CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2015-2717

CVE-2015-2717 describes an integer overflow in the libstagefright component of Mozilla Firefox before 38.0, exploitable via MP4 metadata to cause a heap-based buffer overflow or out-of-bounds read, potentially enabling remote code execution or a denial of service. Affected software is Firefox (an...

CVE-2015-4483

CVE-2015-4483 affects Mozilla Firefox up to version 40.0. A vulnerability in the feed: protocol combined with POST requests can bypass the browser’s mixed-content protections, enabling MITM-scripted content on a page. Remediation: upgrade to the latest Firefox (40.0+).

CVE-2015-7180

The CVE-2015-7180 entry affects Mozilla Firefox (ReadbackResultWriterD3D11::Run) where the function misinterprets the return value, potentially enabling remote code execution or memory corruption leading to a crash or other impact if a victim visits a malicious page. The provided documents primar...

CVE-2016-9064

CVE-2016-9064 affects Mozilla Firefox and Firefox ESR due to inadequate verification in the addon update mechanism: the add-on ID in the signed package could mismatch the target add-on, enabling a MITM attacker to substitute a malicious signed update. Documents indicate this affects Firefox ESR &...

CVE-2017-5387

CVE-2017-5387 affects Mozilla Firefox (pre-51). Root cause: local-file existence can be inferred via double firing of onerror when a TRACK tag references a non-existent source loaded locally. Impact: disclosure of local file existence; no explicit exploitation details provided in the sources. Aff...

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-5090

CVE-2018-5090 affects Mozilla Firefox 57 and earlier due to memory-safety bugs that may allow memory corruption and arbitrary code execution. The vulnerability is described as memory safety issues in Firefox

CVE-2018-5092

CVE-2018-5092 is a use-after-free in Firefox related to Web Workers. Affected product: Mozilla Firefox (pre-58 versions). Description: the Web Worker thread may be freed from memory prematurely during fetch cancellation, causing memory safety issues. Impact stated in sources is memory safety risk...

CVE-2018-5107

CVE-2018-5107 : In Firefox, the printing path can bypass local access protections, allowing reading of files reachable via symlinks. Although the printer processing restricts data to a format, some local file information could be exposed. Affects Firefox versions older than 58; mitigation is to u...

CVE-2018-5118

CVE-2018-5118 affects Firefox

CVE-2018-5128

CVE-2018-5128 is a use-after-free vulnerability in Firefox that can occur when manipulating elements, events, and selection ranges during editor operations, leading to a potentially exploitable crash. Affected products include Firefox versions older than 59 across platforms (Windows, macOS, Linux...

CVE-2018-5143

CVE-2018-5143 is reported against Mozilla Firefox versions before 59.0. The issue arises when a javascript: URL containing a tab character bypasses protocol removal in the address bar, enabling an XSS-style impact where a user could be socially engineered to execute a script in their own browser....

CVE-2018-5160

CVE-2018-5160 affects Firefox

CVE-2023-23604

A vulnerability (CVE-2023-23604) affects Mozilla Firefox older than 109. A duplicate SystemPrincipal object could be created when parsing a non-system HTML document via DOMParser::ParseFromSafeString, potentially bypassing web security checks. The issue is documented across multiple sources (nota...

CVE-2024-0744

Vulnerability CVE-2024-0744 affects Mozilla Firefox. A JIT-compiled code path could dereference a wild pointer, potentially causing an exploitable crash in Firefox versions older than 122. Affected products/versions include Firefox

CVE-2008-3837

CVE-2008-3837 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2) and SeaMonkey (before 1.1.12). A crafted onmousedown action that calls window.moveBy can allow a user‑assisted remote attacker to move a window during a mouse click, potentially triggering a drag‑and‑drop–related action ...

CVE-2009-0357

CVE-2009-0357 affects Mozilla Firefox (before 3.0.6) and SeaMonkey (before 1.1.15). The vulnerability stems from not properly restricting access from web pages to the Set-Cookie/Set-Cookie2 HTTP response headers, allowing an attacker to read cookie data via XMLHttpRequest calls and potentially ex...

CVE-2009-0773

Mode C: The CVE-2009-0773 issue affects Mozilla Firefox (and related Mozilla-based browsers) prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey 1.1.15. The vulnerability is in the JavaScript engine and is triggered by: (1) a splice of an array containing some non-set elements, causing j...

CVE-2009-1312

CVE-2009-1312 affects Mozilla Firefox prior to 3.0.9 and SeaMonkey prior to 1.1.17, where javascript: URIs in Refresh headers are not blocked in HTTP responses, enabling remote XSS via header injection or header content manipulation. The connected documents indicate the issue was addressed in rel...

CVE-2010-0176

CVE-2010-0176 affects Mozilla Firefox (before 3.0.19; 3.5.x before 3.5.9; 3.6.x before 3.6.2), Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is a reference-counting error for option elements in a XUL tree optgroup, described as a dangling pointer vulnerability that could allow r...

CVE-2010-1121

CVE-2010-1121 affects Mozilla Firefox 3.6.x prior to 3.6.3. The issue is a DOM scope handling flaw when nodes are moved across documents, enabling use-after-free conditions that can lead to remote code execution. Exploitation was demonstrated in a Pwn2Own event; no explicit exploit details are pr...

CVE-2010-1209

CVE-2010-1209 affects Mozilla Firefox (3.5.x up to 3.5.10; 3.6.x up to 3.6.6) and SeaMonkey (up to 2.0.5) via a use-after-free in the NodeIterator implementation. The issue arises when a crafted NodeFilter detaches nodes during traversal, enabling memory corruption and potential remote code execu...

CVE-2012-0471

CVE-2012-0471 is documented in multiple connected advisories as a Cross-site Scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The root cause is a vulnerabi...

CVE-2012-0478

CVE-2012-0478 affects Mozilla Firefox WebGL texImage2D in Firefox 4.x–11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0–11.0 and ESR 10.x before 10.0.4, and SeaMonkey before 2.9. Root cause is improper restriction of JSVAL_TO_OBJECT casts in WebGL, enabling remote code execution via a crafted...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2014-1593

CVE-2014-1593 is a stack-based buffer overflow in Mozilla Firefox’s mozilla::FileBlockCache::Read that could allow remote code execution via crafted media content. Affected products and versions in the provided documents: Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird befo...

CVE-2015-0819

The CVE-2015-0819 issue affects Mozilla Firefox and stems from UITour::onPageEvent not validating that an API call originates from a foreground tab. This can enable spoofing and clickjacking when a UITour page in a background tab is whitelisted. Affected releases are Firefox versions before 36.0;...

CVE-2015-0829

CVE-2015-0829 affects Mozilla Firefox desktop prior to 36.0, due to a buffer overflow in libstagefright during MP4 video playback. This can allow remote code execution via a crafted MP4 file. Public advisories (e.g., openSUSE-2015-185) indicate upgrading Firefox to 36.0 (or newer) fixes this issu...

CVE-2015-2712

Mozilla Firefox before 38.0 is affected by CVE-2015-2712 due to an issue in the asm.js validation that misdefines heap lengths, enabling out-of-bounds writes (and potentially reads) via crafted JavaScript and possibly allowing arbitrary code execution or memory leakage. The fault is described in ...

CVE-2015-2729

Mozilla Firefox contains an out-of-bounds read in AudioParamTimeline::AudioNodeInputValue affecting Web Audio oscillator rendering range (pre-39.0 and ESR 38.x before 38.1). Remote attackers could disclose a few bytes of memory or trigger a DoS. The fix is to upgrade Firefox to 39.0+ (and ESR 38....

CVE-2015-4511

CVE-2015-4511 is a heap-based buffer overflow in Firefox’s nestegg_track_codec_data used when decoding WebM headers. A crafted header in a WebM video could allow remote code execution. Affected products/versions: Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. Remediation: upgrade t...

CVE-2015-7174

CVE-2015-7174 affects Mozilla Firefox (and ESR 38.x) with the nsAttrAndChildArray::GrowBy vulnerability. The issue could allow remote attackers to cause memory corruption and a crash or potentially other impact via an overflow in this function, when processing crafted web content. Affected produc...

CVE-2016-1963

CVE-2016-1963: In Mozilla Firefox, the FileReader API can be abused to memory-corrupt the process by changing a file during a FileReader read operation, allowing a local attacker to gain privileges or cause a denial of service. Affected are Firefox versions prior to 45.0; remediation is to upgrad...

CVE-2017-7780

CVE-2017-7780 refers to memory safety bugs in Mozilla Firefox 54 that could be exploited to run arbitrary code. The advisory notes memory corruption and that Firefox versions before 55 are affected (i.e., Firefox 54 and ESR 52.2). The connected Nessus/NVD records enumerate additional related CVEs...

CVE-2018-5112

CVE-2018-5112 affects Mozilla Firefox prior to version 58. The issue arises because Development Tools panels of an extension may load URLs using relative paths from the extension manifest, but this enforcement was not applied in all cases. The vulnerability could allow a developer tools panel to ...

CVE-2018-5179

Affected software: Chromium/Google Chrome (browser). Issue: CVE-2018-5179, within the ServiceWorker implementation, where the update() path could run indefinitely due to insufficient limits. Cause: described as an error in the ServiceWorker component; multiple vendor advisories map this CVE to pr...

CVE-2021-29944

CVE-2021-29944 details: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View in Firefox for Android. HTML injection is possible despite a Content Security Policy preventing direct code execution. Affected product/versions: Firefox before 88 on Android. Other operating ...

CVE-2022-45413

CVE-2022-45413 affects Firefox for Android, where the S.browser_fallback_url parameter can redirect a user and cause SameSite=Strict cookies to be sent. The issue is limited to Firefox on Android; other OSes are unaffected. The vulnerability targets the browser’s handling of SameSite cookies, pot...

CVE-2022-46873

CVE-2022-46873 affects Mozilla Firefox, with the vulnerability arising because Firefox did not implement the unsafe-hashes CSP directive. An attacker who can inject markup into a page protected by a CSP could execute script, constrained by the document’s CSP. Affected: Firefox versions earlier th...

CVE-2024-0748

CVE-2024-0748 concerns Mozilla Firefox where a compromised content process could update the document URI, enabling an attacker to set an arbitrary URI in the address bar or history. The issue affects Firefox versions earlier than 122 and is addressed by Mozilla in MFSA2024-01, which notes fixes i...

CVE-2024-3858

CVE-2024-3858 concerns Mozilla Firefox: a vulnerability that allows mutating a JavaScript object such that the JIT could crash while tracing it, affecting Firefox versions older than 125. The issue is documented in multiple feeds (including Mozilla MFSA advisory) and is tracked across several sec...

CVE-2025-6424

CVE-2025-6424: Use-after-free in FontFaceSet causing potentially exploitable crash in Firefox (affected: Firefox <140, ESR <115.25, ESR

CVE-2026-7321

CVE-2026-7321 describes a sandbox escape vulnerability in the WebRTC: Networking component, caused by incorrect boundary conditions. Affected product is Firefox ESR; the issue was fixed in Firefox ESR 140.10.1. The NVD entry lists a HIGH/CRITICAL impact profile with network attack vector, requiri...

CVE-2026-7323

Memory safety bugs were reported in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0, and Thunderbird 150.0.0, with evidence of memory corruption and the possibility that exploiting these could have permitted arbitrary code execution. These issues have been fixed in Firefox 150.0.1...