CVE-2011-2984

CVE-2011-2984 affects Mozilla Firefox prior to 3.6.20, SeaMonkey 2.x, and Thunderbird 3.x prior to 3.1.12. The issue is a tab-dropping handling bug that lets a remote attacker load a content area, register for drop events, and execute arbitrary JavaScript with chrome privileges. Public summaries ...

CVE-2011-2988

CVE-2011-2988 describes a buffer overrun in an unspecified string class used by the WebGL shader implementation in Mozilla Firefox (4.x–5), SeaMonkey (2.x before 2.3), and Thunderbird before 6. The vulnerability can be triggered by a long shader source block, potentially allowing remote code exec...

CVE-2013-1681

CVE-2013-1681 is a Use-after-Free vulnerability in Mozilla Firefox affecting nsContentUtils::RemoveScriptBlocker. It impacts Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6, enabling remote code execution or a Denial of Servic...

CVE-2014-6492

CVE-2014-6492 is an unspecified vulnerability in Oracle Java SE 6u81, 7u67, and 8u20 tied to the Deployment component, enabling remote confidentiality, integrity, and availability impact. The IBM and SUSE/NASL documents show this CVE alongside related Deployment and wireless components (e.g., CVE...

CVE-2017-7757

CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...

CVE-2018-5124

CVE-2018-5124 affects Mozilla Firefox prior to 58.0.1. The issue arises from unsanitized output in the browser UI, where HTML fragments are left intact, enabling arbitrary code execution as described by the MFSA advisory and related references. The vulnerability is tied to sanitization of HTML fr...

CVE-2026-12295

CVE-2026-12295 describes a sandbox escape in the DOM: Navigation component affecting Mozilla Firefox and Thunderbird. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The entry lists a CVSS v3.1 base score of 9.6 (CRITICAL...

CVE-2005-0527

CVE-2005-0527 affects Firefox 1.0 (Mozilla/Firefox family) where plugins can load privileged content into frames, enabling remote code execution as demonstrated by Firescrolling when a user drags a scrollbar twice. Connected advisories show this as part of broader Mozilla/XPCOM plugin access issu...

CVE-2006-2786

CVE-2006-2786 is an HTTP response smuggling vulnerability affecting Mozilla Firefox and Thunderbird prior to 1.5.0.4. According to connected advisories, an attacker could craft responses that a proxy or header formatting could fool the client into treating as responses from two different sites, p...

CVE-2006-3802

CVE-2006-3802 affects Mozilla Firefox before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3. The issue is that remote attackers can hijack native DOM methods from objects in another domain to conduct cross-site scripting (XSS) attacks using DOM methods of the top-level object. Th...

CVE-2007-4841

CVE-2007-4841 affects Mozilla Firefox (before 2.0.0.8), Mozilla Thunderbird (before 2.0.0.8), and SeaMonkey (before 1.1.5). The vulnerability permits remote command execution via (1) mailto, (2) nntp, (3) news, or (4) snews URIs that use invalid percent encoding, tied to improper file-type handli...

CVE-2007-5340

CVE-2007-5340 is part of multiple vulnerabilities in the Javascript engine of Mozilla Firefox (<2.0.0.8), Thunderbird (<2.0.0.8), and SeaMonkey (

CVE-2009-2462

CVE-2009-2462 affects Mozilla Firefox before 3.0.12 (and Thunderbird) with memory corruption/DoS or potentially arbitrary code execution via multiple rendering/DOM and CSS-related vectors. The connected MiracleLinux advisories reference Firefox 3.0.12 as the fixed version for AXSA:2009-364/365, i...

CVE-2010-3766

CVE-2010-3766 is a use-after-free vulnerability in Mozilla Firefox prior to 3.5.16 and in 3.6.x prior to 3.6.13, and SeaMonkey prior to 2.0.11. The flaw involves modification of an nsDOMAttribute node, which can cause an inconsistent DOM state and enable remote code execution. The affected produc...

CVE-2011-0066

CVE-2011-0066 is a use-after-free vulnerability affecting Mozilla Firefox prior to 3.5.19 and 3.6.x prior to 3.6.17, and SeaMonkey prior to 2.0.14. The issue allows remote attackers to execute arbitrary code via vectors related to OBJECT’s mObserverList (memory corruption risk). The MiracleLinux ...

CVE-2016-2806

CVE-2016-2806 affects Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1. The issue is described as memory safety vulnerabilities in the browser engine that could lead to memory corruption, a denial of service, or possibly arbitrary code execution via unknown vectors. The connected sour...

CVE-2017-7833

CVE-2017-7833 affects Mozilla Firefox versions earlier than 57.0. It enables domain spoofing by combining Arabic/Indic vowel markers with Latin characters in a domain name, causing the non-Latin character to be visually eclipsed and not displayed in punycode. Root cause: font/display rendering ma...

CVE-2025-4092

The CVE-2025-4092 entry concerns memory safety bugs in Mozilla Firefox 137/Thunderbird 137 that reportedly could be exploited to execute arbitrary code. Affected products are Firefox and Thunderbird versions before 138. Root cause is memory safety/memory corruption in the browser components; Mozi...

CVE-2025-6426

The CVE-2025-6426 issue affects Firefox for macOS where opening files with the terminal extension did not warn the user. Connected advisories confirm affected products and versions: Firefox before 140 and Firefox ESR before 128.12, Thunderbird before 140 and Thunderbird before 128.12. The root ca...

CVE-2005-2702

CVE-2005-2702 affects Mozilla/Firefox: vulnerable when processing Unicode sequences, specifically zero-width non-joiner characters. Firefox prior to 1.0.7 and Mozilla Suite prior to 1.7.12 are at risk. Reported impact: remote attacker could cause a crash and, in some scenarios, may execute arbitr...

CVE-2006-5748

CVE-2006-5748 involves memory-corruption flaws in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6, potentially causing a crash or arbitrary code execution via unspecified vectors. The connected advisories confirm these products and versions are affected and ...

CVE-2006-6503

CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...

CVE-2008-0419

CVE-2008-0419 affects Mozilla Firefox (pre-2.0.0.12) and SeaMonkey (pre-1.1.8). It allows remote attackers to steal navigation history and to cause a denial of service (crash) by exploiting images in a page that uses designMode frames, triggering memory corruption related to resize handles. The p...

CVE-2008-5510

CVE-2008-5510 concerns the CSS parser in Mozilla Firefox (3.x up to 3.0.5 and 2.x up to 2.0.0.19), Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14, where the escaped null character (\0) is ignored, potentially allowing remote attackers to bypass sanitization protections. The descri...

CVE-2008-5513

CVE-2008-5513 affects Mozilla Firefox. The issue arises in the session-restore feature, where restoration of SessionStore data can bypass the Same Origin Policy, enabling content injection and cross-site scripting (XSS) via unknown vectors. Affected products/versions include Firefox 3.x prior to ...

CVE-2009-1837

CVE-2009-1837 describes a race condition in Mozilla Firefox 3 before 3.0.11 within NPObjWrapper_NewResolve in nsJSNPRuntime.cpp of xul.dll. The vulnerability could allow remote code execution via a page transition during Java applet loading, related to a use-after-free involving memory tied to a ...

CVE-2010-3777

CVE-2010-3777 is an unspecified vulnerability in Mozilla Firefox 3.6.x before 3.6.13 and Thunderbird 3.1.x before 3.1.7 that allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Connected advisories ...

CVE-2011-0056

CVE-2011-0056: Buffer overflow in the JavaScript engine of Mozilla Firefox (before 3.5.17) and Firefox 3.6.x (before 3.6.14), and SeaMonkey before 2.0.12. The issue arises from an atom map handling of a large number of string values and exception timing, potentially allowing remote code execution...

CVE-2011-2999

The CVE-2011-2999 issue affects Mozilla Firefox (pre-3.6.23 and 4.x–5), Thunderbird (pre-6.0), and SeaMonkey (pre-2.3) where a frame named location could shadow window.location, bypassing Same Origin Policy via a crafted site. This is a remote vulnerability with no explicit exploitation details i...

CVE-2012-3962

CVE-2012-3962 affects Mozilla Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. The issue is a failure to properly iterate through characters in a text run, enabling remote code execution via a crafted document. The ...

CVE-2012-5840

CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...

CVE-2017-7790

CVE-2017-7790 affects the Windows build of Mozilla Firefox prior to 55. The issue arises when non-null-terminated strings are copied into the crash reporter for certain registry keys, causing stack memory to be copied up to a null terminator. This could potentially expose private data from the lo...

CVE-2017-7817

CVE-2017-7817 is a spoofing vulnerability in Firefox for Android where switching to fullscreen mode without user notice can display a fake address bar, enabling page spoofing. The vulnerability is tied to Firefox <56;impact is spoofing the active page, not a remote compromise. Vendor advisory ...

CVE-2025-8030

CVE-2025-8030 is publicly known and tied to an insufficent escaping in the “Copy as cURL” feature that could lead to code execution. The connected Astra Linux and Amazon/Linux advisories confirm the issue affects Firefox and Thunderbird across multiple tracks (e.g., Firefox < 141, Firefox ESR ...

CVE-2026-16349

CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2026-8091

CVE-2026-8091 affects Mozilla Audio/Video: Playback with an incorrect boundary condition in the component. It is fixed by updating to Firefox 150, Thunderbird 150, and Firefox ESR 140.10.1 (and 140.10.2 per ESR updates) as well as Firefox ESR 115.35.2. Connected disclosures corroborate this is a ...

CVE-2006-1727

CVE-2006-1727 affects Mozilla-derived browsers: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The issue allows remote attackers to gain chrome privileges through multiple attack vectors related to the use of XBL...

CVE-2006-1731

CVE-2006-1731 affects Mozilla Firefox/Thunderbird 1.x and related Mozilla suites; the flaw lets a remote attacker trigger XSS by valueOf.call/valueOf.apply with no args, returning the Object prototype instead of the global window. Impact is cross-site scripting; vendors released fixes in Firefox/...

CVE-2006-2776

CVE-2006-2776 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. Privileged UI code calls content-defined setters on an object prototype, enabling remote code execution at higher privileges. Impact is remote code execution with web content privileges; mitigation is upgrading Firefox/Thunde...

CVE-2006-4253

CVE-2006-4253 is a concurrency vulnerability in Mozilla Firefox prior to updates that fixed a path allowing remote attackers to crash the browser or possibly execute arbitrary code via multiple JavaScript timed events loading a nested XML file, then redirecting to another page. Affected products ...

CVE-2006-5747

CVE-2006-5747 affects Mozilla Firefox <=1.5.0.7/8, Thunderbird <=1.5.0.7/8, and SeaMonkey

CVE-2008-2811

The CVE-2008-2811 issue affects Mozilla components (Firefox <2.0.0.15, Thunderbird ≤2.0.0.14, SeaMonkey

CVE-2008-5500

CVE-2008-5500 affects Mozilla Firefox 3.x before 3.0.5 and Firefox 2.x before 2.0.0.19, Mozilla Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14. The vulnerability arises from the layout engine when processing malformed content, allowing a remote attacker to cause a denial of serv...

CVE-2008-5508

CVE-2008-5508 affects Mozilla Firefox (3.x prior to 3.0.5 and 2.x prior to 2.0.0.19), Mozilla Thunderbird (2.x prior to 2.0.0.19), and SeaMonkey (1.x prior to 1.1.14). The issue stems from improper parsing of URLs that start with leading whitespace or control characters, which can allow a remote ...

CVE-2009-3981

CVE-2009-3981 affects Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird. The issue is an unspecified remote vulnerability in the browser engine that can cause memory corruption, leading to a crash or potentially arbitrary code execution via unknown vectors, and can result in ...

CVE-2010-3769

CVE-2010-3769 affects Mozilla Firefox (pre-3.5.16 and pre-3.6.13 on Windows), Thunderbird (pre-3.0.11 and pre-3.1.7), and SeaMonkey (pre-2.0.11) due to a flaw in line-breaking when handling very long strings. The root cause is a buffer over-read triggered by a crafted document.write call, enablin...

CVE-2011-0055

CVE-2011-0055 is a use-after-free in JSON.stringify in js3250.dll affecting Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12. The issue is related to the js_HasOwnProperty handling and garbage collection; exploitation details are not specified in the provided doc...

CVE-2011-2378

CVE-2011-2378 affects Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, SeaMonkey 2.x (and possibly other products). The root cause is improper handling of DOM objects in appendChild, allowing remote attackers to execute arbitrary code via vectors leading to a dangling pointer. Impact...

CVE-2011-2605

CVE-2011-2605 is a CRLF-injection issue in Firefox/Thunderbird: nsCookieService::SetCookieStringInternal mishandles a newline in document.cookie, bypassing access restrictions. Affected: Mozilla Firefox before 3.6.18 and 4.x through 4.0.1; Thunderbird before 3.1.11. Outcome: potential cookie isol...