2026-92023

    Use-after-free in the XML component

  • CVE-2026-92024

    Use-after-free in the SVG component

  • CVE-2026-92025

    Use-after-free in the DOM: Navigation component

  • CVE-2026-92026

    Use-after-free in the Networking component

  • CVE-2026-92027

    Use-after-free in the DOM: Streams component

  • CVE-2026-92028

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-92029

    Use-after-free in the SVG component

  • CVE-2026-92038

    Mitigation bypass in the Remote Settings Client component

  • CVE-2026-92039

    Mitigation bypass in the DOM: Notifications component

  • CVE-2026-92041

    Mitigation bypass in the DOM: Networking component

  • CVE-2026-92042

    Race condition in the DOM: Content Processes component

  • CVE-2026-92043

    Privilege escalation due to incorrect boundary conditions in the Audio/Video component

  • CVE-2026-92044

    Information disclosure in the Networking: HTTP component

  • CVE-2026-92045

    Sandbox escape due to incorrect boundary conditions in the WebRTC component

  • CVE-2026-92030

    Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

  • CVE-2026-92046

    Use-after-free in the Graphics component

  • CVE-2026-92047

    Privilege escalation in the Crash Reporting component

  • CVE-2026-92048

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92049

    Use-after-free in the Widget: Win32 component

  • CVE-2026-92052

    Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component

  • CVE-2026-92053

    Privilege escalation in the Graphics: CanvasWebGL component

  • CVE-2026-92054

    Privilege escalation in the Memory component

  • CVE-2026-92055

    Privilege escalation in the DevTools component

  • CVE-2026-92056

    Use-after-free in the Graphics: Text component

  • CVE-2026-92019

    Mitigation bypass in the Remote Settings Client component

  • CVE-2026-92057

    Mitigation bypass in the Enterprise Policies component

  • CVE-2026-92031

    Information disclosure in the Graphics: ImageLib component

  • CVE-2026-92032

    Sandbox escape due to invalid pointer in the Graphics component

  • CVE-2026-92058

    Use-after-free in the Graphics component

  • CVE-2026-92059

    Incorrect boundary conditions in the DOM: Editor component

  • CVE-2026-92060

    Use-after-free in the Internationalization component

  • CVE-2026-92062

    Privilege escalation in the Session Restore component

  • CVE-2026-92064

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92065

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92067

    Use-after-free in the Widget: Gtk component

  • CVE-2026-92068

    Site isolation issue in the Reader Mode component

  • CVE-2026-92069

    Spoofing issue in the DOM: Navigation component

  • CVE-2026-92070

    Information disclosure in the Networking component

  • CVE-2026-92071

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92072

    Incorrect boundary conditions in the Safe Browsing component

  • CVE-2026-92073

    Privilege escalation in the Enterprise Policies component

  • CVE-2026-92074

    Mitigation bypass in the Popup Blocker component

  • CVE-2026-92075

    Mitigation bypass in the Networking component

  • CVE-2026-92076

    Incorrect boundary conditions in the Networking component

  • CVE-2026-92077

    Denial-of-service in the SVG component

  • CVE-2026-92078

    Denial-of-service in the Security component

  • CVE-2026-92079

    Mitigation bypass in the Widget: Win32 component

MFSA 2026-90Gecko 156Android1.2.873 CVEs
Mozilla advisory
Android release notes1.2.8 1.2.8.1
  • CVE-2026-92005

    Use-after-free in the Audio/Video: Web Codecs component

  • CVE-2026-92006

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92007

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92008

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92009

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92010

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92011

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92012

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92013

    Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-92015

    Privilege escalation in the WebExtensions component

  • CVE-2026-92034

    Site isolation issue in the Graphics component

  • CVE-2026-92035

    Sandbox escape due to incorrect boundary conditions in the Graphics component

  • CVE-2026-92016

    Use-after-free in the Disability Access APIs component

  • CVE-2026-92017

    Privilege escalation in the DOM: Service Workers component

  • CVE-2026-92018

    Sandbox escape in the DOM: Core & HTML component

  • CVE-2026-92020

    Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

  • CVE-2026-92022

    Use-after-free in the DOM: HTML Parser component

  • CVE-2026-92023

    Use-after-free in the XML component

  • CVE-2026-92024

    Use-after-free in the SVG component

  • CVE-2026-92025

    Use-after-free in the DOM: Navigation component

  • CVE-2026-92026

    Use-after-free in the Networking component

  • CVE-2026-92036

    Incorrect boundary conditions in the Networking: HTTP component

  • CVE-2026-92027

    Use-after-free in the DOM: Streams component

  • CVE-2026-92028

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-92029

    Use-after-free in the SVG component

  • CVE-2026-92037

    Incorrect boundary conditions in the DOM: Animation component

  • CVE-2026-92038

    Mitigation bypass in the Remote Settings Client component

  • CVE-2026-92039

    Mitigation bypass in the DOM: Notifications component

  • CVE-2026-92040

    Use-after-free in the JavaScript: WebAssembly component

  • CVE-2026-92041

    Mitigation bypass in the DOM: Networking component

  • CVE-2026-92033

    Privilege escalation in Firefox for Android

  • CVE-2026-92042

    Race condition in the DOM: Content Processes component

  • CVE-2026-92043

    Privilege escalation due to incorrect boundary conditions in the Audio/Video component

  • CVE-2026-92044

    Information disclosure in the Networking: HTTP component

  • CVE-2026-92045

    Sandbox escape due to incorrect boundary conditions in the WebRTC component

  • CVE-2026-92030

    Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

  • CVE-2026-92046

    Use-after-free in the Graphics component

  • CVE-2026-92047

    Privilege escalation in the Crash Reporting component

  • CVE-2026-92048

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92049

    Use-after-free in the Widget: Win32 component

  • CVE-2026-92050

    Sandbox escape due to race condition in the XPConnect component

  • CVE-2026-92051

    Spoofing issue due to invalid pointer in the Graphics component

  • CVE-2026-92052

    Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component

  • CVE-2026-92053

    Privilege escalation in the Graphics: CanvasWebGL component

  • CVE-2026-92054

    Privilege escalation in the Memory component

  • CVE-2026-92055

    Privilege escalation in the DevTools component

  • CVE-2026-92056

    Use-after-free in the Graphics: Text component

  • CVE-2026-92019

    Mitigation bypass in the Remote Settings Client component

  • CVE-2026-92057

    Mitigation bypass in the Enterprise Policies component

  • CVE-2026-92031

    Information disclosure in the Graphics: ImageLib component

  • CVE-2026-92032

    Sandbox escape due to invalid pointer in the Graphics component

  • CVE-2026-92058

    Use-after-free in the Graphics component

  • CVE-2026-92059

    Incorrect boundary conditions in the DOM: Editor component

  • CVE-2026-92060

    Use-after-free in the Internationalization component

  • CVE-2026-92061

    Incorrect boundary conditions in the Security: Process Sandboxing component

  • CVE-2026-92062

    Privilege escalation in the Session Restore component

  • CVE-2026-92063

    Denial-of-service in the Audio/Video component

  • CVE-2026-92064

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92065

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92066

    Sandbox escape in the Profile Backup component

  • CVE-2026-92067

    Use-after-free in the Widget: Gtk component

  • CVE-2026-92068

    Site isolation issue in the Reader Mode component

  • CVE-2026-92069

    Spoofing issue in the DOM: Navigation component

  • CVE-2026-92070

    Information disclosure in the Networking component

  • CVE-2026-92071

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-92072

    Incorrect boundary conditions in the Safe Browsing component

  • CVE-2026-92073

    Privilege escalation in the Enterprise Policies component

  • CVE-2026-92074

    Mitigation bypass in the Popup Blocker component

  • CVE-2026-92075

    Mitigation bypass in the Networking component

  • CVE-2026-92076

    Incorrect boundary conditions in the Networking component

  • CVE-2026-92077

    Denial-of-service in the SVG component

  • CVE-2026-92078

    Denial-of-service in the Security component

  • CVE-2026-92079

    Mitigation bypass in the Widget: Win32 component

MFSA 2026-85Gecko 153.2 ESRDesktop6.7.224 CVEs
Mozilla advisory
Desktop release notes6.7.2
  • CVE-2026-75874

    Sandbox escape in the Remote Settings Client component

  • CVE-2026-84118

    Use-after-free in the JavaScript: GC component

  • CVE-2026-84119

    Sandbox escape due to use-after-free in the DOM: Navigation component

  • CVE-2026-84120

    Use-after-free in the Audio/Video component

  • CVE-2026-84121

    Sandbox escape due to use-after-free in the DOM: Security component

  • CVE-2026-84122

    Use-after-free in the Audio/Video component

  • CVE-2026-84123

    Privilege escalation due to use-after-free in the Graphics: WebGPU component

  • CVE-2026-84124

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-84125

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-74952

    Privilege escalation in the Application Update component

  • CVE-2026-84129

    Site isolation issue in the DOM: Navigation component

  • CVE-2026-84130

    Information disclosure in the Graphics: WebGPU component

  • CVE-2026-84131

    Privilege escalation due to invalid pointer in the Graphics component

  • CVE-2026-84132

    Information disclosure in the Networking: HTTP component

  • CVE-2026-84133

    Site isolation issue in the DOM: Push Subscriptions component

  • CVE-2026-84134

    Other issue in the Profile Backup component

  • CVE-2026-84136

    Other issue in the DOM: Navigation component

  • CVE-2026-84137

    Spoofing issue in the DOM: Core & HTML component

  • CVE-2026-84139

    Clickjacking issue in the DOM: Events component

  • CVE-2026-84140

    Site isolation issue in the DOM: Navigation component

  • CVE-2026-84141

    Integer overflow in the Graphics: ImageLib component

  • CVE-2026-84143

    Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

  • CVE-2026-84144

    Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2

  • CVE-2026-84145

    Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

MFSA 2026-82Gecko 155Android1.2.729 CVEs
Mozilla advisory
Android release notes1.2.7
  • CVE-2026-84117

    Privilege escalation in Firefox for Android

  • CVE-2026-84118

    Use-after-free in the JavaScript: GC component

  • CVE-2026-84119

    Sandbox escape due to use-after-free in the DOM: Navigation component

  • CVE-2026-84120

    Use-after-free in the Audio/Video component

  • CVE-2026-84121

    Sandbox escape due to use-after-free in the DOM: Security component

  • CVE-2026-84122

    Use-after-free in the Audio/Video component

  • CVE-2026-84123

    Privilege escalation due to use-after-free in the Graphics: WebGPU component

  • CVE-2026-84124

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-84125

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-84126

    Incorrect boundary conditions in the Layout: Grid component

  • CVE-2026-84127

    Information disclosure in the WebExtensions component in Firefox for Android

  • CVE-2026-84128

    Privilege escalation in the WebDriver BiDi component

  • CVE-2026-84129

    Site isolation issue in the DOM: Navigation component

  • CVE-2026-84130

    Information disclosure in the Graphics: WebGPU component

  • CVE-2026-84131

    Privilege escalation due to invalid pointer in the Graphics component

  • CVE-2026-84132

    Information disclosure in the Networking: HTTP component

  • CVE-2026-84133

    Site isolation issue in the DOM: Push Subscriptions component

  • CVE-2026-84134

    Other issue in the Profile Backup component

  • CVE-2026-84135

    Other issue in Firefox Focus for Android

  • CVE-2026-84136

    Other issue in the DOM: Navigation component

  • CVE-2026-84137

    Spoofing issue in the DOM: Core & HTML component

  • CVE-2026-84138

    Denial-of-service in the PDF Viewer component

  • CVE-2026-84139

    Clickjacking issue in the DOM: Events component

  • CVE-2026-84140

    Site isolation issue in the DOM: Navigation component

  • CVE-2026-84141

    Integer overflow in the Graphics: ImageLib component

  • CVE-2026-84142

    Internally found bugs fixed in Firefox 155

  • CVE-2026-84143

    Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

  • CVE-2026-84144

    Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2

  • CVE-2026-84145

    Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

MFSA 2026-77Gecko 153.1 ESRDesktop6.7.052 CVEs
Mozilla advisory
Desktop release notes6.7.0
  • CVE-2026-74934

    Site isolation issue in the Graphics: CanvasWebGL component

  • CVE-2026-74935

    Privilege escalation in the DOM: Networking component

  • CVE-2026-74936

    Use-after-free in the JavaScript: WebAssembly component

  • CVE-2026-74937

    Use-after-free in the JavaScript: GC component

  • CVE-2026-74938

    Mitigation bypass in the JavaScript: GC component

  • CVE-2026-74939

    Privilege escalation in the DOM: Navigation component

  • CVE-2026-74941

    Privilege escalation in the Graphics: CanvasWebGL component

  • CVE-2026-74943

    Use-after-free in the Graphics: ImageLib component

  • CVE-2026-74944

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-74945

    Information disclosure in the Graphics: Text component

  • CVE-2026-74947

    Privilege escalation due to invalid pointer in the Graphics component

  • CVE-2026-74948

    Information disclosure in the Graphics component

  • CVE-2026-74950

    Privilege escalation in the Downloads API component

  • CVE-2026-74953

    Privilege escalation in the Networking: Cookies component

  • CVE-2026-74954

    Information disclosure due to side-channel in the Storage: Cache API component

  • CVE-2026-74955

    Privilege escalation in the Request Handling component

  • CVE-2026-74956

    Same-origin policy bypass in the DOM: Service Workers component

  • CVE-2026-74957

    Mitigation bypass in the Safe Browsing component

  • CVE-2026-74958

    Information disclosure in the WebRTC component

  • CVE-2026-74959

    Mitigation bypass in the Storage: Cache API component

  • CVE-2026-74960

    Site isolation issue in the WebExtensions component

  • CVE-2026-74961

    Side-channel in the Web Audio component

  • CVE-2026-74962

    Site isolation issue in the Networking: Cookies component

  • CVE-2026-74963

    Same-origin policy bypass in the Networking: Cookies component

  • CVE-2026-74964

    Integer overflow in the Graphics component

  • CVE-2026-74965

    Privilege escalation in the Shell Integration component

  • CVE-2026-74966

    Information disclosure in the Form Autofill component

  • CVE-2026-74940

    Use-after-free in the Graphics: Text component

  • CVE-2026-74967

    Same-origin policy bypass in the Audio/Video: Playback component

  • CVE-2026-74969

    Race condition, use-after-free in the Layout: Text and Fonts component

  • CVE-2026-74942

    Privilege escalation in the Remote Settings Client component

  • CVE-2026-74971

    Information disclosure in the DOM: UI Events & Focus Handling component

  • CVE-2026-74972

    Information disclosure in the DOM: Push Subscriptions component

  • CVE-2026-74946

    Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  • CVE-2026-74949

    Use-after-free in the Graphics: Canvas2D component

  • CVE-2026-74973

    Race condition, use-after-free in the Graphics component

  • CVE-2026-74974

    Same-origin policy bypass in the Graphics: ImageLib component

  • CVE-2026-74976

    JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-74977

    Integer overflow in the Graphics component

  • CVE-2026-74978

    Clickjacking issue in the Widget component

  • CVE-2026-74979

    Mitigation bypass in the Add-ons Manager component

  • CVE-2026-74981

    Site isolation issue in the Audio/Video: Web Codecs component

  • CVE-2026-74982

    Denial-of-service in the Widget component

  • CVE-2026-74983

    Mitigation bypass in the Data Loss Prevention component

  • CVE-2026-74984

    Race condition in the JavaScript Engine component

  • CVE-2026-74968

    Site isolation issue in the Graphics: WebRender component

  • CVE-2026-74970

    Site isolation issue in the Graphics component

  • CVE-2026-74985

    Privilege escalation in the Enterprise Policies component

  • CVE-2026-74986

    Site isolation issue in the CSS Parsing and Computation component

  • CVE-2026-74987

    Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

  • CVE-2026-74988

    Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154

  • CVE-2026-74990

    Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

MFSA 2026-68Gecko 153Android1.2.663 CVEs
Mozilla advisory
Android release notes1.2.6
  • CVE-2026-16349

    Same-origin policy bypass in the DOM: Navigation component

  • CVE-2026-16350

    Incorrect boundary conditions in the Audio/Video: cubeb component

  • CVE-2026-16362

    Use-after-free in the WebRTC: Audio/Video component

  • CVE-2026-16351

    Sandbox escape due to use-after-free in the DOM: Navigation component

  • CVE-2026-16352

    Sandbox escape due to use-after-free in the Disability Access APIs component

  • CVE-2026-16363

    JIT miscompilation in the JavaScript: WebAssembly component

  • CVE-2026-16364

    Incorrect boundary conditions in the Audio/Video: Playback component

  • CVE-2026-16365

    Privilege escalation in the DOM: Workers component

  • CVE-2026-16366

    Privilege escalation in the DOM: Navigation component

  • CVE-2026-16353

    Invalid pointer in the DOM: Bindings (WebIDL) component

  • CVE-2026-16354

    Information disclosure in the Graphics: ImageLib component

  • CVE-2026-16367

    Sandbox escape due to invalid pointer in the Disability Access APIs component

  • CVE-2026-16368

    Incorrect boundary conditions in the JavaScript: WebAssembly component

  • CVE-2026-16369

    Integer overflow in the JavaScript: WebAssembly component

  • CVE-2026-16355

    JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-16356

    Sandbox escape due to use-after-free in the Disability Access APIs component

  • CVE-2026-16357

    Incorrect boundary conditions in the Graphics component

  • CVE-2026-16370

    Mitigation bypass in the DOM: Networking component

  • CVE-2026-16371

    Privilege escalation in the DOM: Navigation component

  • CVE-2026-16372

    Privilege escalation in the DOM: Content Processes component

  • CVE-2026-16373

    Information disclosure in the Privacy component in Firefox for Android

  • CVE-2026-16374

    Information disclosure in the Framework component in DevTools

  • CVE-2026-16375

    Site isolation issue in the Networking: HTTP component

  • CVE-2026-16376

    Denial-of-service in the Graphics: WebGPU component

  • CVE-2026-16377

    Mitigation bypass in the PDF Viewer component

  • CVE-2026-16378

    Other issue in the DOM: Copy & Paste and Drag & Drop component

  • CVE-2026-16379

    Privilege escalation in the DOM: Content Processes component

  • CVE-2026-16358

    Site isolation issue in the Graphics: WebRender component

  • CVE-2026-16380

    Mitigation bypass in the Networking component

  • CVE-2026-16381

    Same-origin policy bypass in the Networking: DNS component

  • CVE-2026-16382

    Mitigation bypass in the DOM: Service Workers component

  • CVE-2026-16383

    Mitigation bypass in the DOM: Networking component

  • CVE-2026-16384

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component

  • CVE-2026-16385

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component

  • CVE-2026-16386

    Information disclosure due to uninitialized memory in the Graphics: WebGPU component

  • CVE-2026-16387

    Site isolation issue in the Networking component

  • CVE-2026-16388

    Sandbox escape in the DOM: Networking component

  • CVE-2026-16389

    Incorrect boundary conditions, integer overflow in the Libraries component in NSS

  • CVE-2026-16390

    Mitigation bypass in the Enterprise Policies component

  • CVE-2026-16391

    Information disclosure in the Storage: IndexedDB component

  • CVE-2026-16392

    JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-16393

    Incorrect boundary conditions in the Graphics: WebGPU component

  • CVE-2026-16359

    Incorrect boundary conditions in the Audio/Video: GMP component

  • CVE-2026-16394

    Mitigation bypass in the DOM: Security component

  • CVE-2026-16395

    Integer overflow in the Audio/Video component

  • CVE-2026-16396

    Privilege escalation in WebExtensions

  • CVE-2026-16397

    Clickjacking issue in the WebExtensions component in Firefox for Android

  • CVE-2026-16398

    Site isolation issue in the Graphics component

  • CVE-2026-16399

    Site isolation issue in the DOM: Navigation component

  • CVE-2026-16400

    Information disclosure in the DOM: Security component

  • CVE-2026-16401

    Privilege escalation in the Data Loss Prevention component

  • CVE-2026-16402

    Integer overflow in the Graphics: ImageLib component

  • CVE-2026-16403

    Spoofing issue in the Address Bar component

  • CVE-2026-16404

    Spoofing issue in Firefox for Android

  • CVE-2026-16405

    Information disclosure in the Networking: WebSockets component

  • CVE-2026-16406

    Mitigation bypass in the Networking component

  • CVE-2026-16407

    Mitigation bypass in the DOM: Service Workers component

  • CVE-2026-16408

    Integer overflow in the Audio/Video: Playback component

  • CVE-2026-16409

    Invalid pointer in the Security: PSM component

  • CVE-2026-16410

    JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-16411

    Memory safety bugs fixed in Firefox 153

  • CVE-2026-16412

    Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

  • CVE-2026-16360

    Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

MFSA 2026-62Gecko 152.0.4Android1.2.51 CVE
Mozilla advisory
Android release notes1.2.5
MFSA 2026-57Gecko 152Android1.2.540 CVEs
Mozilla advisory
Android release notes1.2.5
MFSA 2026-46Gecko 151Android1.2.431 CVEs
Mozilla advisory
Android release notes1.2.4
  • CVE-2026-8945

    Sandbox escape in Firefox and Firefox Focus for Android

  • CVE-2026-8946

    Incorrect boundary conditions in the Audio/Video: Web Codecs component

  • CVE-2026-8947

    Use-after-free in the DOM: Bindings (WebIDL) component

  • CVE-2026-8948

    Same-origin policy bypass in the DOM: Networking component

  • CVE-2026-8949

    Integer overflow in the Widget: Win32 component

  • CVE-2026-8950

    Same-origin policy bypass in the Networking: HTTP component

  • CVE-2026-8951

    Spoofing issue in the Toolbar component in Firefox for Android

  • CVE-2026-8952

    Privilege escalation in the Application Update component

  • CVE-2026-8953

    Sandbox escape due to use-after-free in the Disability Access APIs component

  • CVE-2026-8954

    Incorrect boundary conditions, integer overflow in the Audio/Video component

  • CVE-2026-8955

    Privilege escalation in the DOM: Workers component

  • CVE-2026-8956

    Integer overflow in the Networking: JAR component

  • CVE-2026-8957

    Privilege escalation in the Enterprise Policies component

  • CVE-2026-8958

    Information disclosure, sandbox escape in the Security: Process Sandboxing component

  • CVE-2026-8959

    Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

  • CVE-2026-8960

    Spoofing issue in WebExtensions

  • CVE-2026-8961

    Spoofing issue in the Form Autofill component

  • CVE-2026-8962

    Mitigation bypass in the DOM: Security component

  • CVE-2026-8963

    Spoofing issue in the Web Speech component

  • CVE-2026-8964

    Spoofing issue in the Popup Blocker component

  • CVE-2026-8965

    Information disclosure in the DOM: Security component

  • CVE-2026-8966

    Information disclosure in the IP Protection component

  • CVE-2026-8967

    Information disclosure in the Graphics: WebGPU component

  • CVE-2026-8968

    Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

  • CVE-2026-8969

    Mitigation bypass in the DOM: Security component

  • CVE-2026-8970

    Privilege escalation in the Security component

  • CVE-2026-8971

    Same-origin policy bypass in the Networking: JAR component

  • CVE-2026-8972

    Privilege escalation in the WebRTC: Audio/Video component

  • CVE-2026-8973

    Memory safety bugs fixed in Firefox 151

  • CVE-2026-8974

    Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151

  • CVE-2026-8975

    Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151

MFSA 2026-30Gecko 150Android1.2.343 CVEs
Mozilla advisory
Android release notes1.2.3
  • CVE-2026-6746

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-6747

    Use-after-free in the WebRTC component

  • CVE-2026-6748

    Uninitialized memory in the Audio/Video: Web Codecs component

  • CVE-2026-6749

    Information disclosure due to uninitialized memory in the Graphics: Canvas2D component

  • CVE-2026-6750

    Privilege escalation in the Graphics: WebRender component

  • CVE-2026-6751

    Uninitialized memory in the Audio/Video: Web Codecs component

  • CVE-2026-6752

    Incorrect boundary conditions in the WebRTC component

  • CVE-2026-6753

    Incorrect boundary conditions in the WebRTC component

  • CVE-2026-6754

    Use-after-free in the JavaScript Engine component

  • CVE-2026-6755

    Mitigation bypass in the DOM: postMessage component

  • CVE-2026-6756

    Mitigation bypass in Firefox for Android

  • CVE-2026-6757

    Invalid pointer in the JavaScript: WebAssembly component

  • CVE-2026-6758

    Use-after-free in the JavaScript: WebAssembly component

  • CVE-2026-6759

    Use-after-free in the Widget: Cocoa component

  • CVE-2026-6760

    Mitigation bypass in the Networking: Cookies component

  • CVE-2026-6761

    Privilege escalation in the Networking component

  • CVE-2026-6762

    Spoofing issue in the DOM: Core & HTML component

  • CVE-2026-6763

    Mitigation bypass in the File Handling component

  • CVE-2026-6764

    Incorrect boundary conditions in the DOM: Device Interfaces component

  • CVE-2026-6765

    Information disclosure in the Form Autofill component

  • CVE-2026-6766

    Incorrect boundary conditions in the Libraries component in NSS

  • CVE-2026-6767

    Other issue in the Libraries component in NSS

  • CVE-2026-6768

    Mitigation bypass in the Networking: Cookies component

  • CVE-2026-6769

    Privilege escalation in the Debugger component

  • CVE-2026-6770

    Other issue in the Storage: IndexedDB component

  • CVE-2026-6771

    Mitigation bypass in the DOM: Security component

  • CVE-2026-6772

    Incorrect boundary conditions in the Libraries component in NSS

  • CVE-2026-6773

    Denial-of-service due to integer overflow in the Graphics: WebGPU component

  • CVE-2026-6774

    Mitigation bypass in the DOM: Security component

  • CVE-2026-6775

    Incorrect boundary conditions in the WebRTC component

  • CVE-2026-6776

    Incorrect boundary conditions in the WebRTC: Networking component

  • CVE-2026-6777

    Other issue in the Networking: DNS component

  • CVE-2026-6778

    Invalid pointer in the Audio/Video: Playback component

  • CVE-2026-6779

    Other issue in the JavaScript Engine component

  • CVE-2026-6780

    Denial-of-service in the Audio/Video: Playback component

  • CVE-2026-6781

    Denial-of-service in the Audio/Video: Playback component

  • CVE-2026-6782

    Information disclosure in the IP Protection component

  • CVE-2026-6783

    Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component

  • CVE-2026-7321

    Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component

  • CVE-2026-8091

    Incorrect boundary conditions in the Audio/Video: Playback component

  • CVE-2026-6784

    Memory safety bugs fixed in Firefox 150 and Thunderbird 150

  • CVE-2026-6785

    Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

  • CVE-2026-6786

    Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

MFSA 2026-20Gecko 149Android1.2.246 CVEs
Mozilla advisory
Android release notes1.2.2
  • CVE-2026-4684

    Race condition, use-after-free in the Graphics: WebRender component

  • CVE-2026-4685

    Incorrect boundary conditions in the Graphics: Canvas2D component

  • CVE-2026-4686

    Incorrect boundary conditions in the Graphics: Canvas2D component

  • CVE-2026-4687

    Sandbox escape due to incorrect boundary conditions in the Telemetry component

  • CVE-2026-4688

    Sandbox escape due to use-after-free in the Disability Access APIs component

  • CVE-2026-4689

    Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

  • CVE-2026-4690

    Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

  • CVE-2026-4691

    Use-after-free in the CSS Parsing and Computation component

  • CVE-2026-4692

    Sandbox escape in the Responsive Design Mode component

  • CVE-2026-4693

    Incorrect boundary conditions in the Audio/Video: Playback component

  • CVE-2026-4694

    Incorrect boundary conditions, integer overflow in the Graphics component

  • CVE-2026-4695

    Incorrect boundary conditions in the Audio/Video: Web Codecs component

  • CVE-2026-4696

    Use-after-free in the Layout: Text and Fonts component

  • CVE-2026-4697

    Incorrect boundary conditions in the Audio/Video: Web Codecs component

  • CVE-2026-4698

    JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-4699

    Incorrect boundary conditions in the Layout: Text and Fonts component

  • CVE-2026-4700

    Mitigation bypass in the Networking: HTTP component

  • CVE-2026-4701

    Use-after-free in the JavaScript Engine component

  • CVE-2026-4722

    Privilege escalation in the IPC component

  • CVE-2026-4702

    JIT miscompilation in the JavaScript Engine component

  • CVE-2026-4723

    Use-after-free in the JavaScript Engine component

  • CVE-2026-4724

    Undefined behavior in the Audio/Video component

  • CVE-2026-4704

    Denial-of-service in the WebRTC: Signaling component

  • CVE-2026-4705

    Undefined behavior in the WebRTC: Signaling component

  • CVE-2026-4706

    Incorrect boundary conditions in the Graphics: Canvas2D component

  • CVE-2026-4707

    Incorrect boundary conditions in the Graphics: Canvas2D component

  • CVE-2026-4708

    Incorrect boundary conditions in the Graphics component

  • CVE-2026-4709

    Incorrect boundary conditions in the Audio/Video: GMP component

  • CVE-2026-4710

    Incorrect boundary conditions in the Audio/Video component

  • CVE-2026-4711

    Use-after-free in the Widget: Cocoa component

  • CVE-2026-4725

    Sandbox escape due to use-after-free in the Graphics: Canvas2D component

  • CVE-2026-4712

    Information disclosure in the Widget: Cocoa component

  • CVE-2026-4713

    Incorrect boundary conditions in the Graphics component

  • CVE-2026-4714

    Incorrect boundary conditions in the Audio/Video component

  • CVE-2026-4715

    Uninitialized memory in the Graphics: Canvas2D component

  • CVE-2026-4716

    Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component

  • CVE-2026-4717

    Privilege escalation in the Netmonitor component

  • CVE-2026-4726

    Denial-of-service in the XML component

  • CVE-2025-59375

    Denial-of-service in the XML component

  • CVE-2026-4727

    Denial-of-service in the Libraries component in NSS

  • CVE-2026-4728

    Spoofing issue in the Privacy: Anti-Tracking component

  • CVE-2026-4718

    Undefined behavior in the WebRTC: Signaling component

  • CVE-2026-4719

    Incorrect boundary conditions in the Graphics: Text component

  • CVE-2026-4720

    Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

  • CVE-2026-4729

    Memory safety bugs fixed in Firefox 149 and Thunderbird 149

  • CVE-2026-4721

    Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

MFSA 2026-19Gecko 148.0.2Android1.2.13 CVEs
Mozilla advisory
Android release notes1.2.1
  • CVE-2026-3845

    Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android

  • CVE-2026-3846

    Same-origin policy bypass in the CSS Parsing and Computation component

  • CVE-2026-3847

    Memory safety bugs fixed in Firefox 148.0.2

MFSA 2026-13Gecko 148Android1.2.051 CVEs
Mozilla advisory
Android release notes1.2.0
  • CVE-2026-2757

    Incorrect boundary conditions in the WebRTC: Audio/Video component

  • CVE-2026-2794

    Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android

  • CVE-2026-2758

    Use-after-free in the JavaScript: GC component

  • CVE-2026-2759

    Incorrect boundary conditions in the Graphics: ImageLib component

  • CVE-2026-2795

    Use-after-free in the JavaScript: GC component

  • CVE-2026-2760

    Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

  • CVE-2026-2761

    Sandbox escape in the Graphics: WebRender component

  • CVE-2026-2762

    Integer overflow in the JavaScript: Standard Library component

  • CVE-2026-2763

    Use-after-free in the JavaScript Engine component

  • CVE-2026-2764

    JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

  • CVE-2026-2796

    JIT miscompilation in the JavaScript: WebAssembly component

  • CVE-2026-2797

    Use-after-free in the JavaScript: GC component

  • CVE-2026-2765

    Use-after-free in the JavaScript Engine component

  • CVE-2026-2766

    Use-after-free in the JavaScript Engine: JIT component

  • CVE-2026-2767

    Use-after-free in the JavaScript: WebAssembly component

  • CVE-2026-2768

    Sandbox escape in the Storage: IndexedDB component

  • CVE-2026-2798

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-2769

    Use-after-free in the Storage: IndexedDB component

  • CVE-2026-2799

    Use-after-free in the DOM: Core & HTML component

  • CVE-2026-2770

    Use-after-free in the DOM: Bindings (WebIDL) component

  • CVE-2026-2771

    Undefined behavior in the DOM: Core & HTML component

  • CVE-2026-2772

    Use-after-free in the Audio/Video: Playback component

  • CVE-2026-2773

    Incorrect boundary conditions in the Web Audio component

  • CVE-2026-2774

    Integer overflow in the Audio/Video component

  • CVE-2026-2775

    Mitigation bypass in the DOM: HTML Parser component

  • CVE-2026-2776

    Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

  • CVE-2026-2777

    Privilege escalation in the Messaging System component

  • CVE-2026-2778

    Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

  • CVE-2026-2779

    Incorrect boundary conditions in the Networking: JAR component

  • CVE-2026-2800

    Spoofing issue in the WebAuthn component in Firefox for Android

  • CVE-2026-2780

    Privilege escalation in the Netmonitor component

  • CVE-2026-2781

    Integer overflow in the Libraries component in NSS

  • CVE-2026-2801

    Incorrect boundary conditions in the JavaScript: WebAssembly component

  • CVE-2026-2782

    Privilege escalation in the Netmonitor component

  • CVE-2026-2783

    Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component

  • CVE-2026-2802

    Race condition in the JavaScript: GC component

  • CVE-2026-2803

    Information disclosure, mitigation bypass in the Settings UI component

  • CVE-2026-2784

    Mitigation bypass in the DOM: Security component

  • CVE-2026-2785

    Invalid pointer in the JavaScript Engine component

  • CVE-2026-2804

    Use-after-free in the JavaScript: WebAssembly component

  • CVE-2026-2786

    Use-after-free in the JavaScript Engine component

  • CVE-2026-2805

    Invalid pointer in the DOM: Core & HTML component

  • CVE-2026-2787

    Use-after-free in the DOM: Window and Location component

  • CVE-2026-2788

    Incorrect boundary conditions in the Audio/Video: GMP component

  • CVE-2026-2789

    Use-after-free in the Graphics: ImageLib component

  • CVE-2026-2806

    Uninitialized memory in the Graphics: Text component

  • CVE-2026-2790

    Same-origin policy bypass in the Networking: JAR component

  • CVE-2026-2791

    Mitigation bypass in the Networking: Cache component

  • CVE-2026-2807

    Memory safety bugs fixed in Firefox 148 and Thunderbird 148

  • CVE-2026-2792

    Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

  • CVE-2026-2793

    Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148