CVE-2012-1141

CVE-2012-1141 affects FreeType before 2.4.9 (as used in Mozilla Firefox Mobile and other products). The underlying issue is an invalid heap read in BDF font handling, enabling a remote attacker to cause a denial of service or potentially execute arbitrary code via a crafted ASCII string in a BDF ...

CVE-2020-15661

The CVE affects Firefox for iOS before version 28. A rogue webpage can override the injected WKUserScript used by the login autofill, potentially leaking the password for the current domain. This is caused by an override in the login autofill workflow. Mitigation per connected sources is to upgra...

CVE-2012-1132

The connected MiracleLinux security advisory AXSA:2012-513:02 fixes multiple FreeType CVEs, including CVE-2012-1132. MiracleLinux 4 lists freetype-2.3.11-6.AXS4.9 as affected; the advisory indicates a backported patch addresses the listed CVEs and notes the Remote host requires updated packages. ...

CVE-2012-1137

CVE-2012-1137 targets FreeType, specifically versions before 2.4.9 used by Mozilla Firefox Mobile and other products. The vulnerability arises from processing BDF fonts, where a crafted header can cause an invalid heap read and memory corruption, leading to denial of service and possibly remote c...

CVE-2012-1143

CVE-2012-1143 affects FreeType (FreeType before 2.4.9) as used by Firefox Mobile and other products. The issue is a divide-by-zero in font parsing when handling crafted fonts, enabling remote DoS. Exploitation details are not provided in the connected documents; remediation is to upgrade to a pat...

CVE-2020-12414

CVE-2020-12414 affects Firefox for iOS prior to version 27. The issue is that IndexedDB is not cleared upon leaving Private Browsing mode due to incorrect use of WKWebViewConfiguration API, which requires the private instance to be deleted when exiting private mode. Published references confirm M...

CVE-2012-1140

CVE-2012-1140 : FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, can be exploited by a crafted PostScript font object to cause a denial of service (invalid heap read and memory corruption) or possibly execute arbitrary code. The vulnerability is rooted in...

CVE-2012-3979

CVE-2012-3979 : The OpenVAS/Nessus entries indicate a vulnerability in Mozilla Firefox for Android where insecure use of __android_log_print can be triggered by a crafted web page using the dump() function, potentially allowing remote code execution. The issue is tied to Firefox for Android speci...

CVE-2012-1130

CVE-2012-1130 concerns the FreeType library: FreeType before 2.4.9 can be exploited via crafted PCF fonts to cause a remote denial of service or memory corruption, with potential code execution when used by Mozilla Firefox Mobile and other products. Connected documents reference multiple vendor a...

CVE-2012-1142

CVE-2012-1142 refers to FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products. The issue allows a remote attacker to cause a denial of service (invalid heap write operation and memory corruption) or potentially execute arbitrary code through crafted glyph-outli...

CVE-2019-17003

CVE-2019-17003 describes that scanning a QR code containing a javascript: URL could cause JavaScript to be executed. Connected sources consistently reference this behavior and assign a CVSS v3.1 base score of 6.1 (MEDIUM) with NETWORK attack vector, UI: REQUIRED, and impact on Confidentiality/Int...

CVE-2012-1138

CVE-2012-1138 is a vulnerability in FreeType up to version 2.4.8 (prefix ‘before 2.4.9’) used in Mozilla Firefox Mobile and other products. The issue allows remote attackers to trigger denial of service (invalid heap read/memory corruption) or possibly execute arbitrary code via font data (MIRP i...

CVE-2012-1128

CVE-2012-1128 affects FreeType before 2.4.9 (as used in Mozilla Firefox Mobile before 10.0.4 and other products). The vulnerability allows remote attackers to trigger a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType fon...

CVE-2012-1131

CVE-2012-1131 is a FreeType vulnerability affecting 64-bit platforms where the cell-table handling in FreeType before 2.4.9 can trigger a denial of service or potential arbitrary code execution via crafted font data. It is referenced across multiple advisories (e.g., MiracleLinux, Oracle Solaris/...

CVE-2020-15662

The CVE-2020-15662 vulnerability affects Firefox for iOS

CVE-2020-15671

CVE-2020-15671 involves a race condition in Firefox for Android (

CVE-2012-1135

CVE-2012-1135 is a vulnerability in FreeType prior to 2.4.9, affecting FreeType as used in Mozilla Firefox Mobile before 10.0.4. The issue allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors in a T...

CVE-2012-1127

CVE-2012-1127 affects the FreeType font engine (versions before 2.4.9 as used by Mozilla Firefox Mobile and other products). The issue allows remote attackers to cause a denial of service (invalid heap read or memory corruption) or possibly execute arbitrary code via crafted font data (glyphs/bit...

CVE-2012-1139

CVE-2012-1139 is a vulnerability in the FreeType library (before 2.4.9). The issue is an array index/stack read problem in FreeType used by Mozilla Firefox Mobile (and other products) that can cause a denial of service or potentially allow arbitrary code execution when processing BDF fonts. Conne...

CVE-2012-1129

FreeType 2.4.9 fixes are referenced in context of CVE-2012-1129. The vulnerability affects FreeType used in Mozilla Firefox Mobile before 10.0.4 and other products, where a crafted SFNT string in a Type 42 font can cause a denial of service (invalid heap read) and memory corruption, with potentia...

CVE-2020-12404

Summary of CVE-2020-12404 (Firefox iOS): The vulnerability arises in the native-to-JS bridge where a unique token is required to call bridging functions. The token could leak during file download, potentially enabling non-app code to access bridging functionality. Affected product: Firefox for iO...

CVE-2023-49061

CVE-2023-49061 concerns Firefox for iOS prior to version 120, where the Reader Mode fails to neutralize HTML tags, enabling an attacker to perform HTML template injection and potentially exfiltrate user information. Affected software: Firefox for iOS

CVE-2026-14906

The vulnerability CVE-2026-14906 affects Firefox for iOS. Pages with malicious titles could cause saved webpages-as-PDF content to overwrite existing PDF files or bundled content within the Firefox for iOS app sandbox. Affected component is the PDF-saving process; root cause details are not expli...

CVE-2026-53899

CVE-2026-53899 affects Firefox for iOS. The issue arises from partial domain matching when attaching cookies to PDF requests, enabling a malicious site on a suffix domain to receive cookies belonging to the target site. The root cause is tied to how cookies were matched during PDF handling, leadi...

CVE-2026-53900

CVE-2026-53900 concerns Firefox for iOS. The issue: cookies set on the initial PDF request were preserved across cross-origin HTTP redirects in TemporaryDocument, enabling a malicious site to inject cookies into requests to an unrelated target domain. The CVE has a base score of 4.3 (Medium) per ...

CVE-2026-16373

CVE-2026-16373 is an information-disclosure vulnerability affecting Mozilla Firefox for Android (Privacy component). The public records show the issue was fixed in Firefox 153, with advisories indicating information disclosure could be obtained in the affected component. The entry also notes affe...

CVE-2026-74980

A clickjacking flaw in Firefox for Android's Downloads component allows a malicious page to trick users into unintended downloads. CVSS 6.5 (MEDIUM), network-accessible with user interaction. Fixed in Firefox 154; the Nessus plugin confirms no in-the-wild exploitation is known.

CVE-2026-74951

CVE-2026-74951 is a clickjacking vulnerability in Firefox for Android , fixed in Firefox 154 . The flaw allows an attacker to trick a user into performing unintended actions by overlaying transparent or invisible UI elements. The CVSS 3.1 base score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N...

CVE-2026-16404

CVE-2026-16404 is a spoofing vulnerability in Firefox for Android with a CVSS v3.1 base score of 7.4 (HIGH) . The issue affects the Android flavor of Firefox and was fixed in Firefox 153 . Other connected sources corroborate the same description. No additional technical details (root cause, affec...

CVE-2026-74975

A spoofing issue in the Downloads component of Firefox for Android allows a remote attacker to trick users into downloading or interacting with malicious content, with CVSS 5.4 (MEDIUM). It was fixed in Firefox 154. No in-the-wild exploitation is reported.