CVE-2013-5593

The CVE-2013-5593 issue affects Mozilla Firefox (and related Mozilla products) where the SELECT element’s handling of HTML in dropdowns did not properly restrict content, allowing remote attackers to spoof the address bar or perform clickjacking via navigation-redirect vectors. Affected products/...

CVE-2010-0170

Technical details about CVE-2010-0170 are not provided in the connected documents. Public details appear limited to the initial description in this entry. Monitor for updates and new disclosures in authoritative advisories. The supplied documents do not specify affected products, versions, root c...

CVE-2010-0171

CVE-2010-0171 affects Mozilla Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; and SeaMonkey before 2.0.3. It enables remote attackers to perform cross-origin keystroke capture and possibly XSS by abusing addEventListener and setTimeout with wrapped o...

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2013-1720

The CVE-2013-1720 issue affects Mozilla Firefox (pre-24.0), Thunderbird (pre-24.0), and SeaMonkey (pre-2.21) where the nsHtml5TreeBuilder::resetTheInsertionMode logic fails to correctly maintain the insertion-mode stack for template elements. This misstate allows a remote attacker to trigger use ...

CVE-2013-5603

The vulnerability CVE-2013-5603 affects Mozilla Firefox before 25.0 (and related ESR/Thunderbird/SeaMonkey releases) via a use-after-free in nsContentUtils::ContentIsHostIncludingDescendantOf, enabling remote code execution or heap memory corruption through HTML document templates. Impact is remo...

CVE-2013-5614

Affected software: Mozilla Firefox <= 25.x/26.0 and SeaMonkey

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2015-2715

CVE-2015-2715 describes a race condition in Mozilla Firefox prior to 38.0 related to nsThreadManager::RegisterCurrentThread during shutdown when Media Decoder threads are created. This leads to use-after-free and heap memory corruption, enabling remote attackers to potentially execute arbitrary c...

CVE-2016-2811

CVE-2016-2811 is a Use-After-Free in Firefox’s ServiceWorkerInfo (Service Worker) that allows remote code execution via BeginReading in Firefox before 46.0. Connected advisories show this CVE fixed in Firefox 46.0 (e.g., openSUSE-2016-541/566, Ubuntu USN-2936, Debian security tracker). Affected p...

CVE-2016-5268

CVE-2016-5268 affects Mozilla Firefox

CVE-2016-5294

CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox

CVE-2016-9067

CVE-2016-9067 refers to two heap-use-after-free vulnerabilities in Firefox’s DOM operations, specifically nsINode::ReplaceOrInsertBefore, potentially allowing crashes exploitable through crafted content in Firefox versions before 50. The related advisories confirm the issue as a memory-safety bug...

CVE-2016-9077

The CVE-2016-9077 issue affects Mozilla Firefox

CVE-2017-7788

CVE-2017-7788 affects Firefox

CVE-2024-2613

CVE-2024-2613 affects Mozilla Firefox prior to version 124, caused by improper sanitization when decoding a QUIC ACK frame, leading to unbounded memory growth and a crash. Affected deployments in connected advisories reference Firefox

CVE-2025-5264

CVE-2025-5264 involves insufficient escaping of the newline character in Firefox/Thunderbird Copy as cURL functionality, enabling a user to be tricked into executing a crafted command locally. Affected: Firefox < 139, Firefox ESR < 115.24/128.11, Thunderbird

CVE-2026-7320

CVE-2026-7320 involves an information disclosure in the Firefox Audio/Video component caused by incorrect boundary conditions. Affected products are Firefox desktop browser (and ESR branches). The vulnerability allows information disclosure with high confidentiality impact (per CVSS: AV:N/AC:L/PR...

CVE-2009-1310

CVE-2009-1310 is a cross-site scripting (XSS) vulnerability in the MozSearch plugin interface of Mozilla Firefox, exploitable via a javascript: URI in the SearchForm element. Affected software: Mozilla Firefox (before 3.0.9). Root cause: MozSearch-related XSS in the browser’s search form. Impact:...

CVE-2012-0451

CVE-2012-0451 affects Mozilla Firefox 4.x–10.0 (and ESR 10.x before 10.0.3), Thunderbird 5.0–10.0, and SeaMonkey before 2.8. The issue is a CRLF injection via crafted HTTP headers that can bypass CSP restrictions and potentially enable XSS. Remediation in the connected documents points to applyin...

CVE-2012-0460

CVE-2012-0460 affects Mozilla Firefox 4.x–10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0–10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8. The issue arises from insufficiently restricting write access to the window.fullScreen object, enabling remote pages to spoof the use...

CVE-2012-1962

CVE-2012-1962 is a use-after-free in Mozilla’s JSDependentString::undepend that affects Firefox 4.x–13.0, ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11, enabling remote memory corruption and possibly arbitrary code execution. Connected advisories (e.g., MFSA2012-52 and r...

CVE-2012-5841

CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2013-6672

CVE-2013-6672: Firefox (Linux) and SeaMonkey are affected by a Linux clipboard information disclosure via middle-click paste. The initial entry specifies Firefox < 26.0 and SeaMonkey

CVE-2015-0808

CVE-2015-0808 is a memory management flaw in Mozilla Firefox’s WebRTC code. The webrtc::VPMContentAnalysis::Release function deallocates memory for simple-type arrays using an incompatible approach, potentially allowing a remote attacker to cause memory corruption and a denial of service. Affecte...

CVE-2016-1956

The CVE describes a vulnerability in Mozilla Firefox on Linux when using Intel graphics drivers. Triggering a WebGL shader can cause a remote denial of service via memory exhaustion or heap/stack memory corruption. Affected product: Firefox prior to 45.0 on Linux with Intel video drivers. Root ca...

CVE-2016-2807

CVE-2016-2807 is a set of memory-safety issues in Mozilla Firefox’s browser engine affecting Firefox, ESR 38.x and ESR 45.x branches. Connected advisories indicate these flaws could allow memory corruption and a potential arbitrary-code execution or DoS. Remediation across sources centers on upgr...

CVE-2016-2818

CVE-2016-2818 corresponds to memory safety bugs in the Mozilla Firefox browser engine that could allow remote code execution or denial of service. The connected IBM advisories indicate the vulnerability affecting IBM products shipped with Firefox (IBM SONAS and IBM Storwize V7000 Unified), with a...

CVE-2016-5255

CVE-2016-5255 is a use-after-free in Mozilla Firefox’s js::PreliminaryObjectArray::sweep during incremental garbage collection that could allow remote code execution via crafted JavaScript. Affected product: Firefox (pre-48.0); the openSUSE advisory indicates fix in version 48.0. The connected do...

CVE-2016-9071

CVE-2016-9071 describes a vulnerability in Mozilla Firefox prior to 50 where Content Security Policy combined with HTTP-to-HTTPS redirection could allow a malicious server to determine if a site is present in a user’s browsing history. Impact: history verification via CSP/HSTS/redirect. Affected ...

CVE-2017-5406

CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...

CVE-2017-5418

CVE-2017-5418 is an out-of-bounds read error in parsing HTTP digest authorization responses, leading to information leakage. Affected products are Mozilla Firefox and Thunderbird prior to version 52.0. The issue is fixed in Firefox 52.0+ (and related Thunderbird updates per advisories), with reme...

CVE-2018-5094

CVE-2018-5094 describes a heap buffer overflow in WebAssembly when shrinkElements is invoked and memory GC runs on memory that is now uninitialized, potentially causing a crash in Firefox before version 58. The vulnerability affects Firefox’s WebAssembly handling (shrinkElements/Memory resize pat...

CVE-2018-5137

CVE-2018-5137 affects Firefox for pre-59 releases. A legacy extension’s non-contentaccessible, defined resources can be loaded by an arbitrary web page using a maliciously crafted path string. The vulnerability does not affect WebExtensions. Root cause: loading defined resources from legacy exten...

CVE-2022-46883

CVE-2022-46883 : Mozilla Firefox contains memory-safety bugs in Firefox 106 that could allow arbitrary code execution. The fixes were included in Firefox 107, and the vulnerability affects Firefox versions earlier than 107 (no exploit details provided in the documents). Affected : Firefox

CVE-2023-3482

The CVE-2023-3482 issue affects Mozilla Firefox prior to version 115, where blocking all cookies does not prevent data exfiltration via localStorage using an iframe with src='about:blank'. This allows a malicious site to store tracking data in the local storage without permission, representing an...

CVE-2026-2447

CVE-2026-2447 describes a heap buffer overflow in libvpx that affects components used by Firefox and Thunderbird. The Initial Description notes fixes in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Connected documents corroborate the sa...

CVE-2011-3663

CVE-2011-3663 affects Mozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. It allows remote attackers to capture keystrokes entered on a web page via SVG animation accessKey events, even when JavaScript is disabled. The description in the provided documents states the affected ...

CVE-2012-1963

CVE-2012-1963 is a real vulnerability described in multiple sources. It affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x prior to 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x prior to 10.0.6, and SeaMonkey before 2.11. The issue is that the Content Security Policy (CSP) blocked-uri string...

CVE-2013-0799

The CVE-2013-0799 issue is a local privilege-escalation vulnerability in the Mozilla Maintenance Service component of Mozilla Firefox (and Thunderbird) prior to certain 17.x/20.0-era builds on Windows. It stems from a buffer overflow when processing crafted arguments, allowing an unprivileged use...

CVE-2013-5619

CVE-2013-5619 describes a vulnerability in Mozilla’s SpiderMonkey JavaScript engine where the binary-search implementation could overflow, potentially enabling a remote attacker to cause a denial of service via crafted JavaScript. The initial Mozilla/OpenSUSE/IBM advisories confirm this is a Java...

CVE-2014-1502

CVE-2014-1502 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The vulnerability arises in WebGL functions WebGL.compressedTexImage2D and WebGL.compressedTexSubImage2D, enabling remote attackers to bypass Same Origin Policy and render content from a different domain via unspecified ve...

CVE-2014-1553

Technical details about CVE-2014-1553 are not publicly provided in the connected documents. Monitor for updates from vendors/security advisories; current sources only reference the CVE among broader Firefox/Thunderbird vulnerabilities, with no explicit affected versions or fixes in the supplied d...

CVE-2014-1565

Technical details about CVE-2014-1565 are not provided in the connected documents. OpenSUSE and OSV entries reference Firefox-related updates but do not describe affected components, impact, or fixes for this CVE. Monitor for updates.

CVE-2014-1580

CVE-2014-1580 affects Mozilla Firefox prior to 33.0 due to uninitialized memory being used during GIF rendering within CANVAS, enabling a crafted page to reveal process memory. Open‑source advisories (e.g., openSUSE/SUSE updates around Firefox 33.0 and related security advisories) confirm the iss...

CVE-2015-0836

CVE-2015-0836 involves multiple memory-safety vulnerabilities in the Mozilla Firefox browser engine and related Thunderbird components. Affected products/versions include Firefox up to 36.0, Firefox ESR up to 31.x before 31.5, and Thunderbird up to 31.5. The flaws allow remote attackers to cause ...

CVE-2015-2725

CVE-2015-2725 refers to multiple memory safety vulnerabilities in Mozilla Firefox (and Thunderbird) that could allow remote code execution or memory corruption leading to a crash. The connected IBM advisories confirm affected products (IBM Storwize V7000 Unified and IBM SONAS) ship Firefox compon...

CVE-2015-4512

CVE-2015-4512: In Mozilla Firefox before 41.0 on Linux, gfx/2d/DataSurfaceHelpers.cpp may misuse Cairo when creating a 32‑bit color surface and displaying it as a 16‑bit surface, enabling out‑of‑bounds reads and potential information disclosure or denial of service via a crafted CANVAS trigger. A...