CVE-2025-55029

Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks This vulnerability affects Firefox for iOS 142...

CVE-2025-54143

Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page This vulnerability affects Firefox for iOS 141...

CVE-2025-55028

Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks This vulnerability affects Firefox for iOS 142...

CVE-2025-54145

The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme This vulnerability affects Firefox for iOS 141...

UBUNTU-CVE-2025-9183

Spoofing issue in the Address Bar component. This vulnerability affects Firefox 142 and Firefox ESR 140.2...

UBUNTU-CVE-2025-9186

Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability affects Firefox 142...

UBUNTU-CVE-2025-9182

Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2...

CVE-2025-55033

The CVE describes a Cross-Site Scripting (XSS) issue in Mozilla Focus for iOS prior to version 142. The vulnerability arises when dragging JavaScript links to the URL bar, which can cause arbitrary script execution. Affected product: Focus for iOS (versions

CVE-2025-55032 Focus incorrectly ignores Content-Disposition headers for some MIME types

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks. This vulnerability was fixed in Focus for iOS 142...

CVE-2025-55032

Mozilla Focus for iOS contains a vulnerability where Content-Disposition headers of type Attachment are not respected, causing content to display inline and enabling cross-site scripting (XSS) for Focus for iOS versions prior to 142. Multiple connected sources corroborate this issue and point to ...

CVE-2025-55028

CVE-2025-55028 affects Mozilla Firefox for iOS. The issue arises from malicious scripts using repetitive JavaScript alerts that can prevent user interaction, potentially enabling denial-of-service scenarios. Affected version range is Firefox for iOS before 142. The available connected documents c...

CVE-2025-54145

The CVE-2025-54145 issue affects Mozilla Firefox for iOS, specifically versions before 141. The vulnerability arises from the QR scanner and Firefox’s open-text URL scheme, which could cause a user to load arbitrary websites. Documented impact is high (H) with user interaction required and no pri...

CVE-2025-55030

CVE-2025-55030 concerns Firefox for iOS where a mis-handling of the Content-Disposition header (Attachment) allows inline content display and potential XSS. Affected: Firefox for iOS versions prior to 142. Root cause: improper handling of the Content-Disposition header for certain MIME types. Imp...

CVE-2025-55030 Content-Disposition headers incorrectly ignored for some MIME types

Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, potentially allowing for XSS attacks. This vulnerability was fixed in Firefox for iOS 142...

CVE-2025-54144 Internal Firefox open-text URL scheme allowed loading of arbitrary URLs

The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141...

CVE-2025-8364

A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. Note: This issue only affected Android operating systems. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 141...

CVE-2025-8364 Address bar spoofing using an blob URI on Firefox for Android

A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. Note: This issue only affected Android operating systems. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 141...

CVE-2025-9187 Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142...

CVE-2025-9183 Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability affects Firefox 142 and Firefox ESR 140.2...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird