CVE-2015-0816

CVE-2015-0816 describes a privilege-escalation bypass in Mozilla Firefox and Thunderbird where resource: URLs could bypass Same Origin Policy to run arbitrary code with chrome privileges when combined with a separate SOP violation. Affected: Firefox up to 37.0 (ESR up to 31.x before 31.6) and Thu...

CVE-2017-7824

The CVE-2017-7824 issue is a buffer overflow in ANGLE used for WebGL rendering in Thunderbird before 52.4. It results from an incorrect value passed during checks in the ANGLE library, leading to a potentially exploitable crash. Affected products include Thunderbird

CVE-2018-5152

CVE-2018-5152 affects Firefox before 60. WebExtensions with appropriate permissions can inject content scripts into sites like accounts.firefox.com and monitor traffic via webRequest, enabling interception during login and exposure of username and encrypted password. The issue is limited to the l...

CVE-2018-5180

CVE-2018-5180 is a WebGL use-after-free vulnerability reported in Firefox. The root cause is a heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced during WebGL operations, with impact on Firefox versions older than 60. The connected Nessus entries (Firefox

CVE-2020-15665

CVE-2020-15665 affects Mozilla Firefox before version 80. The issue is that the address bar is not reset after the beforeunload dialog if the user stays on the page, which could lead to an incorrect URL being shown when combined with other browser behaviors. Connected sources reiterate this descr...

CVE-2025-1934

CVE-2025-1934 is a Firefox/Thunderbird memory-safety issue caused by interrupting the RegExp bailout, which could trigger garbage collection when not expected. Affected: Firefox before 136, Firefox ESR before 128.8, Thunderbird before 136, and Thunderbird before 128.8. Exploitation status is not ...

CVE-2025-4091

CVE-2025-4091 involves memory-safety bugs in Mozilla Firefox and Thunderbird. The initial entry notes memory corruption evidence and indicates that attackers could potentially exploit some bugs to run arbitrary code, affecting Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and T...

CVE-2010-0182

The CVE-2010-0182 issue affects Mozilla Firefox (pre-3.5.9 and 3.6.x pre-3.6.2), Thunderbird (pre-3.0.4), and SeaMonkey (pre-2.0.4). The root cause is that XMLDocument::load did not perform the expected nsIContentPolicy checks when loading content via XML documents, allowing crafted content to by...

CVE-2010-1211

CVE-2010-1211 affects Mozilla Firefox 3.5.x before 3.5.11, and 3.6.x before 3.6.7; Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1; SeaMonkey before 2.0.6. The Mozilla browser engine vulnerabilities allow memory corruption leading to memory corruption, DoS, or possibly arbitrary code execut...

CVE-2012-0455

CVE-2012-0455 affects Mozilla browsers: drag-and-drop restrictions on javascript: URLs can enable user-assisted XSS. Affected products include Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x b...

CVE-2013-1669

CVE-2013-1669 affects Mozilla Firefox (and related components) with memory-safety hazards that could lead to memory corruption, application crash, or potential arbitrary code execution. Publicly visible entries in openSUSE-era advisories (MFSA 2013-41) reference this CVE as part of a batch of mem...

CVE-2015-7197

CVE-2015-7197 affects Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, where a web worker can instantiate a WebSocket object, bypassing mixed-content restrictions via crafted JavaScript. Connected sources confirm the description and show remediation paths (update Firefox to 42.0+ or ...

CVE-2016-1521

CVE-2016-1521 is a vulnerability in Graphite 2’s Libgraphite (directrun in directmachine.cpp) where skipping operations are not validated, enabling a crafted Graphite font to cause remote code execution, information disclosure, or denial of service. Affected products include Mozilla Firefox (and ...

CVE-2016-1952

CVE-2016-1952 involves memory-safety vulnerabilities in the Firefox browser engine. Affected software: Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7. Root cause: memory-corruption/memory-safety bugs in the browser engine that can be triggered by parsing/processing malformed or craf...

CVE-2016-1955

CVE-2016-1955 affects Mozilla Firefox prior to 45.0. The issue allows a remote attacker to bypass the Same Origin Policy by reading a CSP violation report that exposes the path information of an embedded iframe, potentially leaking sensitive data. Public references in openSUSE/Tenable notes assoc...

CVE-2016-5297

CVE-2016-5297 is an argument length checking error in JavaScript that can trigger integer overflows, affecting Mozilla Thunderbird <45.5, Firefox ESR <45.5, and Firefox

CVE-2018-12358

CVE-2018-12358 affects Mozilla Firefox prior to 61.0. The issue arises from how service workers can use redirection to avoid tainting of cross-origin resources, allowing a malicious site to read responses that should be opaque. Impact is read access to cross-origin responses; affected are Firefox...

CVE-2018-12371

CVE-2018-12371 is an integer overflow in the Skia library during edge-builder memory allocation on systems with 16 GB RAM or more. Documented impact is a potentially exploitable crash, affecting Firefox ESR < 60.1, Thunderbird < 60, and Firefox

CVE-2018-12375

CVE-2018-12375 concerns memory safety bugs in Firefox 61 that could allow memory corruption and potentially arbitrary code execution. The vulnerability affects Firefox versions earlier than 62. The connected Nessus/NVD entries corroborate the issue as a family of memory-safety defects in Firefox ...

CVE-2013-1697

CVE-2013-1697 affects Mozilla Firefox (before 22.0) and related Thunderbird/ESR builds. The XrayWrapper allowed bypassing restrictions on DefaultValue for method calls, enabling remote JavaScript execution with chrome privileges via a crafted site using a user-defined (1) toString or (2) valueOf....

CVE-2013-1732

CVE-2013-1732 is a buffer overflow in Mozilla's nsFloatManager::GetFlowArea that affects Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. This allows remote attackers to execute arbitrary code via crafted ...

CVE-2017-5400

The CVE-2017-5400 entry describes a exploit scenario arising from a JIT-spray targeting asm.js combined with a heap spray that bypasses ASLR and DEP, potentially causing memory corruption. Connected IBM advisories confirm affected product: IBM Storwize V7000 Unified (codes 1.5.1.0–1.5.2.5) with F...

CVE-2017-5456

CVE-2017-5456 is a sandbox-escape vulnerability in Mozilla Firefox/Firefox ESR where the file system request constructor, via an IPC message, bypasses sandbox protections to gain read/write access to the local filesystem. Affected products include Firefox ESR versions before 52.1 and Firefox befo...

CVE-2019-11699

CVE-2019-11699 affects Mozilla Firefox (pre-67) and relates to content spoofing: a malicious page can briefly highlight the wrong domain name in the address bar during navigation, potentially confusing users about the loaded site. The root cause is incorrect domain highlighting, enabling spoofing...

CVE-2020-26979

Affected software: Mozilla Firefox (versions before 84). Root cause: when a user types a URL in the address/search bar and quickly presses Enter, a website could capture the event and redirect before navigation, enabling spoofing of the entered address.Impact: spoofing of the address bar; potenti...

CVE-2021-29961

CVE-2021-29961 affects Mozilla Firefox (pre-89 releases). The issue is a content spoofing vulnerability where styling/rendering an oversized element failed to clip correctly, enabling an attacker to paint over the user interface. Root cause: incorrect clipping during rendering of oversized selec...

CVE-2022-22752

The CVE-2022-22752 entry corresponds to memory‑safety bugs in Mozilla Firefox 95 that could be exploited to run arbitrary code. Affected software is Firefox prior to version 96; the root cause is memory corruption in certain code paths described across multiple advisories. Impact is memory corrup...

CVE-2022-22758

CVE-2022-22758 affects Mozilla Firefox (Android) and arises from incorrect handling of tel: links where USSD codes placed after a * character could be included in the dialed number, potentially enabling actions on a user’s account. The issue impacts Firefox versions prior to 97 (and related ESR l...

CVE-2022-36315

CVE-2022-36315 affects Mozilla Firefox older than 103. An attacker with injection capability could trigger reuse of cached scripts loaded with Subresource Integrity, causing mismatched integrity metadata to be applied to previously cached entries. This is a browser-side issue in the SRI handling ...

CVE-2022-45419

CVE-2022-45419 describes a Firefox trust-management vulnerability where, if a user added a security exception for an invalid TLS certificate, kept an ongoing TLS connection, and then deleted the exception, Firefox could keep the connection alive and continue to treat the certificate as trusted. A...

CVE-2023-6205

The connected sources corroborate CVE-2023-6205: a use-after-free involving MessagePort Entangled leads to an exploitable crash in Firefox and Thunderbird. Affected products include Firefox versions prior to 120 and Thunderbird prior to 115.5.0 (and ESR 115.5.0 lineage). The root cause is use-aft...

CVE-2025-3029

CVE-2025-3029 describes a URL spoofing vulnerability caused by crafted URLs with specific Unicode characters that can mask the true origin of a page. The advisory text in connected sources confirms affected products include Firefox (versions before 137 and ESR before 128.9) and Thunderbird (versi...

CVE-2026-15719

The CVE-2026-15719 entry refers to Firefox Site isolation in the DOM: Navigation component. Publicly disclosed exploit code exists, but none are documented as in-the-wild attacks in the provided sources. Affected software is Firefox; the vulnerability was fixed in Firefox 152.0.6. The Mozilla adv...

CVE-2010-2755

CVE-2010-2755 affects Mozilla Firefox 3.6.x (notably around 3.6.7) where memory was not properly freed in the parameter array of a plugin instance, leading to memory corruption and potential remote code execution via a crafted HTML document that uses the DATA/SRC attributes of an OBJECT element. ...

CVE-2010-3170

CVE-2010-3170 affects Mozilla Firefox (3.5.x before 3.5.14; 3.6.x before 3.6.11), Thunderbird (before 3.0.9; before 3.1.x before 3.1.5), and SeaMonkey (before 2.0.9). Root cause: wildcard in the X.509 certificate subject Common Name enables MITM by spoofing SSL servers with a cert from a trusted ...

CVE-2011-0080

CVE-2011-0080 corresponds to multiple memory‑corruption/browser engine vulnerabilities in Mozilla Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The MiracleLinux advisories (AXSA:2011-198/203) enumerate these as a set of memory‑sa...

CVE-2013-0775

CVE-2013-0775 is a use-after-free vulnerability in Firefox’s image handling. Specifically, it concerns nsImageLoadingContent::OnStopContainer and affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. ...

CVE-2013-1693

CVE-2013-1693 affects Mozilla Firefox (SVG filter implementation) and related Mozilla products. Affected: Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. Impact: remote attackers could read pixel values and possibly bypass Sa...

CVE-2013-1694

CVE-2013-1694 affects Mozilla Firefox <= 21.x (before 22.0), Firefox ESR < 17.0.7, Thunderbird < 17.0.7, and Thunderbird ESR

CVE-2014-1493

CVE-2014-1493 is a Mozilla Firefox/Thunderbird/SeaMonkey browser-engine vulnerability reported in multiple advisories. IBM Storwize V7000 Unified and IBM SONAS bulletins note these issues affect shipped Firefox and advise upgrading to version 1.4.3.3 (Storwize Unified) or 1.4.3.3 (SONAS) to apply...

CVE-2015-4478

CVE-2015-4478 affects Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2. The issue arises when parsing JSON with JSON.parse and a reviver, which can redefine non-configurable properties on JavaScript objects and bypass the Same Origin Policy. Affected products: Firefox/ESR; root cause:...

CVE-2016-1979

CVE-2016-1979 is a use-after-free vulnerability in NSS (PK11_ImportDERPrivateKeyInfoAndReturnKey) affecting NSS libraries used by Firefox prior to 45.0, with the issue triggered by crafted DER-encoded key data. Multiple connected advisories (Debian DSA/DLA entries, CentOS/CESA, and F5 advisory) c...

CVE-2016-2815

CVE-2016-2815 is a memory-safety hazard in Mozilla Firefox’s browser engine. Affected versions include Firefox prior to 47.0 (with NSS updates in related advisories). The initial description notes remote memory corruption that can cause a crash or potentially allow arbitrary code execution via un...

CVE-2016-5281

IBM Storwize V7000 Unified is affected by CVE-2016-5281 (Mozilla Firefox use-after-free in DOMSVGLength) as part of a set of Firefox vulnerabilities bundled in IBM advisories. The IBM Security Bulletin lists affected code releases 1.5.1.0 to 1.5.2.4 and states a fix is available in version 1.5.2....

CVE-2017-5382

CVE-2017-5382 affects Mozilla Firefox prior to 51.0. The feed preview for RSS feeds can expose internal errors/exceptions generated by privileged content, potentially revealing sensitive information. Rationale: described in the CVE entry and corroborated by multiple advisories (OpenSUSE/Mageia/Ub...

CVE-2018-12399

CVE-2018-12399 affects Firefox prior to 63.0. When a new protocol handler is registered, the API accepts a title argument that can mislead the user about which domain is registering the handler, potentially causing the user to approve a protocol handler they otherwise wouldn’t. The vulnerability ...

CVE-2020-12411

CVE-2020-12411 concerns Mozilla Firefox memory-safety bugs (in Firefox 76) that the researchers cited as potentially exploitable to achieve arbitrary code execution. The provided documents consistently indicate the vulnerability affects Firefox versions earlier than 77. The root cause described a...

CVE-2021-23963

CVE-2021-23963 affects Mozilla Firefox and relates to the WebRTC geolocation sharing flow. The issue occurs when sharing geolocation during an active WebRTC share, where the UI could reset the WebRTC sharing state, causing loss of control over the currently granted permission. Affected products/v...

CVE-2022-40960

CVE-2022-40960: Concurrent use of the URL parser with non-UTF-8 data is not thread-safe, causing a use-after-free and potentially exploitable crash. Affected products include Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2023-23606

Mozilla Firefox has memory-safety bugs reported in Firefox 108, with all issues affecting Firefox versions earlier than 109. The documentation indicates some of these bugs could be exploited to run arbitrary code, implying a potential high-impact risk if unpatched. Affected scope is Firefox