CVE-2009-3077

CVE-2009-3077 affects Mozilla Firefox before 3.0.14 and 3.5.x before 3.5.3. The issue is a dangling-pointer vulnerability in TreeColumns of a XUL tree, caused by improper pointer management, enabling remote attackers to execute arbitrary code via a crafted HTML document. Affected products: Firefo...

CVE-2013-0775

CVE-2013-0775 is a use-after-free vulnerability in Firefox’s image handling. Specifically, it concerns nsImageLoadingContent::OnStopContainer and affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. ...

CVE-2014-1497

CVE-2014-1497 affects mozilla::WaveReader::DecodeAudioData in Mozilla Firefox up to 28.0 (and ESR 24.x up to 24.4), Thunderbird up to 24.4, and SeaMonkey up to 2.25. A crafted WAV file can cause information disclosure from process heap memory and can trigger a denial of service via an out-of-boun...

CVE-2016-2800

The Graphite 2 font rendering library is affected by CVE-2016-2800 and CVE-2016-2792. In Graphite 2, the vulnerability resides in graphite2::Slot::getAttr (Slot.cpp) and can be triggered when processing crafted Graphite fonts, as used by Mozilla Firefox prior to 45.0 and Firefox ESR 38.x prior to...

CVE-2017-5456

CVE-2017-5456 is a sandbox-escape vulnerability in Mozilla Firefox/Firefox ESR where the file system request constructor, via an IPC message, bypasses sandbox protections to gain read/write access to the local filesystem. Affected products include Firefox ESR versions before 52.1 and Firefox befo...

CVE-2018-12370

CVE-2018-12370 : In Firefox Reader View, SameSite cookie protections are not checked on exit, allowing a payload to trigger when Reader View is left if loaded from a malicious site while Reader mode is active, bypassing CSRF protections. Affected products are Firefox versions earlier than 61.0. C...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2021-29961

CVE-2021-29961 affects Mozilla Firefox (pre-89 releases). The issue is a content spoofing vulnerability where styling/rendering an oversized element failed to clip correctly, enabling an attacker to paint over the user interface. Root cause: incorrect clipping during rendering of oversized selec...

CVE-2021-29975

CVE-2021-29975 affects Mozilla Firefox earlier than 90. Through DOM manipulations, an attacker could overlay a message (text only) on top of another domain while the address bar showed the new domain, potentially leading to user confusion or spoofing. The issue is tied to content spoofing in Fire...

CVE-2022-22749

CVE-2022-22749 affects Firefox for Android. When scanning QR codes, it could navigate to URLs that do not point to web content. Other OSes are unaffected. Mozilla fixed this as part of MFSA2022-01; remediation is to upgrade to Firefox 96 or newer.

CVE-2023-28177

CVE-2023-28177 corresponds to memory safety bugs in Firefox 110, with the issue affecting Firefox versions before 111. The supplied documents indicate memory corruption evidence and a theoretical path to arbitrary code execution, though no exploit details are provided. Affected component scope is...

CVE-2023-32210

CVE-2023-32210 : Mozilla Firefox is affected by a vulnerability where documents could be loaded with a higher-privileged principal than intended due to an incorrect assumption about the ordering of principal objects. This could lead to privilege escalation or leakage under certain circumstances. ...

CVE-2023-34415

Affected software: Mozilla Firefox. Issue: a site-isolation bypass vulnerability where a document loaded from a data: URL that was the result of a redirect could be loaded in the same process as the redirecting site, bypassing Spectre-like protections. Root cause: bypass of site-isolation protect...

CVE-2026-16358

A site isolation issue exists in the Graphics: WebRender component of the Mozilla Firefox and Thunderbird browsers. This vulnerability has been addressed in Firefox versions 153 , ESR 115.38 , and ESR 140.13 , as well as Thunderbird versions 153 and 140.13 . While specific exploitation details or...

CVE-2026-7321

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a sandbox escape caused by incorrect boundary conditions in the WebRTC: Networking component. The vulnerability allows an attacker to bypass security boundaries, potentially compromising the confidentiality, integrity, and accessib...

CVE-2010-2752

CVE-2010-2752 is an integer overflow in Mozilla’s CSS handling that affects Firefox 3.5.x (before 3.5.11), Firefox 3.6.x (before 3.6.7), Thunderbird 3.0.x (before 3.0.6), Thunderbird 3.1.x (before 3.1.1), and SeaMonkey before 2.0.6. The issue arises in an array class used to store CSS values, tie...

CVE-2010-2764

CVE-2010-2764 affects Mozilla Firefox (before 3.5.12 and before 3.6.9), Thunderbird (before 3.0.7 and before 3.1.3), and SeaMonkey (before 2.0.7). The flaw: read access to XMLHttpRequest.statusText is not properly restricted, enabling remote attackers to determine the existence of intranet web se...

CVE-2011-2995

CVE-2011-2995 is a browser engine vulnerability affecting Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows remote attackers to cause memory corruption and application crashes or possibly execute arbitrary code via unknown vectors;...

CVE-2013-0800

CVE-2013-0800 : An integer signedness error in the pixman_fill_sse2 function (pixman-sse2.c) used by Cairo and shipped with Mozilla Firefox and related products allows a remote attacker to trigger an out-of-bounds write via crafted values (negative box boundary or negative box size). This affects...

CVE-2014-1486

CVE-2014-1486 is a use-after-free in Mozilla Firefox’s imgRequestProxy function (affecting Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24). The vulnerability enables remote code execution via image data with unspecified Content-Type values. Mirac...

CVE-2015-2713

CVE-2015-2713 is a use-after-free in Mozilla Firefox (SetBreaks) affecting Firefox before 38.0, Firefox ESR before 31.7, and Thunderbird before 31.7. An attacker could craft a document with specific CSS tokens for vertical text to cause heap memory corruption, enabling remote code execution or a ...

CVE-2015-7212

CVE-2015-7212 describes an integer overflow in mozilla::layers::BufferTextureClient::AllocateForSurface in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5, allowing remote code execution via a graphics operation that allocates a large texture. Affected products/versions: Firefox prio...

CVE-2016-1935

CVE-2016-1935 : Buffer overflow in Mozilla Firefox’s BufferSubData function allows remote code execution via crafted WebGL content. Affected products: Firefox before 44.0 and Firefox ESR 38.x before 38.6. Root cause: buffer overflow while rendering WebGL content. Impact: remote code execution wit...

CVE-2016-1955

CVE-2016-1955 affects Mozilla Firefox prior to 45.0. The issue allows a remote attacker to bypass the Same Origin Policy by reading a CSP violation report that exposes the path information of an embedded iframe, potentially leaking sensitive data. Public references in openSUSE/Tenable notes assoc...

CVE-2016-2815

CVE-2016-2815 is a memory-safety hazard in Mozilla Firefox’s browser engine. Affected versions include Firefox prior to 47.0 (with NSS updates in related advisories). The initial description notes remote memory corruption that can cause a crash or potentially allow arbitrary code execution via un...

CVE-2016-5270

CVE-2016-5270: Mozilla Firefox (and Thunderbird <45.4/Firefox ESR

CVE-2016-5297

CVE-2016-5297 is an argument length checking error in JavaScript that can trigger integer overflows, affecting Mozilla Thunderbird <45.5, Firefox ESR <45.5, and Firefox

CVE-2019-17014

CVE-2019-17014 : A cross-origin information leak in Firefox occurs when an image fails to load correctly (e.g., non-image), enabling cross-domain drag-and-drop. Affected: Firefox versions earlier than 71. Root cause: drag-and-drop cross-domain exposure, leading to a partial confidentiality impact...

CVE-2021-29960

The CVE-2021-29960 entry concerns Mozilla Firefox before version 89. The issue is an information disclosure where Firefox caches the last filename used for printing and often uses the web page title as the suggested print filename. The combination of caching and title suggestion could allow the t...

CVE-2023-25748

CVE-2023-25748 is a public vulnerability affecting Firefox for Android (not other OSes). The issue arises when a prompt with a long description is displayed, potentially hiding the fullscreen notification and enabling user confusion or spoofing. Connected sources confirm this CVE is fixed in Fire...

CVE-2023-6211

CVE-2023-6211 affects Mozilla Firefox earlier than 120. The initial description states that an attacker could exploit when a user is prompted to load an insecure http: page and has HTTPS-only mode enabled, by tricking the user into clicking to grant an HTTPS-only exception through a clicking game...

CVE-2024-2615

Summary (CVE-2024-2615) : The incident centers on memory safety bugs in Mozilla Firefox 123 that may allow memory corruption and, with enough effort, arbitrary code execution. The vulnerability affects Firefox versions earlier than 124. The connected sources consistently describe the issue as mem...

CVE-2024-4764

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox

CVE-2025-2817

The Update Handler component in Mozilla Firefox , Mozilla Firefox ESR , and Mozilla Thunderbird contains a privilege escalation vulnerability (CVE-2025-2817 ) caused by access control deficiencies in the update mechanism. Specifically, a medium-integrity user process can interfere with the SYSTEM...

CVE-2026-14241

CVE-2026-14241 is a memory-safety issue in Firefox 152.0.3 that could potentially be exploited to execute arbitrary code. The issue affects Firefox desktop builds and was fixed in Firefox 152.0.4. Multiple connected sources confirm the same root cause: memory-safety bugs leading to memory corrupt...

CVE-2009-1044

From MiracleLinux AXSA:2009-348:01, CVE-2009-1044 is described as an unspecified vulnerability in Mozilla Firefox 3.0.7 on Windows 7 that allows remote code execution via unknown vectors triggered by clicking a link (demonstrated by PWN2OWN). The advisory associates this CVE with Firefox/XULRunne...

CVE-2010-2753

CVE-2010-2753 affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7), Thunderbird (3.0.x before 3.0.6; 3.1.x before 3.1.1), and SeaMonkey before 2.0.6. Root cause: integer overflow in the XUL tree selection attribute can trigger a use-after-free when handling a large selection in a XUL...

CVE-2010-2755

CVE-2010-2755 affects Mozilla Firefox 3.6.x (notably around 3.6.7) where memory was not properly freed in the parameter array of a plugin instance, leading to memory corruption and potential remote code execution via a crafted HTML document that uses the DATA/SRC attributes of an OBJECT element. ...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2013-0746

CVE-2013-0746 affects Mozilla products including Firefox (before 18.0), Firefox ESR (before 10.0.12 and 17.x before 17.0.2), Thunderbird (before 17.0.2, and ESR 10.x before 10.0.12 and 17.x before 17.0.2), and SeaMonkey (before 2.15). The issue is a quickstubs/jsval return-value handling flaw tha...

CVE-2013-1687

CVE-2013-1687 affects Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7. The vulnerability arises from insufficient restriction of XBL user-defined functions in the SOW (System Only Wrapper) and COW (Chrome Object Wrappe...

CVE-2013-1713

CVE-2013-1713 affects Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20. It arises from an incorrect URI comparison during enforcement of the Same Origin Policy, enabling remote attackers to perfor...

CVE-2014-1512

The provided connected documents confirm multiple Firefox-related CVEs (e.g., CVE-2014-1512 among others) affecting Mozilla Firefox before 28.0, ESR 24.x before 24.4, and related Mozilla products. The primary issue is memory-safety/use-after-free vulnerabilities in the browser engine (notably in ...

CVE-2015-2731

CVE-2015-2731 is a use-after-free vulnerability in the CSPService::ShouldLoad function of Firefox’s microtask implementation (and affects Thunderbird). An attacker could trigger removal of a DOM object via client-side JavaScript based on a Content Policy, leading to remote code execution. Affecte...

CVE-2016-2837

In IBM Storwize V7000 Unified, CVE-2016-2837 affects Mozilla Firefox components embedded via ClearKey CDM in the EME API. A heap-based buffer overflow during video playback could allow remote code execution. Affected versions: 1.5.0.0–1.5.2.4. Remediation: upgrade to 1.5.2.5 or later. If no furth...

CVE-2021-23983

Summary: CVE-2021-23983 affects Mozilla Firefox prior to version 87. The issue arises when a transition on a parent node is caused by removing a CSS rule, allowing an invalid property for a marker to be applied, which can lead to memory corruption and a potentially exploitable crash. This vulnera...

CVE-2023-32208

CVE-2023-32208 describes a vulnerability in Mozilla Firefox prior to 113 where service workers could reveal the script base URL due to dynamic import(). The issue is limited to Firefox versions earlier than 113, with a CVSS v3.1 base score of 5.3 (Medium), affecting the confidentiality impact onl...

CVE-2024-3865

Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox

CVE-2025-1936

The Mozilla Firefox and Thunderbird applications are vulnerable to a flaw where jar: URLs retrieve local file content from ZIP archives improperly. Specifically, the system ignores the null character and subsequent content when retrieving data, but uses the fake extension following the null chara...

CVE-2026-12318

CVE-2026-12318 involves incorrect boundary conditions in the Libraries component of the NSS cryptographic libraries. This flaw could lead to a denial of service (DoS) or potentially the execution of arbitrary code . The vulnerability affects multiple distributions and applications, including Fire...