CVE-2012-1142

CVE-2012-1142 refers to FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products. The issue allows a remote attacker to cause a denial of service (invalid heap write operation and memory corruption) or potentially execute arbitrary code through crafted glyph-outli...

CVE-2012-1143

CVE-2012-1143 affects FreeType (FreeType before 2.4.9) as used by Firefox Mobile and other products. The issue is a divide-by-zero in font parsing when handling crafted fonts, enabling remote DoS. Exploitation details are not provided in the connected documents; remediation is to upgrade to a pat...

CVE-2023-49060

CVE-2023-49060 affects Firefox for iOS prior to 120. The issue allows an attacker to exfiltrate a security key from Reader Mode by abusing the referrerpolicy attribute, potentially enabling access to internal pages/data. Root cause: misuse of Reader Mode and referrer policy handling leading to da...

CVE-2012-1137

CVE-2012-1137 targets FreeType, specifically versions before 2.4.9 used by Mozilla Firefox Mobile and other products. The vulnerability arises from processing BDF fonts, where a crafted header can cause an invalid heap read and memory corruption, leading to denial of service and possibly remote c...

CVE-2012-1138

CVE-2012-1138 is a vulnerability in FreeType up to version 2.4.8 (prefix ‘before 2.4.9’) used in Mozilla Firefox Mobile and other products. The issue allows remote attackers to trigger denial of service (invalid heap read/memory corruption) or possibly execute arbitrary code via font data (MIRP i...

CVE-2012-1132

The connected MiracleLinux security advisory AXSA:2012-513:02 fixes multiple FreeType CVEs, including CVE-2012-1132. MiracleLinux 4 lists freetype-2.3.11-6.AXS4.9 as affected; the advisory indicates a backported patch addresses the listed CVEs and notes the Remote host requires updated packages. ...

CVE-2020-15661

The CVE affects Firefox for iOS before version 28. A rogue webpage can override the injected WKUserScript used by the login autofill, potentially leaking the password for the current domain. This is caused by an override in the login autofill workflow. Mitigation per connected sources is to upgra...

CVE-2020-12414

CVE-2020-12414 affects Firefox for iOS prior to version 27. The issue is that IndexedDB is not cleared upon leaving Private Browsing mode due to incorrect use of WKWebViewConfiguration API, which requires the private instance to be deleted when exiting private mode. Published references confirm M...

CVE-2012-1133

CVE-2012-1133 affects FreeType prior to 2.4.9 and is triggered when processing font data (e.g., BDF fonts) in Mozilla Firefox Mobile and other products. The issue can cause a denial of service via invalid heap write and memory corruption and may possibly lead to arbitrary code execution. Affected...

CVE-2020-15671

CVE-2020-15671 involves a race condition in Firefox for Android (

CVE-2012-1130

CVE-2012-1130 concerns the FreeType library: FreeType before 2.4.9 can be exploited via crafted PCF fonts to cause a remote denial of service or memory corruption, with potential code execution when used by Mozilla Firefox Mobile and other products. Connected documents reference multiple vendor a...

CVE-2020-15662

The CVE-2020-15662 vulnerability affects Firefox for iOS

CVE-2012-1140

CVE-2012-1140 : FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, can be exploited by a crafted PostScript font object to cause a denial of service (invalid heap read and memory corruption) or possibly execute arbitrary code. The vulnerability is rooted in...

CVE-2012-1128

CVE-2012-1128 affects FreeType before 2.4.9 (as used in Mozilla Firefox Mobile before 10.0.4 and other products). The vulnerability allows remote attackers to trigger a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType fon...

CVE-2012-1135

CVE-2012-1135 is a vulnerability in FreeType prior to 2.4.9, affecting FreeType as used in Mozilla Firefox Mobile before 10.0.4. The issue allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors in a T...

CVE-2012-3979

CVE-2012-3979 : The OpenVAS/Nessus entries indicate a vulnerability in Mozilla Firefox for Android where insecure use of __android_log_print can be triggered by a crafted web page using the dump() function, potentially allowing remote code execution. The issue is tied to Firefox for Android speci...

CVE-2012-1127

CVE-2012-1127 affects the FreeType font engine (versions before 2.4.9 as used by Mozilla Firefox Mobile and other products). The issue allows remote attackers to cause a denial of service (invalid heap read or memory corruption) or possibly execute arbitrary code via crafted font data (glyphs/bit...

CVE-2019-17003

CVE-2019-17003 describes that scanning a QR code containing a javascript: URL could cause JavaScript to be executed. Connected sources consistently reference this behavior and assign a CVSS v3.1 base score of 6.1 (MEDIUM) with NETWORK attack vector, UI: REQUIRED, and impact on Confidentiality/Int...

CVE-2026-14906

Firefox for iOS is vulnerable to a flaw where pages with malicious titles could allow saved PDF content to overwrite PDF files or bundled content within the application sandbox. This issue was addressed in Firefox for iOS 152.4 . Specific exploitation details and exploit links are not provided in...

CVE-2026-84117

A privilege escalation vulnerability exists in Firefox for Android , allowing malicious users to bypass security restrictions . The vulnerability is addressed in Firefox version 155 . While public exploits exist, specific technical details regarding the root cause are not provided. Impact include...

CVE-2026-92033

A privilege escalation vulnerability exists in Firefox for Android , which has been resolved in Firefox 156 . According to the Mozilla security advisory (MFSA2026-90) , the flaw was reported by Steven Julian and carries a high impact rating. While the specific technical root cause is not detailed...

CVE-2012-1139

CVE-2012-1139 is a vulnerability in the FreeType library (before 2.4.9). The issue is an array index/stack read problem in FreeType used by Mozilla Firefox Mobile (and other products) that can cause a denial of service or potentially allow arbitrary code execution when processing BDF fonts. Conne...

CVE-2023-49061

CVE-2023-49061 concerns Firefox for iOS prior to version 120, where the Reader Mode fails to neutralize HTML tags, enabling an attacker to perform HTML template injection and potentially exfiltrate user information. Affected software: Firefox for iOS

CVE-2012-1129

FreeType 2.4.9 fixes are referenced in context of CVE-2012-1129. The vulnerability affects FreeType used in Mozilla Firefox Mobile before 10.0.4 and other products, where a crafted SFNT string in a Type 42 font can cause a denial of service (invalid heap read) and memory corruption, with potentia...

CVE-2020-12404

Summary of CVE-2020-12404 (Firefox iOS): The vulnerability arises in the native-to-JS bridge where a unique token is required to call bridging functions. The token could leak during file download, potentially enabling non-app code to access bridging functionality. Affected product: Firefox for iO...

CVE-2026-53899

Firefox for iOS is affected by an input validation vulnerability where it used partial domain matching when attaching cookies to PDF requests. This flaw allows a malicious site on a suffix domain to receive cookies belonging to the target site. The issue was addressed in Firefox for iOS 152.0 . N...

CVE-2026-74980

CVE-2026-74980 is a clickjacking vulnerability affecting the Downloads component in Firefox for Android . The vulnerability has been addressed in Firefox 154 . Documentation confirms this issue was part of a broader set of security fixes (MFSA 2026-74) and has been reported in the wild according ...

CVE-2026-16373

CVE-2026-16373 is an information disclosure vulnerability affecting the Privacy component in Firefox for Android . The issue was addressed in Firefox 153 . The vulnerability is associated with CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and is categorized with a High base...

CVE-2026-74951

Mozilla Firefox for Android is impacted by a clickjacking vulnerability, as identified in CVE-2026-74951 . This issue was addressed in Firefox 154 . While various Linux distributions (including SUSE SLES12, SLED15, and Fedora 43/44) have reported the vulnerability in their Firefox packages, it is...

CVE-2026-81267

The Firefox for iOS browser is affected by a vulnerability where a malicious webpage can stall a popup's cross-origin navigation after a commit. This allows the address bar to display the intended destination origin while the browser continues to render content controlled by the attacker, potenti...

CVE-2026-53900

Firefox for iOS is vulnerable to an input validation error where the TemporaryDocument component preserves cookies set on an initial PDF request during cross-origin HTTP redirects. This flaw allows a malicious site to perform arbitrary cookie injection into requests directed at unrelated target d...

CVE-2026-74975

A spoofing issue exists in the Downloads component of Firefox for Android . This vulnerability is addressed in Firefox 154 . Related security advisories, such as MFSA 2026-74 , indicate that this flaw is part of a larger set of security updates for Mozilla products. While the vulnerability has be...

CVE-2026-16404

CVE-2026-16404 is a spoofing issue affecting Firefox for Android . The vulnerability was addressed in Firefox 153 . While technical details regarding the specific root cause are not extensively detailed in the provided documents beyond the nature of the spoofing issue, the vulnerability is confir...

CVE-2026-84135

CVE-2026-84135 is a denial of service vulnerability in Firefox Focus for Android , part of Mozilla Firefox. The root cause is not publicly detailed beyond "Other issue." According to Kaspersky's advisory (MFSA2026-82), it can be exploited remotely to cause denial of service. The NVD assigns a CVS...

CVE-2026-100823

The Firefox for Android browser contains a spoofing issue within its Downloads component . This vulnerability has been addressed and fixed in Firefox version 157 . No specific details regarding the underlying root cause, exploit vectors, or practical consequences beyond the spoofing nature are pr...

CVE-2026-84127

An information disclosure vulnerability exists in the WebExtensions component of Firefox for Android (versions prior to 155). This flaw allows a malicious user to obtain sensitive information from the application. The vulnerability was addressed in Firefox 155 . Public exploits for this vulnerabi...

CVE-2026-86853

A malicious webpage can repeatedly trigger external URL schemes in Firefox for iOS , leading to frequent system prompts or the launching of external applications. This behavior can result in a denial of service by making the browser temporarily unusable until the page is closed. This vulnerabilit...