VendorsPlatform
Mozilla
Mozilla makes the Firefox web browser (including the Extended Support Release) and, through MZLA, the Thunderbird email client.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 27 Oct 2010
- Incidents on record
- 1 (1 not yet reviewed)
Response to exploited bugs
Not rated. No reviewed zero-days yet.
Fixing privately reported bugs
74 range 57–90rank 15 of 20
Provisional 4 private reports, published on 3 dates. Not enough yet for a firm grade.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
- Fixing privately reported bugs: B- (74), provisional. Median 64 days from private report to fix (4 cases, 1 with a vendor fix date). 1 of 4 took longer than ZDI's 120-day deadline. All concern Firefox. 1 more case is held back until their dates are checked.
- No exploited incidents on record for the last 36 months.
Response to exploited bugs: sub-scores
- Time to first advisoryNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to first fixNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- Time to fix all versionsNo reviewed zero-days in the last 36 monthsNR0 cases, not used
- OpennessNo machine-readable advisory feed listed424 cases, low confidence, not used for this vendor
Fixing privately reported bugs: sub-score
- Private fix speedMedian 64 days from private report to fix (4 cases, 1 with a vendor fix date)74B−4 cases, low confidence, weight 100%
Response fingerprint
Counts toward the response grade 0
No incidents count toward the grade yet.
Not graded 1: n-days, unreviewed timelines and end-of-life products
- 27 Oct 2010Mozilla Multiple Products Remote Code Execution VulnerabilityNot graded: unreviewedNo response moments recorded
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
1 in 24 months, 0 with known ransomware use
| First report | Incident | CVSS | Silence | First fix | All fixed | Status | Grade |
|---|---|---|---|---|---|---|---|
| 27 Oct 2010 | Mozilla Multiple Products Remote Code Execution VulnerabilityCVE-2010-3765 | 9.8 | – | not dated | not dated | Unknown | Not graded: unreviewed |
Private reports
Median 64 days, 25% over 120 days, 0 published unpatched
Bugs reported privately to Mozilla by ZDI or Project Zero.
| Published | Advisory | Product | Days from report to fix or to publication. Tick: ZDI's 120-day deadline. | Patch at publication |
|---|---|---|---|---|
| 2 Apr 2026 | ZDI-26-252CVE-2026-4698 | Firefox | 22to vendor fix, 24 Mar 2026 | Yes |
| 29 Jul 2025 | ZDI-25-708CVE-2024-3863 | Firefox | 532to publication | Yes |
| 21 May 2025 | ZDI-25-291, ZDI-25-292CVE-2025-4918, CVE-2025-4919Not gradedthe linked vendor advisory https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/ is dated 2025-05-17, before the report date 2025-05-21: it describes an earlier fix | Firefox | 0to publication | Yes |
| 12 Jun 2024 | ZDI-24-665CVE-2024-29944 | Firefox | 49to publication | Yes |
| 12 Jun 2024 | ZDI-24-664CVE-2024-29943 | Firefox | 78to publication | Yes |
Grade history
Response to exploited bugs: score at the end of each month.
Not rated at any point in this period.
Channels
Get Mozilla's own alerts
- GitHubfoundation-security-advisories repositoryWatch the repository for security advisories.
- BlueskyMozilla on BlueskyFollow the account.
- BlogMozilla Security BlogSubscribe to the security blog.
- Advisory pageMozilla Foundation Security AdvisoriesCheck the advisory page. It has no push channel.
What we watch
- Advisory pageMozilla Foundation Security Advisories
- BlogMozilla Security Blog
- BlueskyMozilla on Bluesky
See sources and health for when each was last read.
Grade not rated.