Skip to content
COOEY

FAIL › dossier

Firefox and Thunderbird

PRODUCT

· dossier confidence 20%

Mozilla Firefox and Thunderbird are widely used but have a documented history of high-severity vulnerabilities including remote code execution and use-after-free flaws that have been actively exploited. The Mozilla Foundation's track record shows repeated critical flaws in core engine components requiring urgent patching and hardening for defense-industrial-base environments.

Failure events
6
Zero-days
0
RCEs
5
On KEV
6
Critical
0
Worst shame
85
PROFILE
CategorySoftwareWhat they doMozilla Firefox is a web browser and Thunderbird is an email client, both developed by the Mozilla Foundation. Websitehttps://www.mozilla.org ↗
SECURITY POSTURE

The Mozilla Foundation has a history of high-severity vulnerabilities in Firefox and Thunderbird, including remote code execution, use-after-free, and type confusion flaws that have been actively exploited in the wild.

Notable failures
  • CVE-2019-11708 sandbox escape RCE
  • CVE-2019-11707 type confusion crash
  • CVE-2020-6819 use-after-free race condition
  • CVE-2020-6820 use-after-free race condition
  • CVE-2019-17026 type confusion in IonMonkey JIT
  • CVE-2013-1690 DoS/RCE
Patterns: repeated high-severity RCE and use-after-free vulnerabilities; type confusion flaws in core engine components; active exploitation of sandbox escape flaws in the wild
FAILURE HISTORY · 6
DATEEVENTSEVSUMMARY
2022-05-23 CVE-2019-11708 high Mozilla Firefox and Thunderbird suffered a sandbox escape vulnerability allowing remote code execution, which was actively exploited in the wild.
2021-11-03 CVE-2020-6819 high Mozilla Firefox and Thunderbird suffered a use-after-free vulnerability that was actively exploited in the wild.
2021-11-03 CVE-2020-6820 high Firefox and Thunderbird suffered a use-after-free vulnerability in their ReadableStream handling that was actively exploited in the wild.
2021-11-03 CVE-2019-17026 high Mozilla Firefox and Thunderbird suffered a type confusion vulnerability in the IonMonkey JIT compiler that was actively exploited in the wild.
2022-05-23 CVE-2019-11707 high A type confusion vulnerability in Firefox and Thunderbird's Array.pop function allowed an exploitable crash, listed in CISA's KEV catalog.
2022-03-28 CVE-2013-1690 high A DoS vulnerability in Firefox and Thunderbird allowed remote attackers to cause denial-of-service or possibly execute malicious code via crafted websites.
DOSSIER SOURCES
Open questions: Current patch cycle SLA for critical vulnerabilities · Specific CMMC compliance posture of Mozilla Foundation
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-14 03:46:43.386012+00:00