CVE-2018-5151

CVE-2018-5151 affects Mozilla Firefox prior to version 60, where memory safety bugs in Firefox 59 could potentially lead to memory corruption and arbitrary code execution. The issue is documented in multiple sources referencing memory safety bugs in Firefox 59 and the impact is limited to Firefox...

CVE-2018-5173

CVE-2018-5173 : In Firefox, the filename shown in the Downloads panel can be spoofed by rendering certain Unicode characters differently, allowing a deception of the file name and potentially masking the extension of executable files. The dialog used to open the file still shows the true filename...

CVE-2019-9799

CVE-2019-9799 affects Mozilla Firefox before 66.0. The issue is caused by insufficient bounds checking of data during inter-process communication, which can allow a compromised content process to read memory from the parent process under certain conditions. Connected advisories/plugins corroborat...

CVE-2023-29547

The CVE-2023-29547 issue affects Mozilla Firefox and Firefox-based products: when a secure cookie existed in the Firefox cookie jar, an insecure cookie for the same domain could be created instead of silently failing, causing desynchronization when reading the secure cookie. Affected versions inc...

CVE-2025-4087

Summary: CVE-2025-4087 is a Mozilla Thunderbird/Firefox memory-safety issue in XPath parsing caused by missing null checks during attribute access, leading to undefined behavior and potential out-of-bounds reads. Affected versions: Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, ...

CVE-2010-0173

CVE-2010-0173 affects Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is memory corruption in the browser engine that can cause denial of service or potentially allow remote code execution. Mitigation per connected docs: upgrade...

CVE-2010-1199

CVE-2010-1199 : Integer overflow in the XSLT node sorting implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a large text value for a node. Affected products are t...

CVE-2012-0467

CVE-2012-0467 is reflected in multiple Nessus/MiracleLinux advisories for Mozilla Firefox 4.x–11.0, Firefox ESR 10.x (before 10.0.4), Thunderbird 5.0–11.0, Thunderbird ESR 10.x (before 10.0.4), and SeaMonkey before 2.9. The Connected documents describe a set of memory-safety and control-flow vuln...

CVE-2013-1717

CVE-2013-1717: Local-filesystem access via Java applets not properly restricted in Mozilla Firefox (before 23.0; ESR 17.x before 17.0.8), SeaMonkey (before 2.20), and Thunderbird (before 17.0.8). This allows user‑assisted reading of arbitrary files through downloads to fixed/predictable paths. Co...

CVE-2014-1574

CVE-2014-1574 affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The vulnerability arises from memory safety issues in the browser engine that could be exploited to cause a denial of service (memory corruption and application crash) or possibly ex...

CVE-2014-1587

CVE-2014-1587 affects Mozilla Firefox before 34.0, Firefox ESR before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31. It stems from memory safety bugs in the browser engine that can be exploited remotely to cause memory corruption, denial of service, or possibly arbitrary code execution...

CVE-2015-7194

CVE-2015-7194 affects Mozilla Firefox and Firefox ESR via a buffer underflow in libjar when parsing crafted ZIP archives. A remote attacker could crash the browser or possibly execute arbitrary code. Affected: Firefox before 42.0 and Firefox ESR 38.x before 38.4. Remediation: upgrade to Firefox 4...

CVE-2016-2820

CVE-2016-2820 affects Mozilla Firefox before 46.0, tied to the Firefox Health Reports (FHR) feature. The root cause is failure to properly restrict the origin of events within the remote-report IFRAME, enabling a remote attacker to influence sharing preferences by injecting events from untrusted ...

CVE-2016-5280

CVE-2016-5280 is a use-after-free in Mozilla Firefox (function mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap) that allows remote code execution via crafted bidirectional text in Firefox before 49.0 (ESR 45.x before 45.4; Thunderbird

CVE-2016-5291

CVE-2016-5291 is a local-bypass vulnerability where a attacker could load arbitrary local content by abusing local shortcut files, bypassing same-origin policy in Mozilla Firefox and Thunderbird products. Public details in connected docs indicate affected versions include Thunderbird < 45.5, F...

CVE-2017-7772

CVE-2017-7772 describes a heap-based buffer overflow in the Graphite2 library, specifically in lz4::decompress, affecting Firefox prior to 54. The issue is triggered when processing crafted font data, potentially allowing a crash or arbitrary code execution in the context of an application using ...

CVE-2018-12403

This CVE affects Mozilla Firefox before version 63. The issue arises when a site is loaded over HTTPS but a favicon is loaded over HTTP, causing the mixed-content warning not to display to users. Impact is the missing warning indicator (no direct exploit details provided here). Remediation: upgra...

CVE-2018-12407

CVE-2018-12407 describes a buffer overflow in the ANGLE graphics library used for WebGL content, triggered when drawing/validating elements in the VertexBuffer11 module. Affected software is Mozilla Firefox versions before 64; the vulnerability can lead to a crash and potentially exploitable cond...

CVE-2019-17013

No technical details about CVE-2019-17013 are provided in the connected documents. The materials reference Firefox memory-safety issues generally but do not specify affected versions, root cause, exploitability, or fixes for this CVE within the supplied material. Monitor for updates.

CVE-2020-35114

CVE-2020-35114 affects Mozilla Firefox before 84.0. Mozilla reports memory safety bugs in Firefox 83 that could lead to memory corruption and potentially arbitrary code execution; exploitation would require convincing a user to visit a crafted page. Affected products in the provided documents con...

CVE-2021-29947

CVE-2021-29947 is a Firefox memory-safety issue reported in Firefox 87 and prior builds, with memory corruption that could potentially allow arbitrary code execution. Connected sources (e.g., Alpine Arch ASA-202104-3, Arch Linux ASA entries, CNVD/CNNVD summaries, and MFSA 2021-16) consistently de...

CVE-2021-38494

CVE-2021-38494 maps to memory-safety bugs in Firefox 91 that could be triggered to run arbitrary code. Affected products: Mozilla Firefox earlier than 92. Root cause: memory corruption vulnerabilities disclosed by Mozilla; impact ranges to arbitrary code execution with potential for exploitation ...

CVE-2023-25748

CVE-2023-25748 is a public vulnerability affecting Firefox for Android (not other OSes). The issue arises when a prompt with a long description is displayed, potentially hiding the fullscreen notification and enabling user confusion or spoofing. Connected sources confirm this CVE is fixed in Fire...

CVE-2023-34415

Affected software: Mozilla Firefox. Issue: a site-isolation bypass vulnerability where a document loaded from a data: URL that was the result of a redirect could be loaded in the same process as the redirecting site, bypassing Spectre-like protections. Root cause: bypass of site-isolation protect...

CVE-2024-4771

CVE-2024-4771 concerns Mozilla Firefox where a missing memory-allocation check could cause a use-after-free if allocation fails, leading to a crash or potential code execution. Affected lineage: Firefox before version 126. The issue is tied to Firefox use-after-free in memory handling (no exploit...

CVE-2025-1931

CVE-2025-1931 describes a use-after-free in the content process side of a WebTransport connection, causing a potentially exploitable crash. Affected products/versions from the provided docs: Firefox < 136, Firefox ESR < 115.21 and < 128.8, Thunderbird < 136, and Thunderbird

CVE-2025-4093

CVE-2025-4093 involves a memory safety bug in Firefox ESR 128.9 and Thunderbird 128.9 that showed memory corruption with potential to enable arbitrary code execution. The vulnerability is fixed in Firefox ESR 128.10 and Thunderbird 128.10. The provided connected documents confirm affected product...

CVE-2010-3169

CVE-2010-3169 affects Mozilla's browser engine across multiple products: Firefox ≤ 3.5.11 (and 3.6.x prior to 3.6.9), Thunderbird ≤ 3.0.6 (and 3.1.x prior to 3.1.3), and SeaMonkey ≤ 2.0.6 (prior to 2.0.7). The issue is described as memory safety vulnerabilities in the browser engine that could al...

CVE-2012-4194

The CVE-2012-4194 issue affects Mozilla Firefox and related Mozilla components where the valueOf shadowing of the location object (window.location) enables cross-site scripting via plugin vectors. Affected software and versions (stated in the provided sources) include: Mozilla Firefox before 16.0...

CVE-2013-0744

CVE-2013-0744 is a use-after-free in the TableBackgroundPainter::TableBackgroundData::Destroy function of Mozilla Firefox prior to 18.0 (and Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2), Thunderbird prior to 17.0.2/ESR 10.x before 10.0.12/17.x before 17.0.2, and SeaMonkey prior to 2.15...

CVE-2013-1725

CVE-2013-1725 affects Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is that initialization of JavaScript objects with compartments may not occur, allowing remote attackers to execute a...

CVE-2015-0813

CVE-2015-0813 is a use-after-free in Mozilla Firefox (AppendElements) triggered when processing MP3 files via the Fluendo MP3 plugin for GStreamer on Linux. This can allow remote code execution or a heap-based denial of service. Affected: Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thu...

CVE-2015-2706

CVE-2015-2706 affects Mozilla Firefox before 37.0.2, where a race condition in AsyncPaintWaitEvent() during plugin initialization can lead to remote code execution or a denial of service via use-after-free. The vulnerability is confirmed in multiple advisories (e.g., Firefox updates to 37.0.2 add...

CVE-2015-4482

CVE-2015-4482 affects Mozilla Firefox before 40.0 and Firefox ESR before 38.2, via the Updater’s MAR file handling. mar_read.c could allow a crafted MAR file name to cause an out-of-bounds write, enabling local privilege gain or a denial of service. In public documents, the remediation typically ...

CVE-2016-1974

The CVE-2016-1974 issue affects Mozilla Firefox and Firefox ESR, where nsScannerString::AppendUnicodeTo can fail to verify memory allocation success, enabling a remote attacker to crash the browser or potentially execute arbitrary code via crafted Unicode data in HTML/XML/SVG. Affected versions a...

CVE-2016-2792

CVE-2016-2792 affects Graphite2 (graphite2) in Graphite font rendering used by Firefox

CVE-2016-2831

Mozilla Firefox and Firefox ESR are affected by CVE-2016-2831 where an error during fullscreen and pointerlock handling (and window closing) could allow a pointerlock in a fullscreen window without user permission, enabling UI outage, spoofing, and clickjacking. A fix is available in later Firefo...

CVE-2016-5257

CVE-2016-5257 affects Mozilla Firefox (non-ESR) and Thunderbird prior to specific fixed versions. Root cause: memory safety defects in the browser engine that could be exploited to execute arbitrary code or cause denial of service. Affected: Firefox before 49.0 and ESR 45.x before 45.4; Thunderbi...

CVE-2018-12388

Mozilla Firefox vulnerability CVE-2018-12388 arises from memory-safety bugs in Firefox 62 that could be triggered to cause memory corruption and, with sufficient effort, potentially execute arbitrary code. Affected products are Firefox versions before 63; remediation is to upgrade to Firefox 63 o...

CVE-2020-12409

Summary: CVE-2020-12409 affects Mozilla Firefox prior to 77. The root cause is a URL rendering issue where certain blank characters are shown as spaces instead of a properly encoded URL. Impact (as stated): URL forgery/defacement risk in the address bar. Affected versions: Firefox

CVE-2023-32208

CVE-2023-32208 describes a vulnerability in Mozilla Firefox prior to 113 where service workers could reveal the script base URL due to dynamic import(). The issue is limited to Firefox versions earlier than 113, with a CVSS v3.1 base score of 5.3 (Medium), affecting the confidentiality impact onl...

CVE-2023-32210

CVE-2023-32210 : Mozilla Firefox is affected by a vulnerability where documents could be loaded with a higher-privileged principal than intended due to an incorrect assumption about the ordering of principal objects. This could lead to privilege escalation or leakage under certain circumstances. ...

CVE-2024-3862

The vulnerability CVE-2024-3862 affects Mozilla Firefox and is caused by the MarkStack assignment operator in the JavaScript engine, which could access uninitialized memory if used in a self‑assignment. Affected products are Firefox versions older than 125. The practical impact is memory access r...

CVE-2009-2654

CVE-2009-2654 affects Mozilla Firefox 3.0.x and 3.5.x before certain fixed releases. A remote attacker could spoof the address bar via a crafted page that uses window.open with an invalid URL character, followed by document.write to the created object and a stop during the error page load, enabli...

CVE-2010-2762

CVE-2010-2762 affects Mozilla Firefox 3.6.x (prior to 3.6.9) and Thunderbird 3.1.x (prior to 3.1.3). The issue lies in the SafeJSObjectWrapper (SJOW) implementation: the XPCSafeJSObjectWrapper class does not properly restrict objects at the end of scope chains, enabling remote attackers to execut...

CVE-2015-0799

Summary: Mozilla Firefox before 37.0.1 is affected by CVE-2015-0799 due to the HTTP Alt-Svc feature, which allows a man‑in‑the‑middle attacker to bypass X.509 certificate verification by directing the client to a chosen server via the uri-host in an Alt-Svc header. Impact: potential MITM disclosu...

CVE-2015-4498

CVE-2015-4498 affects Mozilla Firefox and Firefox ESR. The vulnerability arises in the add-on installation flow: an attacker can bypass the user-confirmation prompt by crafting a data: URL and navigating to an arbitrary http: or https: URL early in the installation process, enabling installation ...

CVE-2015-4520

CVE-2015-4520 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. The vulnerability enables remote bypass of CORS preflight protections by (1) duplicating cache-key generation or (2) reading values from an incorrect HTTP Access-Control-* response header, potentially allowing cro...

CVE-2016-1930

CVE-2016-1930 affects Mozilla Firefox browser engine (and ESR 38.x) prior to 44.0/38.6, with memory-safety flaws that could lead to denial of service or remote code execution via unspecified vectors. The issue is documented across multiple advisories; affected products include Firefox, Iceweasel/...

CVE-2016-1973

CVE-2016-1973 is a race condition in GetStaticInstance within Firefox’s WebRTC implementation that can cause a use-after-free in WebRTC components. The issue was found in Mozilla Firefox prior to version 45.0 (Firefox ESR references show similar concerns in the 38.x ESR line). Reported root cause...