CVE-2018-18496

CVE-2018-18496 is a clickjacking vulnerability in Mozilla Firefox’s feed preview page about:feeds. When the RSS Feed preview is framed in another page, scripted content can coerce a user into downloading and executing an executable from a temporary directory. It affects Firefox versions earlier t...

CVE-2025-9179

CVE-2025-9179 describes a memory corruption vulnerability in the GMP process used by Firefox/Thunderbird for encrypted media handling, with privileges that are sandboxed yet could allow total impact (CVE-2025-9179). Affected products include Firefox < 142, Firefox ESR < 115.27/128.14/140.2,...

CVE-2026-6746

This CVE (CVE-2026-6746) is a use-after-free in the DOM: Core & HTML component. The Initial document states it was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected documents also reference Mozilla advisories tying this CVE to Firefox...

CVE-2006-1728

CVE-2006-1728 affects multiple Mozilla-based products (Firefox and Thunderbird 1.x < 1.5.0.2; Mozilla Suite < 1.7.13; SeaMonkey

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2006-3809

CVE-2006-3809: Firefox <=1.5.0.4/Thunderbird <=1.5.0.4/SeaMonkey

CVE-2008-0414

Mozilla Firefox <=2.0.0.11/SeaMonkey

CVE-2008-5014

CVE-2008-5014 affects Mozilla firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: modifying window.proto .proto can lock a non-native object, triggering an OBJ_IS_NATIVE assertion. Impact: remote attacker could crash...

CVE-2008-5019

CVE-2008-5019 affects Mozilla Firefox 3.x prior to 3.0.4 and 2.x prior to 2.0.0.18. The session restore feature can bypass the same-origin policy, enabling cross-site scripting and arbitrary JavaScript execution with chrome privileges via unknown vectors. Mitigation per the connected advisories i...

CVE-2008-5511

Affected software: Mozilla Firefox (3.x before 3.0.5; 2.x before 2.0.0.19), Mozilla Thunderbird (2.x before 2.0.0.19), and SeaMonkey (1.x before 1.1.14). Root cause: vulnerability in XBL bindings allowing an XSS payload via an unloaded document, combined with bypass of the same-origin policy (CVE...

CVE-2010-3772

Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, contain a vulnerability where a DIV inside a XUL tree's treechildren causes index calculations to be incorrect, enabling arbitrary code execution via crafted content. MiracleLinux AXSA:2010-507:08 lists CVE-2010-3...

CVE-2011-0072

CVE-2011-0072 refers to an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14, allowing remote attackers to cause memory corruption and application crashes or possibly execut...

CVE-2011-0078

CVE-2011-0078 is an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x prior to 3.5.19, Firefox 3.6.x prior to 3.6.17, Thunderbird prior to 3.1.10, and SeaMonkey prior to 2.0.14. The issue can cause a denial of service through memory corruption and may allow arbitrary...

CVE-2011-0081

CVE-2011-0081 covers an unspecified memory-corruption vulnerability in the Mozilla Firefox 3.6.x engine (before 3.6.17) and Firefox 4.x (before 4.0.1), and in Thunderbird 3.1.x (before 3.1.10). It can be exploited remotely to cause a denial of service or potentially execute arbitrary code via unk...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2014-1538

CVE-2014-1538 is a use-after-free in Mozilla Firefox's nsTextEditRules::CreateMozBR that can lead to remote code execution or a heap memory corruption condition. It affects Firefox before 30.0, ESR 24.x before 24.6, and Thunderbird before 24.6. Public advisories in connected docs show fixes: Fire...

CVE-2015-0800

The CVE-2015-0800 entry concerns Mozilla Firefox on Android (pre-37.0) where the DNS resolver’s PRNG for query IDs and UDP source ports may not generate random values properly. This weakens the ability to distinguish genuine DNS responses from spoofed ones, enabling remote attackers to spoof DNS ...

CVE-2015-4505

CVE-2015-4505 affects Mozilla Firefox on Windows (updater.exe) where local users can write to arbitrary files by abusing a junction attack during the Mozilla Maintenance Service update process. Root cause: a flaw in the updater path that permits writing arbitrary files during update. Impact in th...

CVE-2017-5468

The CVE-2017-5468 issue affects Mozilla Firefox before version 53, related to an incorrect ownership model of privateBrowsing information exposed via developer tools. The underlying problem is in how privateBrowsing ownership is tracked in the developer tools, which can trigger a non-exploitable ...

CVE-2017-7835

CVE-2017-7835 affects Mozilla Firefox < 57.0. The issue is that mixed content blocking for insecure (HTTP) sub-resources in HTTPS pages failed for resources that redirect from HTTPS to HTTP, allowing blocked content such as scripts to load. The connected Nessus/Ubuntu advisories corroborate th...

CVE-2017-7840

CVE-2017-7840 affects Firefox

CVE-2021-29973

Firefox for Android was vulnerable to password autofill being triggered on insecure websites without user interaction. The issue, affecting Firefox versions earlier than 90, was fixed by requiring user interaction before autofill occurs; the mitigation is upgrading to Firefox 90 or newer. The vul...

CVE-2026-12318

CVE-2026-12318 concerns the Mozilla NSS Libraries component. The vulnerability is described as incorrect boundary conditions in the NSS Libraries, with the fixed versions identified as Firefox 152 and Thunderbird 152. Connected sources confirm this fix and cite Firefox/Thunderbird 152 as the reme...

CVE-2006-0748

CVE-2006-0748 affects Mozilla Firefox/Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The vulnerability arises from an invalid and non-sensical ordering of table-related tags that results in a negative array index, enabling remote ar...

CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2008-0416

CVE-2008-0416 describes multiple XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8. The issue allows remote attackers to inject arbitrary web script or HTML via certain character encodings, specifically: (1) a backspace character treat...

CVE-2009-3985

CVE-2009-3985 affects Mozilla Firefox prior to 3.0.16 and 3.5.x prior to 3.5.6, and SeaMonkey prior to 2.0.1. The issue allows remote attackers to cause spoofing by setting document.location to the vulnerable URL and then writing arbitrary script/HTML to the associated blank document, enabling co...

CVE-2010-0174

CVE-2010-0174 covers multiple Mozilla packages with several browser-engine vulnerabilities that could allow memory corruption, DoS, or potentially arbitrary code execution. Affected products and versions, as documented, include Mozilla Firefox up to 3.0.18/3.0.x (pre-3.0.19), Firefox 3.5.x before...

CVE-2010-1215

CVE-2010-1215 affects Mozilla Firefox 3.6.x (pre-3.6.7) and Thunderbird 3.1.x (pre-3.1.1). The vulnerability arises when a content script accesses a content object via SJOW (SafeJSObjectWrapper); this can let attacker-controlled code in the chrome context execute arbitrary JavaScript with chrome ...

CVE-2012-3971

CVE-2012-3971 affects SIL Graphite 2 as used in Mozilla Firefox up to 15.0, Mozilla Thunderbird up to 15.0, and SeaMonkey up to 2.12. The vulnerability arises from issues in Silf::readClassMap and Pass::readPass, allowing remote attackers to execute arbitrary code or cause memory corruption (DoS)...

CVE-2015-7178

CVE-2015-7178 affects Mozilla Firefox on Windows via ANGLE’s libGLES, where the ProgramBinary::linkAttributes function mishandles shader access. This can allow a remote attacker to execute arbitrary code or cause a denial of service through crafted OpenGL/WebGL content, leading to memory corrupti...

CVE-2016-2809

CVE-2016-2809 : Affects Mozilla Firefox on Windows; the Mozilla Maintenance Service updater can be abused to delete arbitrary files via certain local file execution. Root cause is a local file-execution pathway in the maintenance updater. Impact is high for file deletion; exploitation details are...

CVE-2016-5279

CVE-2016-5279 affects Mozilla Firefox prior to 49.0 and allows a user-assisted remote attacker to obtain the full filesystem path of local files via a crafted drag-and-drop operation from a web page. Publicly linked advisories (openSUSE openSUSE-2016-1119/1128) confirm MFSA 2016-85 and list CVE-2...

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2023-37210

CVE-2023-37210 affects Mozilla Firefox prior to 115, where a website could prevent exiting full-screen mode using alert/prompt, potentially causing user confusion or spoofing. The issue is confirmed in multiple sources and is addressed by updating Firefox to 115 or newer (fix included in Firefox ...

CVE-2025-5265

CVE-2025-5265 concerns Firefox on Windows where the Copy as cURL feature improperly escapes the ampersand, enabling a crafted command to trigger local code execution. The impact is described as potentially allowing arbitrary code execution on the user’s system when the user runs the affected curl...

CVE-2026-2757

CVE-2026-2757 (FF/Thunderbird) is confirmed with root cause: incorrect boundary conditions in the WebRTC: Audio/Video component, fixed in Firefox 148, Firefox ESR 115.33/140.8 ESR, Thunderbird 148/140.8. Affected products explicitly include Firefox and Thunderbird lines in multiple advisories (AL...

CVE-2007-0800

CVE-2007-0800 is a cross-zone vulnerability in Mozilla Firefox 1.5.0.9 where blocked popups are treated as having an internal zone origin, enabling a user-assisted remote attacker to read arbitrary file:// URIs. The connected documents indicate Firefox was updated to version 1.5.0.10 to fix these...

CVE-2009-0723

CVE-2009-0723 affects LittleCMS (lcms/liblcms) before 1.18beta2. The vulnerability comprises multiple integer overflows that, when processing crafted image files, can trigger a heap-based buffer overflow. This issue is noted to be exploitable in contexts where LittleCMS is used (e.g., in Firefox ...

CVE-2010-0160

CVE-2010-0160 affects Mozilla Firefox 3.0.x prior to 3.0.18, Firefox 3.5.x prior to 3.5.8, and SeaMonkey prior to 2.0.3. The issue arises in Web Worker handling of array data types in posted messages, causing heap memory corruption and browser crash; remote attackers could potentially execute arb...

CVE-2010-3767

CVE-2010-3767 describes an integer overflow in the NewIdArray function of Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11. An attacker could cause memory corruption or arbitrary code execution by supplying a JavaScript array with a very large number of elements,...

CVE-2011-0057

CVE-2011-0057 is a use-after-free vulnerability in the Web Workers implementation of Mozilla Firefox. Affected products and versions: Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue arises from a use-after-free in interactions between a JavaScript Worker and ...

CVE-2011-2369

CVE-2011-2369 is a cross-site scripting vulnerability in SeaMonkey as described in NASL entry SeaMonkey

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...