1623 matches found
Security Vulnerabilities fixed in Firefox 124.0.1 — Mozilla
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This...
Security Vulnerabilities fixed in Thunderbird 91 — Mozilla
A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. Note: This issue only affected Linux operating systems. Other operating systems are unaffected. An issue present in lowering/register allocation could have led to obscure but...
Security Vulnerabilities fixed in Firefox ESR 102.12 — Mozilla
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a sit...
Security Vulnerabilities fixed in Firefox for iOS 152.4 — Mozilla
Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox...
Security Vulnerabilities fixed in Thunderbird 115.11 — Mozilla
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by...
Security Vulnerabilities fixed in Thunderbird 115.7 — Mozilla
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after...
Security vulnerabilities fixed in Firefox 52 — Mozilla
JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. A crash triggerable by web content in which an ErrorResult references unassigned memory due to a logic error. The resulting crash may be exploitabl...
Security Vulnerabilities fixed in Firefox 154 — Mozilla
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs present in...
Security Vulnerabilities fixed in Firefox ESR 140.14 — Mozilla
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs present in...
Security vulnerabilities fixed in Firefox 69.0.1 — Mozilla
When the pointer lock is enabled by a website though requestPointerLock, no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users...
NSS incorrectly permits skipping of ServerKeyExchange — Mozilla
Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where the client allows for a ECDHEECDSA exchange where the server does not send its ServerKeyExchange message instead of aborting the handshake. Instead, the NSS client will take the EC key from the ECDS...
Defense against multiple Location headers due to CRLF Injection — Mozilla
Ian Graham of Citrix Online reported that when multiple Location headers were present in a redirect response Mozilla behavior differed from other browsers: Mozilla would use the second Location header while Chrome and Internet Explorer would use the first. Two copies of this header with different...
Security Vulnerabilities fixed in Firefox 157.0.1 — Mozilla
CVE-2026-106016: Mitigation bypass in the File Handling component Reporter Abdulrahman Alzahrani Impact moderate References Bug 2067465...
Security Vulnerabilities fixed in Firefox 155 — Mozilla
Internally found bugs present in Firefox 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR...
Firefox SVG Animation Remote Code Execution — Mozilla
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows...
Delegated OCSP responder certificates failure with id-pkix-ocsp-nocheck extension — Mozilla
Brian Smith reported that delegated Online Certificate Status Protocol OCSP responder certificates fail to recognize the id-pkix-ocsp-nocheck extension. If this extension is present in a delegated OCSP response signing certificate, it will be discarded if it is signed by such a certificate. This...
Crash during WAV audio file decoding — Mozilla
Security researcher Aki Helin from OUSPG used the Address Sanitizer tool to discover a crash during the decoding of WAV format audio files in some instances. This crash is not exploitable but could be used for a denial of service DOS attack by malicious parties...
Security Vulnerabilities fixed in Firefox ESR 153.3 — Mozilla
Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component Reporter...
Security Vulnerabilities fixed in Thunderbird 115.0.1 — Mozilla
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in...
Security Vulnerabilities fixed in Firefox ESR 91.6 — Mozilla
A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.This bug only affects Firefox on Windows. Other operating systems are unaffected. If a user...
Security Vulnerabilities fixed in Firefox ESR 91.3 — Mozilla
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have...
Security Vulnerabilities fixed in Firefox ESR 78.2 — Mozilla
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to ...
Security Vulnerabilities fixed in Thunderbird 68.6 — Mozilla
When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during scrip...
Security vulnerabilities fixed in - Thunderbird 68.2 — Mozilla
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early. A subsequent call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read. When following the value's prototype chain, it...
Exploitable WebGL crash with Cesium JavaScript library — Mozilla
Developer Patrick Cozzi reported a crash in some circumstances when using the Cesium JavaScript library to generate WebGL content. Mozilla developers determined that this crash is potentially exploitable...
libpng integer overflow — Mozilla
An integer overflow in the libpng library can lead to a heap-buffer overflow when decompressing certain PNG images. This leads to a crash, which may be potentially exploitable...
Security Vulnerabilities fixed in Firefox for Android 153.0.3 — Mozilla
CVE-2026-18809: Information disclosure in Firefox for Android and Firefox Focus for Android Reporter The Mozilla Fuzzing Team Impact high References Bug 2055683...
Security Vulnerabilities fixed in Firefox 152.0.4 — Mozilla
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code...
Security Vulnerabilities fixed in Firefox 129 — Mozilla
Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape....
Security Vulnerabilities fixed in Firefox ESR 68.7 — Mozilla
A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference value...
Security Vulnerabilities fixed in Firefox for iOS 151.1 — Mozilla
Firefox for iOS displayed specially crafted right-to-left RTL and internationalized domain names IDNs incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins...
Security vulnerabilities fixed in Firefox 64 — Mozilla
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the...
Memory corruption during failed plugin initialization — Mozilla
Mozilla developer Robert Kaiser Kairo reported that a race condition when initialization of a plugin fails led to a potentially exploitable use-after-free vulnerability...
Privilege escalation using WebIDL-implemented APIs — Mozilla
Security researcher Mariusz Mlynski, via TippingPoint's Pwn2Own contest, reported that it is possible for untrusted web content to load a chrome-privileged page by getting JavaScript-implemented WebIDL to call window.open. A second bug allowed the bypassing of the popup-blocker without user...
Security Vulnerabilities fixed in Firefox ESR 102.8 — Mozilla
The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode...
Security Vulnerabilities fixed in Thunderbird 78.2 — Mozilla
If Thunderbird is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back...
Security vulnerabilities fixed in Firefox 50.1 — Mozilla
A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. Event...
Heap overflow in gdk-pixbuf when scaling bitmap images — Mozilla
Security researcher Gustavo Grieco reported a heap overflow in gdk-pixbuf affecting Linux systems using Gnome. This issue is triggered by the scaling of a malformed bitmap format image and results in a potentially exploitable crash...
Security Vulnerabilities fixed in Firefox ESR 153.2 — Mozilla
Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs present in...
Security Vulnerabilities fixed in Firefox for iOS 151.0 — Mozilla
Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies...
Security Vulnerabilities fixed in Firefox 124 — Mozilla
An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. Passing invalid data could have led to invalid wasm values being created, such as...
Security Vulnerabilities fixed in Firefox 78 — Mozilla
When %2F was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. A VideoStreamEncoder may have been freed in a race...
Gecko memory corruption — Mozilla
Google security researcher Abhishek Arya used the Address Sanitizer tool to uncover four issues: two use-after-free problems, one out of bounds read bug, and a bad cast. The first use-after-free problem is caused when an array of nsSMILTimeValueSpec objects is destroyed but attempts are made to...
Security vulnerabilities fixed in Firefox 51 — Mozilla
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. Use-after-free while manipulating XSL in XSLT documents A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potential...
defaultValue security checks not applied — Mozilla
Mozilla security researcher mozbugra4 reported a regression where security wrappers are unwrapped without doing a security check in defaultValue. This can allow for improper access to the Location object. In versions 15 and earlier of affected products, there was also the potential for arbitrary...
Security issues addressed in Thunderbird 6 — Mozilla
Many of the issues listed below are not exploitable through mail since JavaScript is disabled by default in Thunderbird. These particular issues may be triggered while viewing RSS feeds and displaying full remote content rather than the feed summary. Addons that expose browser functionality may...
Security Vulnerabilities fixed in Firefox 152.0.6 — Mozilla
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...
Security Vulnerabilities fixed in Firefox ESR 78.12 — Mozilla
A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug only affected Firefox when accessibility was enabled. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable...
Security Vulnerabilities fixed in Firefox 81 — Mozilla
When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original si...
integer overflow in createImageBitmap() — Mozilla
An integer overflow in createImageBitmap was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer...