CVE-2016-1968

CVE-2016-1968: An integer underflow in Brotli decompression used by Mozilla Firefox prior to 45.0 can be triggered by crafted brotli data, leading to remote code execution or a denial of service. The issue is documented in MFSA 2016-30 (CVE-2016-1968) and was addressed by Firefox 45.0, with relat...

CVE-2026-7323

Memory safety bugs were reported in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0, and Thunderbird 150.0.0, with evidence of memory corruption and the possibility that exploiting these could have permitted arbitrary code execution. These issues have been fixed in Firefox 150.0.1...

CVE-2009-0355

CVE-2009-0355 affects Mozilla Firefox (components/sessionstore/src/nsSessionStore.js). Root cause: code does not block changes to input type="file" during tab restoration, enabling a crafted tab to let a user‑assisted remote attacker read arbitrary files on the client. Impact: local file disclosu...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2009-2470

CVE-2009-2470 is a Firefox/Thunderbird issue where remote SOCKS5 proxy replies with a long domain name can cause data stream corruption and a denial of service. Public details in connected documents reference Firefox versions affected (pre-3.0.12 and 3.5.x before 3.5.2) and note a related Thunder...

CVE-2011-2377

CVE-2011-2377 affects Mozilla Firefox (Firefox <3.6.18 and 4.x ≤ 4.0.1), Thunderbird (

CVE-2011-2993

CVE-2011-2993 describes unsigned JavaScript calling into signed JAR code, allowing Same Origin Policy bypass and privilege gain in Mozilla SeaMonkey/Firefox. Connected sources confirm the issue across SeaMonkey 2.x (fixed in SeaMonkey 2.3) and Firefox 4.x–5 timelines, with MFSA advisories and pat...

CVE-2012-1947

CVE-2012-1947 describes a heap-based buffer overflow in the utf16_to_isolatin1 function affecting Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability allows remote attackers to execute arb...

CVE-2012-1956

CVE-2012-1956 affects Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The issue is that Object.defineProperty can shadow the top-level location object (window.location), enabling cross-site scripting via plugin-imbued vectors. MiracleLinux advisories enumerate CVE-20...

CVE-2014-1577

CVE-2014-1577 affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The issue is in mozilla::dom::OscillatorNodeEngine::ComputeCustom() within Web Audio, where an invalid custom waveform can trigger a negative frequency, leading to an out-of-bounds r...

CVE-2014-8639

CVE-2014-8639 affects Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32. It improperly interprets Set-Cookie headers in responses with a 407 Proxy Authentication Required status, enabling a remote proxy to perform session fixation by inj...

CVE-2015-4506

CVE-2015-4506 is a buffer overflow in libvpx (vp9_init_context_buffers) used by Mozilla Firefox, allowing remote code execution via a crafted VP9 file. Affected: Firefox before 41.0 and Firefox ESR 38.x before 38.3. Remediation: upgrade to Firefox 41.0 or ESR 38.3+ (as applicable).

CVE-2015-4519

CVE-2015-4519 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. A crafted JavaScript sequence after dragging an image into a TEXTBOX can bypass access restrictions and disclose the redirect’s target URL (information disclosure). The issue is triggered via user-assisted interac...

CVE-2016-1944

CVE-2016-1944 affects Mozilla Firefox before 44.0 via a flaw in ANGLE’s Buffer11::NativeBuffer11::map, leading to memory corruption and potential denial of service. OpenSUSE/Mozilla advisories around 2016-02 show Firefox 44.0 (NSS 3.21, NSPR 4.11) as part of the fix set, with the issue listed amo...

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2018-5140

CVE-2018-5140 involves a disclosure in Mozilla Firefox prior to 59 where the moz-icon: protocol used by moz-icons can be accessed by web content, allowing a malicious page to leak information about which MIME types are associated with which applications. Affected product: Firefox and Firefox ESR ...

CVE-2018-5169

CVE-2018-5169 affects Mozilla Firefox versions before 60. A drag-and-drop of hyperlinked text containing a chrome: URL onto the home button can reset the homepage to include chrome pages. This is documented in Mozilla’s MFSA2018-11 advisory (CVE-2018-5169). Remediation observed in downstream advi...

CVE-2019-9798

CVE-2019-9798 affects Firefox on Android, where a world-writable APITRACE_LIB location can be loaded by the browser. An untrusted or compromised application could write malicious code to this library and trigger a man-in-the-middle scenario when the library is loaded, enabling data interception o...

CVE-2021-29962

CVE-2021-29962 affects Firefox for Android; the issue causes instability when a website opens too many popups and only impacts Firefox on Android, with affected versions being Firefox

CVE-2023-25736

This CVE concerns Mozilla Firefox. Affected component: browser/HTML handling where an invalid downcast from nsHTMLDocument to nsIContent could trigger undefined behavior. Impact: high/critical in CVSS terms, with potential for disruption or data exposure as described by multiple sources; affected...

CVE-2023-32209

CVE-2023-32209 : A maliciously crafted favicon could lead to an out-of-memory crash in Mozilla Firefox. Affected product/version: Firefox prior to 113. Impact: potential crash due to memory exhaustion when processing a favicon. Root cause details are limited in the provided documents beyond favic...

CVE-2023-37212

CVE-2023-37212 corresponds to memory-safety bugs in Mozilla Firefox affecting versions older than 115. The connected advisories confirm Firefox 114-era memory-corruption issues that could potentially be exploited to run arbitrary code, with the impact limited to the affected browser versions. The...

CVE-2024-4778

CVE-2024-4778 maps to memory-safety bugs in Firefox 125 that affect Firefox versions earlier than 126. The connected security bulletins note memory-corruption evidence and the potential for arbitrary code execution, with affected products including Firefox 125 (and Firefox ESR 115.10) prior to up...

CVE-2026-8389

CVE-2026-8389 is a JIT miscompilation vulnerability in the Firefox JavaScript Engine (JIT component). Multiple connected sources (NVD, EUVD, CIRCL sighting, Debian/MD advisories, and Mozilla MFSA advisory) confirm the issue affects Firefox and was addressed in version 150.0.3. The underlying issu...

CVE-2006-6077

Technical details about CVE-2006-6077 are not provided in the connected documents. The initial description mentions the vulnerability, but no specific vendor/product/version or remediation details are included here. Monitor for updates from authoritative sources.

CVE-2009-0774

The CVE-2009-0774 entry affects the Mozilla layout/JavaScript stack: Firefox 2 and 3 prior to 3.0.7, Thunderbird prior to 2.0.0.21, and SeaMonkey prior to 1.1.15 are vulnerable to remote-triggered denial of service and potential arbitrary code execution via gczeal-related vectors (distinct from C...

CVE-2009-3984

CVE-2009-3984 affects Mozilla Firefox up to 3.0.16 and Firefox 3.5.x up to 3.5.6, as well as SeaMonkey up to 2.0.1. Root cause: spoofing of the SSL indicator by navigating a document.location to an HTTPS URL that serves a 204 No Content with an empty body, enabling a user-facing location-bar spoo...

CVE-2011-0064

The CVE-2011-0064 issue affects HarfBuzz’s hb_buffer_ensure() as used by Pango (notably in Pango 1.28.3) and other products, where memory reallocations are not verified, potentially causing a NULL pointer dereference leading to a crash or, via crafted OpenType data triggering an incorrect index, ...

CVE-2011-0065

CVE-2011-0065 is a use-after-free in Mozilla Firefox (before 3.5.19 and 3.6.x before 3.6.17) and SeaMonkey (before 2.0.14) tied to OBJECT's mChannel in OnChannelRedirect. A remote attacker could trigger arbitrary code execution. MFSA2011-13 documents fixes; remediation is upgrading to fixed Firef...

CVE-2011-3005

CVE-2011-3005 is a use-after-free in Mozilla Firefox (4.x–6) that can be triggered via crafted OGG headers in a .ogg file, potentially leading to remote code execution or a crash. Affected products/versions include Firefox 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root caus...

CVE-2011-3648

CVE-2011-3648 is an XSS vulnerability in Mozilla Firefox prior to 3.6.24 and 4.x through 7.0 and in Thunderbird prior to 3.1.6 and 5.0 through 7.0. It allows remote attackers to inject arbitrary web script or HTML via crafted text encoded in Shift_JIS. Affected products include Firefox and Thunde...

CVE-2012-0473

CVE-2012-0473 : In Mozilla Firefox and related Mozilla products, the WebGLBuffer::FindMaxUshortElement function calls FindMaxElementInSubArray with incorrect template arguments, allowing remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. Affe...

CVE-2012-1957

CVE-2012-1957 : An unspecified parser-utility class in Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 mishandles EMBED elements inside RSS description feeds, enabling remote XSS via a feed. Affected pro...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2014-1550

CVE-2014-1550 is a use-after-free in Mozilla Firefox (before 31.0) and Thunderbird (before 31.0) affecting the MediaInputPort class. The underlying issue is a heap memory corruption caused by incorrect Web Audio control-message ordering, which could allow a remote attacker to execute arbitrary co...

CVE-2014-1594

CVE-2014-1594 affects Mozilla Firefox (pre-34.0), Firefox ESR (pre-31.3), Thunderbird (pre-31.3), and SeaMonkey (pre-2.31). The underlying issue is a casting error: an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type. This can allow a remote attacker to exec...

CVE-2015-0833

CVE-2015-0833 affects Mozilla Firefox (pre-36.0), Firefox ESR (pre-31.x up to 31.5), and Thunderbird (pre-31.5) on Windows. It is a local privilege-escalation via untrusted search paths where a Trojan horse DLL (e.g., bcrypt.dll) in the current working directory or a temporary directory is loaded...

CVE-2015-7184

CVE-2015-7184 affects Mozilla Firefox before 41.0.2, where the fetch() API implementation did not adequately restrict access to the HTTP response body in certain cases when credentials are used. The issue arises from an improper handling of the CORS cross-origin request algorithm, allowing a remo...

CVE-2015-7218

CVE-2015-7218 affects Mozilla Firefox before 43.0. The HTTP/2 implementation allows remote DoS via a single-byte header frame that triggers integer underflow and incorrect memory allocation, leading to an assertion and application exit. Public advisories (e.g., Mageia/OpenSUSE/Fedora/Nessus-docum...

CVE-2016-2829

CVE-2016-2829 affects Mozilla Firefox prior to 47.0. A crafted website that rapidly triggers multiple permission requests (e.g., microphone or geolocation) can cause the notification icon to be incorrect, enabling spoofing of permission prompts. This could mislead users into granting access to re...

CVE-2017-7752

CVE-2017-7752 is a use-after-free vulnerability triggered by specific user interactions with the input method editor (IME) in certain languages. The flaw is reported to affect Mozilla Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The impacted component is tied ...

CVE-2017-7783

CVE-2017-7783 describes a denial-of-service vulnerability in Mozilla Firefox affecting versions earlier than 55. The issue occurs when a long username is used in a username:password@URL (for example http://UserName:[email protected]); the browser’s modal prompt can hang or crash, leading to a ...

CVE-2017-7812

CVE-2017-7812 is confirmed in the provided Open Source vulnerability set. Affected: Firefox versions prior to 56.0. Issue: dragging web content onto parts of the browser UI (e.g., the tab bar) allows links to open that would normally be disallowed, enabling a malicious page to trigger opening a l...

CVE-2018-5101

Mozilla Firefox vulnerable before version 58 due to a use‑after‑free in manipulating floating first‑letter style elements, leading to potentially exploitable crashes. Affected: Firefox

CVE-2018-5106

CVE-2018-5106 is a Firefox Developer Tools vulnerability affecting Firefox versions prior to 58. The issue allows a third‑party hosted service worker to leak style editor information when a user with DevTools open clicks error links, enabling cross‑origin data exposure of the editor. Affected pro...

CVE-2023-28159

The CVE-2023-28159 entry concerns Firefox for Android only. It describes a vulnerability where the fullscreen notification could be hidden by using download popups, potentially confusing users or enabling spoofing. Root cause details are not further specified in the provided documents. Impact is ...

CVE-2009-1308

CVE-2009-1308 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox prior to 3.0.9, also affecting Thunderbird and SeaMonkey. The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, with exploitation...

CVE-2009-1392

The CVE-2009-1392 issue affects Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17. It enables memory corruption that can cause a denial of service or potentially allow arbitrary code execution via multiple code paths in the browser engine and UI (e.g., nsEv...

CVE-2010-2754

CVE-2010-2754 affects Mozilla Firefox 3.5.x before 3.5.11, Firefox 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6. It relates to the window.onerror path and may allow a remote attacker to obtain sensitive information about script parameters v...

CVE-2013-1671

CVE-2013-1671 affects Mozilla Firefox prior to 21.0. The vulnerability arises in the handling of the INPUT/file input element, allowing a remote site to obtain the full local path of a file chosen via the element. This can lead to partial confidentiality impact as described in MFSA 2013-43. The i...