Mozilla Firefox for iOS

Name: Mozilla Firefox for iOS
Brand: Mozilla

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

2critical1high17medium0low

updated 2026-10-28

vulnerabilities (49)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-37456US	medium6.5	0.49% (42nd)	Exploit	115	2023-07-12	unspecified → 115
CVE-2020-6830US	high7.5	0.91% (60th)	—	25	2020-05-26	unspecified → 25
CVE-2020-15661US	medium6.5	0.85% (58th)	—	28	2020-08-10	unspecified → 28
CVE-2020-12404US	medium4.3	0.79% (56th)	—	26	2020-07-09	unspecified → 26
CVE-2020-15662US	medium6.5	0.68% (52nd)	—	28	2020-08-10	unspecified → 28
CVE-2020-12414US	medium6.5	0.68% (52nd)	—	27	2020-07-09	unspecified → 27
CVE-2021-29958US	medium4.3OT elevated	0.67% (52nd)	—	34	2021-06-24	unspecified → 34
CVE-2023-49060US	critical9.8	0.64% (50th)	—	120	2023-11-21	unspecified → 120
CVE-2022-1887US	critical9.8	0.62% (49th)	—	101	2022-12-22	unspecified → 101
CVE-2020-15651US	medium4.3	0.58% (48th)	—	28	2020-08-10	unspecified → 28
CVE-2025-8028US	—	0.58% (48th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2023-5758US	medium6.1	0.51% (43rd)	—	119	2023-10-25	unspecified → 119
CVE-2025-8031US	—OT elevated	0.51% (43rd)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-54143US	—	0.48% (41st)	—	no fix	2025-08-19	≤ vers:mozilla/<141
CVE-2025-8044US	—	0.48% (41st)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8042US	—	0.47% (41st)	—	no fix	2025-08-19	≤ vers:mozilla/<141
CVE-2025-8034US	—	0.46% (40th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8036US	—	0.45% (39th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2022-31746US	medium6.5	0.44% (38th)	—	102	2022-12-22	unspecified → 102
CVE-2025-8043US	—	0.43% (37th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8033US	—	0.43% (37th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8027US	—	0.43% (37th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8035US	—	0.40% (34th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-54145US	—	0.39% (33rd)	—	no fix	2025-08-19	≤ vers:mozilla/<141
CVE-2024-10004US	—	0.38% (32nd)	—	131.2	2024-10-15	unspecified → 131.2
CVE-2024-31392US	—	0.38% (32nd)	—	124	2024-04-03	2 versions
CVE-2025-8030US	—	0.38% (31st)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8029US	—	0.38% (31st)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8032US	—	0.38% (31st)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8040US	—	0.37% (31st)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8039US	—	0.34% (27th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2024-26282US	—	0.34% (27th)	—	123	2024-02-22	2 versions
CVE-2024-31393US	—	0.33% (26th)	—	124	2024-04-03	2 versions
CVE-2024-26281US	—	0.31% (24th)	—	123	2024-02-22	2 versions
CVE-2023-49061US	medium6.1	0.31% (24th)	—	120	2023-11-21	unspecified → 120
CVE-2024-0953US	medium6.1	0.31% (23rd)	—	129	2024-02-05	2 versions
CVE-2024-53976US	—	0.30% (23rd)	—	133	2024-11-26	unspecified → 133
CVE-2023-37455US	medium5.4	0.30% (23rd)	—	115	2023-07-12	unspecified → 115
CVE-2024-38312US	medium6.5	0.29% (22nd)	—	127	2024-06-13	unspecified → 127
CVE-2025-8041US	—	0.29% (21st)	—	no fix	2025-08-19	≤ vers:mozilla/<141
CVE-2024-53975US	—	0.29% (21st)	—	133	2024-11-26	unspecified → 133
CVE-2024-26283US	—	0.28% (20th)	—	123	2024-02-22	2 versions
CVE-2024-43111US	medium6.1	0.27% (19th)	—	129	2024-08-06	unspecified → 129
CVE-2025-8038US	—OT elevated	0.27% (19th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2025-8037US	—	0.27% (19th)	—	no fix	2025-07-22	≤ vers:mozilla/<141
CVE-2024-43113US	medium6.1	0.25% (17th)	—	129	2024-08-06	unspecified → 129
CVE-2024-43112US	medium6.1	0.25% (17th)	—	129	2024-08-06	unspecified → 129
CVE-2024-38313US	medium4.3	0.25% (16th)	—	127	2024-06-13	unspecified → 127
CVE-2025-54144US	—	0.23% (13th)	—	no fix	2025-08-19	≤ vers:mozilla/<141

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer5 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor5 CVEs
CWE-451User Interface (UI) Misrepresentation of Critical Information5 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames4 CVEs
CWE-20Improper Input Validation4 CVEs
CWE-601URL Redirection to Untrusted Site ('Open Redirect')4 CVEs
CWE-693Protection Mechanism Failure3 CVEs

sources (2)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)28 CVEs
NLNCSC-NL (CSAF)21 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan