CVE-2012-1131

CVE-2012-1131 is a FreeType vulnerability affecting 64-bit platforms where the cell-table handling in FreeType before 2.4.9 can trigger a denial of service or potential arbitrary code execution via crafted font data. It is referenced across multiple advisories (e.g., MiracleLinux, Oracle Solaris/...

CVE-2012-1143

CVE-2012-1143 affects FreeType (FreeType before 2.4.9) as used by Firefox Mobile and other products. The issue is a divide-by-zero in font parsing when handling crafted fonts, enabling remote DoS. Exploitation details are not provided in the connected documents; remediation is to upgrade to a pat...

CVE-2023-49060

CVE-2023-49060 affects Firefox for iOS prior to 120. The issue allows an attacker to exfiltrate a security key from Reader Mode by abusing the referrerpolicy attribute, potentially enabling access to internal pages/data. Root cause: misuse of Reader Mode and referrer policy handling leading to da...

CVE-2012-1132

The connected MiracleLinux security advisory AXSA:2012-513:02 fixes multiple FreeType CVEs, including CVE-2012-1132. MiracleLinux 4 lists freetype-2.3.11-6.AXS4.9 as affected; the advisory indicates a backported patch addresses the listed CVEs and notes the Remote host requires updated packages. ...

CVE-2020-15661

The CVE affects Firefox for iOS before version 28. A rogue webpage can override the injected WKUserScript used by the login autofill, potentially leaking the password for the current domain. This is caused by an override in the login autofill workflow. Mitigation per connected sources is to upgra...

CVE-2012-1133

CVE-2012-1133 affects FreeType prior to 2.4.9 and is triggered when processing font data (e.g., BDF fonts) in Mozilla Firefox Mobile and other products. The issue can cause a denial of service via invalid heap write and memory corruption and may possibly lead to arbitrary code execution. Affected...

CVE-2020-12414

CVE-2020-12414 affects Firefox for iOS prior to version 27. The issue is that IndexedDB is not cleared upon leaving Private Browsing mode due to incorrect use of WKWebViewConfiguration API, which requires the private instance to be deleted when exiting private mode. Published references confirm M...

CVE-2012-1137

CVE-2012-1137 targets FreeType, specifically versions before 2.4.9 used by Mozilla Firefox Mobile and other products. The vulnerability arises from processing BDF fonts, where a crafted header can cause an invalid heap read and memory corruption, leading to denial of service and possibly remote c...

CVE-2012-1138

CVE-2012-1138 is a vulnerability in FreeType up to version 2.4.8 (prefix ‘before 2.4.9’) used in Mozilla Firefox Mobile and other products. The issue allows remote attackers to trigger denial of service (invalid heap read/memory corruption) or possibly execute arbitrary code via font data (MIRP i...

CVE-2020-15671

CVE-2020-15671 involves a race condition in Firefox for Android (

CVE-2012-1130

CVE-2012-1130 concerns the FreeType library: FreeType before 2.4.9 can be exploited via crafted PCF fonts to cause a remote denial of service or memory corruption, with potential code execution when used by Mozilla Firefox Mobile and other products. Connected documents reference multiple vendor a...

CVE-2019-17003

CVE-2019-17003 describes that scanning a QR code containing a javascript: URL could cause JavaScript to be executed. Connected sources consistently reference this behavior and assign a CVSS v3.1 base score of 6.1 (MEDIUM) with NETWORK attack vector, UI: REQUIRED, and impact on Confidentiality/Int...

CVE-2020-15662

The CVE-2020-15662 vulnerability affects Firefox for iOS

CVE-2012-1140

CVE-2012-1140 : FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, can be exploited by a crafted PostScript font object to cause a denial of service (invalid heap read and memory corruption) or possibly execute arbitrary code. The vulnerability is rooted in...

CVE-2012-3979

CVE-2012-3979 : The OpenVAS/Nessus entries indicate a vulnerability in Mozilla Firefox for Android where insecure use of __android_log_print can be triggered by a crafted web page using the dump() function, potentially allowing remote code execution. The issue is tied to Firefox for Android speci...

CVE-2012-1128

CVE-2012-1128 affects FreeType before 2.4.9 (as used in Mozilla Firefox Mobile before 10.0.4 and other products). The vulnerability allows remote attackers to trigger a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType fon...

CVE-2012-1135

CVE-2012-1135 is a vulnerability in FreeType prior to 2.4.9, affecting FreeType as used in Mozilla Firefox Mobile before 10.0.4. The issue allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors in a T...

CVE-2012-1127

CVE-2012-1127 affects the FreeType font engine (versions before 2.4.9 as used by Mozilla Firefox Mobile and other products). The issue allows remote attackers to cause a denial of service (invalid heap read or memory corruption) or possibly execute arbitrary code via crafted font data (glyphs/bit...

CVE-2026-14906

The Firefox for iOS application is vulnerable to a flaw where webpages with malicious titles could allow saved PDF content to overwrite PDF files or bundled content within the application sandbox. This issue was addressed in Firefox for iOS 152.4 . Specific exploit details or in-the-wild exploita...

CVE-2012-1139

CVE-2012-1139 is a vulnerability in the FreeType library (before 2.4.9). The issue is an array index/stack read problem in FreeType used by Mozilla Firefox Mobile (and other products) that can cause a denial of service or potentially allow arbitrary code execution when processing BDF fonts. Conne...

CVE-2023-49061

CVE-2023-49061 concerns Firefox for iOS prior to version 120, where the Reader Mode fails to neutralize HTML tags, enabling an attacker to perform HTML template injection and potentially exfiltrate user information. Affected software: Firefox for iOS

CVE-2020-12404

Summary of CVE-2020-12404 (Firefox iOS): The vulnerability arises in the native-to-JS bridge where a unique token is required to call bridging functions. The token could leak during file download, potentially enabling non-app code to access bridging functionality. Affected product: Firefox for iO...

CVE-2012-1129

FreeType 2.4.9 fixes are referenced in context of CVE-2012-1129. The vulnerability affects FreeType used in Mozilla Firefox Mobile before 10.0.4 and other products, where a crafted SFNT string in a Type 42 font can cause a denial of service (invalid heap read) and memory corruption, with potentia...

CVE-2026-84117

A privilege escalation vulnerability exists in Mozilla Firefox for Android affecting versions earlier than 155.0 . This flaw allows malicious users to bypass security restrictions on the mobile browser. The vulnerability was addressed in Firefox 155 . While specific technical details regarding th...

CVE-2026-53899

Mozilla Firefox for iOS is affected by an input validation error where the browser uses partial domain matching when attaching cookies to PDF requests. This flaw allows a malicious website hosted on a suffix domain to intercept and receive cookies belonging to the target site. The vulnerability h...

CVE-2026-74980

A clickjacking vulnerability exists in the Downloads component of Firefox for Android . This flaw was addressed in Firefox 154 . No specific exploit details or exploit links are provided in the documents, and no direct mitigation steps are listed beyond the available update. Impact is noted as pa...

CVE-2026-16373

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-74951

A clickjacking issue was identified in Firefox for Android . The vulnerability was addressed in Firefox 154 . The issue was part of the Mozilla Foundation Security Advisory MFSA 2026-74 . No specific technical root cause, exploit code, or details regarding the exploitability are provided in the d...

CVE-2026-16404

Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-53900

The Firefox for iOS mobile web browser is vulnerable to an input validation error within the TemporaryDocument component. The flaw occurs because the browser preserves cookies set during an initial PDF request across cross-origin HTTP redirects . This allows a malicious site to exploit the behavi...

CVE-2026-74975

A spoofing issue exists in the Downloads component of Firefox for Android . This vulnerability was addressed in Firefox 154 . While specific technical root causes are not detailed in the provided documents, the issue is documented as part of the MFSA 2026-74 security advisory. No specific exploit...

CVE-2026-84135

CVE-2026-84135 is a denial of service vulnerability in Firefox Focus for Android , part of Mozilla Firefox. The root cause is not publicly detailed beyond "Other issue." According to Kaspersky's advisory (MFSA2026-82), it can be exploited remotely to cause denial of service. The NVD assigns a CVS...

CVE-2026-84127

This vulnerability involves an information disclosure in the WebExtensions component within Firefox for Android . Malicious users can exploit this flaw to obtain sensitive information . The issue has been addressed in Firefox 155 . Remediation requires updating to the latest version. Public explo...

CVE-2026-81267

A malicious webpage can exploit a vulnerability in Firefox for iOS to stall a popup's cross-origin navigation after a commit. This results in the address bar displaying the destination origin while the browser continues to render content controlled by the attacker, potentially leading to address ...