CVE-2022-36317

The CVE-2022-36317 entry concerns Firefox for Android, where visiting a website with an overly long URL can cause the UI to hang due to session restore, potentially leading to a permanent Denial of Service. The incident is documented across multiple sources, including ALAS2FIREFOX-2024-026 (Amazo...

CVE-2023-29537

CVE-2023-29537 concerns multiple race conditions in font initialization that could cause memory corruption and allow attacker-controlled code execution. Affected products include Mozilla Firefox on Android, Firefox versions before 112, and Focus for Android before 112. The vulnerability’s root ca...

CVE-2023-6207

CVE-2023-6207: Ownership mismanagement leads to a use-after-free in ReadableByteStreams. Affected products include Firefox < 120 and Thunderbird

CVE-2024-0747

CVE-2024-0747 describes a CSP bypass: when a parent page loads a child in an iframe with unsafe-inline, the parent CSP could override the child CSP. Affected: Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Practical impact: potential bypass of content security policie...

CVE-2024-0751

CVE-2024-0751 : A malicious devtools extension could have been used to escalate privileges. Affected: Firefox < 122, Firefox ESR < 115.7, Thunderbird

CVE-2011-2372

CVE-2011-2372 is described across connected advisories as a vulnerability in Mozilla Firefox and related Mozilla-based apps where merely holding Enter could trigger a download dialog, allowing user-assisted remote attackers to bypass access restrictions via a crafted site. Affected components inc...

CVE-2015-0817

CVE-2015-0817 is a vulnerability in the asm.js/JIT bounds checking of Mozilla Firefox (and related Mozilla products) that can allow a remote attacker to read/write memory and potentially execute arbitrary code due to improper bounds checks during JIT compilation. Connected IBM advisories confirm ...

CVE-2015-2727

CVE-2015-2727 affects Mozilla Firefox 38.0 and Firefox ESR 38.0. It enables a user-assisted remote attacker to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by visiting a crafted website; the issue is tied to a regression from CVE-2015-0821. Affected systems inc...

CVE-2017-7803

CVE-2017-7803 affects Thunderbird and Firefox browsers with CSP in a page header containing a sandbox directive. The root cause is that when sandbox is present, other CSP directives are ignored, leading to incorrect CSP enforcement. Documents in connected sources specify affected products (Thunde...

CVE-2021-29977

CVE-2021-29977 affects Mozilla Firefox prior to version 90. The connected Astra Linux and Arch Linux advisories confirm memory-safety bugs in Firefox 89 that could permit memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is described as part of...

CVE-2022-34473

Summary: CVE-2022-34473 is a vulnerability in Mozilla Firefox prior to 102 where the HTML Sanitizer failed to sanitize the xlink:href attribute of SVG elements. This could enable attacker-controlled input to bypass sanitization, potentially enabling script execution or other abuses via SVG refer...

CVE-2022-38475

CVE-2022-38475 affects Firefox up to version 104. An attacker could write to the first element of a zero-length JavaScript array; the value is not written to an invalid memory address, but the issue is listed with memory safety implications (I: High). Exploitation context is not described in thes...

CVE-2023-6857

CVE-2023-6857 describes a race condition when resolving symlinks in Firefox on Unix-based OSes, where the buffer passed to readlink may be too small. Affects Firefox and Thunderbird components (Firefox ESR <115.6, Firefox <121, Thunderbird

CVE-2011-2374

CVE-2011-2374 is described as a set of multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (affecting Firefox <3.6.18 and 4.x up to 4.0.1, and Thunderbird

CVE-2014-1532

CVE-2014-1532 is a use-after-free in Mozilla Firefox’s host-resolution path. Affected products include Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, where the vulnerability resides in libxul.so's nsHostResolver::ConditionallyRefreshRecord. ...

CVE-2015-7222

Summary: CVE-2015-7222 affects Mozilla Firefox and Firefox ESR. The vulnerability is an integer underflow in Metadata::setData (MetaData.cpp) within libstagefright that can trigger a buffer overflow when parsing MP4 covr metadata, possibly enabling remote code execution or causing a denial of ser...

CVE-2017-5398

CVE-2017-5398 describes memory-safety bugs in Mozilla Thunderbird (and related Firefox components) that could allow arbitrary code execution. Affected products include Thunderbird versions earlier than 45.8 (and Firefox earlier than 52; ESR lines too). Public advisories indicate fixes in Thunderb...

CVE-2017-5469

CVE-2017-5469 describes a potential buffer overflow in code generated by Flex (related to CVE-2016-6354). Affected products include Thunderbird < 52.1, Firefox ESR < 45.9, ESR < 52.1, and Firefox

CVE-2018-5130

CVE-2018-5130 describes a memory corruption/denial-of-service risk in Mozilla Firefox/WebRTC where receiving packets with a mismatched RTP payload type can crash the browser. The vulnerability affects Firefox ESR versions earlier than 52.7 and standard Firefox versions earlier than 59. Multiple a...

CVE-2019-11697

CVE-2019-11697 affects Firefox before 67.0. The vulnerability lets a malicious page bypass the prompt delay for extension installation by pressing ALT and a on the prompt, enabling spoofing and potential installation of a malicious extension. Exploitation status is not provided in the supplied do...

CVE-2020-15666

CVE-2020-15666 affects Firefox before 80 (desktop and Android); the issue is an information-disclosure vulnerability where loading a non-video in an audio/video context leaks the exact HTTP status code via the MediaError Message. This could enable login-status inference to services or local-netwo...

CVE-2022-34476

CVE-2022-34476: Mozilla Firefox ASN.1 parsing flaw where an indefinite SEQUENCE inside an indefinite GROUP could cause malformed ASN.1 to be accepted. Affected: Firefox prior to 102.0. Reported impact includes potential arbitrary code execution, information disclosure, DoS, and security bypass. R...

CVE-2023-29531

Technical details about CVE-2023-29531 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from Mozilla and security advisories.

CVE-2025-4083

CVE-2025-4083 is a process isolation vulnerability in Thunderbird/Firefox caused by improper handling of javascript: URIs, which can let content execute in the top-level process instead of the intended frame, potentially enabling a sandbox escape. Affected: Firefox < 138, Firefox ESR < 128....

CVE-2009-1307

CVE-2009-1307 is evidenced in connected documents as a vulnerability in the view-source: URI handling in Mozilla Firefox before 3.0.9 (also affecting Thunderbird and SeaMonkey) that breaks the Same Origin Policy. It enables remote attackers to bypass cross-domain restrictions and connect to arbit...

CVE-2010-3182

CVE-2010-3182 impacts Mozilla Firefox (before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9) on Linux. Root cause: an application-launch script places a zero-length directory name in LD_LIBRARY_PATH, enabling a local user to load a...

CVE-2013-0750

CVE-2013-0750 is a high-severity vulnerability in Mozilla’s JavaScript engine where an integer overflow during string concatenation can lead to heap-based memory corruption and remote code execution. Affected products include Firefox prior to 18.0 (and ESR branches), Thunderbird prior to 17.0.2, ...

CVE-2014-1477

CVE-2014-1477 affects Mozilla Firefox before 27.0 (and related ESR/Thunderbird/SeaMonkey versions) where the browser engine contains multiple unspecified vulnerabilities that could lead to memory corruption, application crashes, or possibly arbitrary code execution via unknown vectors. Exploitati...

CVE-2014-1518

CVE-2014-1518 affects Mozilla Firefox and related browsers (Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). Reported impact per the connected advisories: remote memory corruption and application crash, with potential arbitrary code execution via...

CVE-2015-2708

CVE-2015-2708 affects Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7, with memory-safety issues in the browser engine that could allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vect...

CVE-2016-2821

CVE-2016-2821 is a use-after-free in Mozilla Firefox’s editor contenteditable path (mozilla::dom::Element) that can lead to remote code execution or a denial of service when elements are deleted during editing. The description applies to Firefox before 47.0 and Firefox ESR 45.x before 45.2. Publi...

CVE-2017-5401

CVE-2017-5401 is a memory corruption crash triggered by ErrorResult handling in Firefox/Thunderbird. Affected versions are Firefox < 52 and ESR < 45.8, Thunderbird < 52 and Thunderbird

CVE-2020-15675

The CVE-2020-15675 vulnerability affects Firefox before version 81. It is a memory-corruption issue where, during surface processing, a persistent buffer’s lifetime may outlive its memory, potentially allowing a crash or exploitation. Affected component/behavior is a memory-management path in Fir...

CVE-2021-23957

CVE-2021-23957 : Firefox for Android was vulnerable to navigation via Android-specific intent URL schemes that could be misused to escape the iframe sandbox, potentially bypassing sandbox protections. The advisory indicates this affected Firefox versions prior to 85 and is limited to Android; oth...

CVE-2021-29966

CVE-2021-29966 concerns Mozilla Firefox before version 89. The connected advisories indicate memory-safety bugs in Firefox 88 with potential to be exploited to execute arbitrary code. Affected product: Mozilla Firefox (pre-89). Root cause: memory corruption/memory-safety vulnerabilities reported ...

CVE-2021-29972

CVE-2021-29972 is a use-after-free vulnerability linked to an out-of-date Cairo library affecting Mozilla Firefox versions earlier than 90. The issue was identified via testing and updating Cairo (and/or Firefox to a newer Firefox 90+ version) was reported to resolve the vulnerability and may als...

CVE-2021-29975

CVE-2021-29975 affects Mozilla Firefox earlier than 90. Through DOM manipulations, an attacker could overlay a message (text only) on top of another domain while the address bar showed the new domain, potentially leading to user confusion or spoofing. The issue is tied to content spoofing in Fire...

CVE-2022-22762

CVE-2022-22762 is a Firefox for Android issue where a JavaScript alert/prompt could be shown in a way that overlapped another website, enabling UI spoofing. The vulnerability is limited to Firefox on Android and affects versions before 97, with the CVSS base metrics showing low impact on confiden...

CVE-2013-1701

CVE-2013-1701 is part of multiple Mozilla browser engine vulnerabilities fixed in Firefox (before 23.0), ESR 17.x (before 17.0.8), Thunderbird (before 17.0.8), and SeaMonkey (before 2.20). The MiracleLinux advisories and IBM/Red Hat entries confirm remediation via upgrading to patched versions (F...

CVE-2015-2722

CVE-2015-2722 affects Mozilla Firefox before 39.0 and Firefox ESR before 31.8 (and 38.x before 38.1). Root cause: a use-after-free in CanonicalizeXPCOMParticipant when an XMLHttpRequest is attached to a shared or dedicated worker. Impact: remote attacker could execute arbitrary code. Mitigation: ...

CVE-2015-7205

CVE-2015-7205 details : In Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5, an integer underflow in RTPReceiverVideo::ParseRtpPacket can be triggered by a crafted WebRTC RTP packet, potentially exposing sensitive information, causing a denial of service, or other unspecified impacts....

CVE-2016-1954

CVE-2016-1954 affects Mozilla Firefox and Firefox ESR. The flaw in nsCSPContext::SendReports allows a CSP violation report to specify a local file URL, potentially causing a denial of service (data overwrite) or privilege escalation. Affected versions: Firefox before 45.0 and Firefox ESR 38.x bef...

CVE-2021-23962

CVE-2021-23962 concerns Mozilla Firefox prior to version 85, where an incorrect use of the method could cause a user-after-poison condition and a potentially exploitable crash in the browser. The vulnerability is documented across multiple sources with the same root cause and impact: a crash tha...

CVE-2021-23971

CVE-2021-23971 concerns Mozilla Firefox: when processing a redirect with a conflicting Referrer-Policy, the browser would adopt the redirect’s policy, potentially leaking more information to the destination than intended by the original origin. Affected: Firefox versions earlier than 86. The conn...

CVE-2021-29959

CVE-2021-29959 affects Mozilla Firefox up to version

CVE-2023-25734

CVE-2023-25734 affects Mozilla Firefox on Windows. It arises when a user opens a local Windows .url shortcut, allowing an attacker to supply a remote path that can trigger unexpected network requests and potentially leak NTLM credentials. Affected versions: Firefox before 110, Thunderbird before ...

CVE-2010-3178

CVE-2010-3178 affects Mozilla Firefox (before 3.5.14 and 3.6.x before 3.6.11), Thunderbird (before 3.0.9 and 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). The issue arises from improper handling of certain modal calls made by javascript: URLs when opening a new window and performing cross-do...

CVE-2015-0816

CVE-2015-0816 describes a privilege-escalation bypass in Mozilla Firefox and Thunderbird where resource: URLs could bypass Same Origin Policy to run arbitrary code with chrome privileges when combined with a separate SOP violation. Affected: Firefox up to 37.0 (ESR up to 31.x before 31.6) and Thu...

CVE-2015-7193

Mozilla Firefox 42.0 and Firefox ESR 38.x before 38.4 fix a cross-origin request handling flaw (CORS) for POST with unspecified Content-Type headers. The vulnerability arises from not following the CORS preflight flow, allowing remote attackers to bypass the Same Origin Policy and potentially acc...

CVE-2018-5152

CVE-2018-5152 affects Firefox before 60. WebExtensions with appropriate permissions can inject content scripts into sites like accounts.firefox.com and monitor traffic via webRequest, enabling interception during login and exposure of username and encrypted password. The issue is limited to the l...