CVE-2017-5382

CVE-2017-5382 affects Mozilla Firefox prior to 51.0. The feed preview for RSS feeds can expose internal errors/exceptions generated by privileged content, potentially revealing sensitive information. Rationale: described in the CVE entry and corroborated by multiple advisories (OpenSUSE/Mageia/Ub...

CVE-2018-12369

Summary (CVE-2018-12369) WebExtensions bundled with embedded experiments could bypass authorization checks, allowing a malicious WebExtension to gain full browser permissions. Affected products: Mozilla Firefox (non-ESR) versions before 61 and Firefox ESR before 60.1. Root cause: improper authori...

CVE-2015-2708

CVE-2015-2708 affects Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7, with memory-safety issues in the browser engine that could allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vect...

CVE-2017-7803

CVE-2017-7803 affects Thunderbird and Firefox browsers with CSP in a page header containing a sandbox directive. The root cause is that when sandbox is present, other CSP directives are ignored, leading to incorrect CSP enforcement. Documents in connected sources specify affected products (Thunde...

CVE-2018-5096

CVE-2018-5096 is a use-after-free vulnerability in editing events within form elements that can cause a crash. Documented impact is limited to Firefox ESR versions older than 52.6 and Thunderbird versions older than 52.6, with a fix included in version 52.6.0 for affected Mozilla products (Firefo...

CVE-2019-9799

CVE-2019-9799 affects Mozilla Firefox before 66.0. The issue is caused by insufficient bounds checking of data during inter-process communication, which can allow a compromised content process to read memory from the parent process under certain conditions. Connected advisories/plugins corroborat...

CVE-2020-15675

The CVE-2020-15675 vulnerability affects Firefox before version 81. It is a memory-corruption issue where, during surface processing, a persistent buffer’s lifetime may outlive its memory, potentially allowing a crash or exploitation. Affected component/behavior is a memory-management path in Fir...

CVE-2022-45419

CVE-2022-45419 describes a Firefox trust-management vulnerability where, if a user added a security exception for an invalid TLS certificate, kept an ongoing TLS connection, and then deleted the exception, Firefox could keep the connection alive and continue to treat the certificate as trusted. A...

CVE-2023-25734

CVE-2023-25734 affects Mozilla Firefox on Windows. It arises when a user opens a local Windows .url shortcut, allowing an attacker to supply a remote path that can trigger unexpected network requests and potentially leak NTLM credentials. Affected versions: Firefox before 110, Thunderbird before ...

CVE-2023-6205

The connected sources corroborate CVE-2023-6205: a use-after-free involving MessagePort Entangled leads to an exploitable crash in Firefox and Thunderbird. Affected products include Firefox versions prior to 120 and Thunderbird prior to 115.5.0 (and ESR 115.5.0 lineage). The root cause is use-aft...

CVE-2024-3853

A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerability affects Firefox

CVE-2025-1938

Memory safety bugs exist in Mozilla Firefox and Thunderbird (including ESR versions) that can lead to memory corruption. If successfully exploited with sufficient effort, these vulnerabilities could allow an attacker to execute arbitrary code . The issue affects Firefox < 136 , Firefox ESR &lt...

CVE-2025-3030

Memory safety bugs in Firefox , Thunderbird , Firefox ESR , and Thunderbird versions 136 and 128.8 (specifically affecting versions < 137 and

CVE-2009-3376

CVE-2009-3376 affects Mozilla Firefox (before 3.0.15 and 3.5.x before 3.5.4) and SeaMonkey (before 2.0). The root cause is improper handling of a right-to-left override (RLO, U+202E) Unicode character in a download filename, which can cause the displayed name to differ from the actual filename. T...

CVE-2013-1684

CVE-2013-1684 is a use-after-free in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function affecting Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. It allows remote attackers to execute arbitrary co...

CVE-2013-1694

CVE-2013-1694 affects Mozilla Firefox <= 21.x (before 22.0), Firefox ESR < 17.0.7, Thunderbird < 17.0.7, and Thunderbird ESR

CVE-2014-1493

CVE-2014-1493 is a Mozilla Firefox/Thunderbird/SeaMonkey browser-engine vulnerability reported in multiple advisories. IBM Storwize V7000 Unified and IBM SONAS bulletins note these issues affect shipped Firefox and advise upgrading to version 1.4.3.3 (Storwize Unified) or 1.4.3.3 (SONAS) to apply...

CVE-2015-7193

Mozilla Firefox 42.0 and Firefox ESR 38.x before 38.4 fix a cross-origin request handling flaw (CORS) for POST with unspecified Content-Type headers. The vulnerability arises from not following the CORS preflight flow, allowing remote attackers to bypass the Same Origin Policy and potentially acc...

CVE-2015-7204

CVE-2015-7204 affects Mozilla Firefox before 43.0. The issue is due to how Firefox stores properties of unboxed objects, which can allow a remote attacker to execute arbitrary code via crafted JavaScript variable assignments. The vulnerability is linked to Firefox’s memory handling and has been a...

CVE-2015-7205

CVE-2015-7205 details : In Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5, an integer underflow in RTPReceiverVideo::ParseRtpPacket can be triggered by a crafted WebRTC RTP packet, potentially exposing sensitive information, causing a denial of service, or other unspecified impacts....

CVE-2016-1952

CVE-2016-1952 involves memory-safety vulnerabilities in the Firefox browser engine. Affected software: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. Root cause: memory-corruption/memory-safety bugs in the browser engine that can be triggered by parsing/processing malformed or craf...

CVE-2017-7830

CVE-2017-7830 involves a cross-origin information disclosure through the Resource Timing API that could reveal navigations loaded in iframes, constituting a same-origin policy violation. Public documentation in Debian and CVE databases tie this to WebKit-related handling in Safari/WebKit componen...

CVE-2019-11696

CVE-2019-11696 affects Mozilla Firefox before 67.0. Files with the .JNLP extension used for Java Web Start are not treated as executable content during download prompts, yet they can be executed if Java is present, enabling a user to inadvertently launch a local executable. Impact details in conn...

CVE-2019-11697

CVE-2019-11697 affects Firefox before 67.0. The vulnerability lets a malicious page bypass the prompt delay for extension installation by pressing ALT and a on the prompt, enabling spoofing and potential installation of a malicious extension. Exploitation status is not provided in the supplied do...

CVE-2020-15674

CVE-2020-15674 is a Firefox memory-safety bug before 81. Mozilla reports memory corruption with enough effort potentially enabling arbitrary code execution. Affected product: Mozilla Firefox (prior to 81); root cause: memory-safety issues leading to memory corruption. Impact: possible remote code...

CVE-2021-23962

CVE-2021-23962 concerns Mozilla Firefox prior to version 85, where an incorrect use of the method could cause a user-after-poison condition and a potentially exploitable crash in the browser. The vulnerability is documented across multiple sources with the same root cause and impact: a crash tha...

CVE-2021-23971

CVE-2021-23971 concerns Mozilla Firefox: when processing a redirect with a conflicting Referrer-Policy, the browser would adopt the redirect’s policy, potentially leaking more information to the destination than intended by the original origin. Affected: Firefox versions earlier than 86. The conn...

CVE-2022-22752

The CVE-2022-22752 entry corresponds to memory‑safety bugs in Mozilla Firefox 95 that could be exploited to run arbitrary code. Affected software is Firefox prior to version 96; the root cause is memory corruption in certain code paths described across multiple advisories. Impact is memory corrup...

CVE-2013-1693

CVE-2013-1693 affects Mozilla Firefox (SVG filter implementation) and related Mozilla products. Affected: Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. Impact: remote attackers could read pixel values and possibly bypass Sa...

CVE-2014-1531

CVE-2014-1531 is a use-after-free vulnerability in Mozilla Firefox’s image handling. The flaw occurs in nsGenericHTMLElement::GetWidthHeightForImage during an image-resize operation and can be triggered via an imgLoader object, allowing remote attackers to cause heap memory corruption and potenti...

CVE-2015-7197

CVE-2015-7197 affects Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, where a web worker can instantiate a WebSocket object, bypassing mixed-content restrictions via crafted JavaScript. Connected sources confirm the description and show remediation paths (update Firefox to 42.0+ or ...

CVE-2016-1954

CVE-2016-1954 affects Mozilla Firefox and Firefox ESR. The flaw in nsCSPContext::SendReports allows a CSP violation report to specify a local file URL, potentially causing a denial of service (data overwrite) or privilege escalation. Affected versions: Firefox before 45.0 and Firefox ESR 38.x bef...

CVE-2017-5398

CVE-2017-5398 describes memory-safety bugs in Mozilla Thunderbird (and related Firefox components) that could allow arbitrary code execution. Affected products include Thunderbird versions earlier than 45.8 (and Firefox earlier than 52; ESR lines too). Public advisories indicate fixes in Thunderb...

CVE-2019-11734

CVE-2019-11734 refers to memory safety bugs in Firefox 68 that may allow arbitrary code execution and affect Firefox versions older than 69. The issue is described as memory corruption with potential exploitation but no exploit details are provided in the initial description beyond that. The vuln...

CVE-2020-26962

CVE-2020-26962 affects Mozilla Firefox up to version 82 (Firefox

CVE-2020-26979

Affected software: Mozilla Firefox (versions before 84). Root cause: when a user types a URL in the address/search bar and quickly presses Enter, a website could capture the event and redirect before navigation, enabling spoofing of the entered address.Impact: spoofing of the address bar; potenti...

CVE-2021-23957

CVE-2021-23957 : Firefox for Android was vulnerable to navigation via Android-specific intent URL schemes that could be misused to escape the iframe sandbox, potentially bypassing sandbox protections. The advisory indicates this affected Firefox versions prior to 85 and is limited to Android; oth...

CVE-2021-29977

CVE-2021-29977 affects Mozilla Firefox prior to version 90. The connected Astra Linux and Arch Linux advisories confirm memory-safety bugs in Firefox 89 that could permit memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is described as part of...

CVE-2025-4093

A memory safety bug exists in Firefox ESR 128.9 and Thunderbird 128.9 , characterized by memory corruption . If exploited, this vulnerability could allow an attacker to execute arbitrary code . The issue has been resolved in Firefox ESR 128.10 and Thunderbird 128.10 . While documentation indicate...

CVE-2025-5269

A memory safety bug exists in Firefox ESR 128.10 and Thunderbird 128.10 caused by the execution of operations beyond memory buffer boundaries. This flaw exhibited signs of memory corruption and could potentially be exploited by a remote attacker to execute arbitrary code . The vulnerability has b...

CVE-2026-16349

The Mozilla Firefox and Thunderbird browsers are affected by CVE-2026-16349 , a Same-origin policy bypass in the DOM: Navigation component . This vulnerability allows for the bypass of security boundaries intended to isolate different web origins. The issue has been addressed in Firefox 153 , Fir...

CVE-2010-0182

The CVE-2010-0182 issue affects Mozilla Firefox (pre-3.5.9 and 3.6.x pre-3.6.2), Thunderbird (pre-3.0.4), and SeaMonkey (pre-2.0.4). The root cause is that XMLDocument::load did not perform the expected nsIContentPolicy checks when loading content via XML documents, allowing crafted content to by...

CVE-2012-1972

CVE-2012-1972 is a use-after-free in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox, with remote code execution/denial of service via heap memory corruption. Affected products/versions include Firefox prior to 15.0, Firefox ESR 10.x prior to 10.0.7, and Thunderbird prior ...

CVE-2013-0757

CVE-2013-0757 affects Mozilla Firefox (and related Mozilla-based apps) via a Chrome Object Wrapper (COW) bypass that allows changing the prototype of an object, enabling arbitrary code execution with chrome privileges. The SUSE/openSUSE and Gentoo/Nessus summaries map this to MFSA 2013-14 and lis...

CVE-2014-1482

CVE-2014-1482 affects Mozilla Firefox and related Mozilla products. The issue is that RasterImage.cpp does not prevent access to discarded image data, enabling remote attackers to run arbitrary code or cause a denial of service via crafted image data (Goo Create demonstrated). Affected versions i...

CVE-2015-0831

CVE-2015-0831 describes a use-after-free in Mozilla Firefox (mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex) that could allow remote code execution or denial of service via crafted IndexedDB index content. Affected products include Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thun...

CVE-2016-1521

CVE-2016-1521 is a vulnerability in Graphite 2’s Libgraphite (directrun in directmachine.cpp) where skipping operations are not validated, enabling a crafted Graphite font to cause remote code execution, information disclosure, or denial of service. Affected products include Mozilla Firefox (and ...

CVE-2017-5401

CVE-2017-5401 is a memory corruption crash triggered by ErrorResult handling in Firefox/Thunderbird. Affected versions are Firefox < 52 and ESR < 45.8, Thunderbird < 52 and Thunderbird

CVE-2017-7824

The CVE-2017-7824 issue is a buffer overflow in ANGLE used for WebGL rendering in Thunderbird before 52.4. It results from an incorrect value passed during checks in the ANGLE library, leading to a potentially exploitable crash. Affected products include Thunderbird

CVE-2018-12371

CVE-2018-12371 is an integer overflow in the Skia library during edge-builder memory allocation on systems with 16 GB RAM or more. Documented impact is a potentially exploitable crash, affecting Firefox ESR < 60.1, Thunderbird < 60, and Firefox