CVE-2009-0353

CVE-2009-0353 affects Mozilla components: Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. The vulnerability is related to the JavaScript engine and can allow a remote attacker to cause memory corruption and an application crash, potentially leading to arbitrary...

CVE-2009-1304

CVE-2009-1304 affects the JavaScript engine in Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability arises from the engine’s handling of (1) js_FindPropertyHelper (related to Math and Date) and (2) js_CheckRedeclaration, enabling remo...

CVE-2009-1834

CVE-2009-1834 describes a visual truncation vulnerability in Mozilla Firefox (nsIDNService.cpp) affecting Firefox < 3.0.11 and SeaMonkey

CVE-2009-1835

CVE-2009-1835 affects Mozilla Firefox (pre-3.0.11) and SeaMonkey (pre-1.1.17). A URL containing file:// at the start can cause the browser to associate local documents with external domain names located after the file:// substring, allowing a user-assisted remote attacker to read arbitrary cookie...

CVE-2009-3070

CVE-2009-3070 refers to multiple unspecified vulnerabilities in the Mozilla Firefox browser engine up to version 3.0.14. The Mozilla Firefox entry states that remote attackers could cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code via unkno...

CVE-2011-0062

This CVE (CVE-2011-0062) affects Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8, per the Initial Description. It arises from multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crash (DoS) or potentially allow arbitra...

CVE-2012-1948

CVE-2012-1948 is a member of a set of vulnerabilities in the Mozilla browser engine affecting Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The issue enables remote attackers to cause a denial of serv...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2013-1707

CVE-2013-1707 is a stack-based buffer overflow in Mozilla Updater used by Mozilla Maintenance Service, enabling local privilege escalation via a long pathname on the command line. Affected products/versions include Mozilla Firefox up to version 23.0 (and ESR), Thunderbird up to 17.0.8, with corre...

CVE-2013-5601

CVE-2013-5601 is a use-after-free in Mozilla Firefox’s nsEventListenerManager::SetEventHandler that could allow remote code execution. Affected products and versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1 and ESR 17.x before 17.0...

CVE-2014-1543

CVE-2014-1543 affects Mozilla Firefox before 30.0, where multiple heap-based buffer overflows occur in navigator.getGamepads (Gamepad API) when using non-contiguous axes on physical or virtual gamepad devices. This can enable remote code execution. The available description indicates the issue li...

CVE-2015-0806

CVE-2015-0806 affects Mozilla Firefox prior to 37.0, where the OMTC path may call memset on a negative-length memory region during interaction with mozilla::layers::BufferTextureClient::AllocateForSurface. This can enable a remote attacker to execute arbitrary code or cause a memory corruption-ba...

CVE-2015-4474

CVE-2015-4474 concerns Mozilla Firefox browser engine. The initial entry indicates multiple unspecified memory safety vulnerabilities in Firefox before 40.0, which could allow a remote attacker to cause a memory corruption crash or possibly execute arbitrary code via unknown vectors. The connecte...

CVE-2015-7176

Mozilla Firefox CVE-2015-7176 affects Firefox before 41.0 (ESR 38.x before 38.3). Root cause: AnimationThread uses an incorrect argument to sscanf, enabling a remote attacker to trigger a stack-based buffer overflow and crash, with possible other impact via unknown vectors. Public details describ...

CVE-2018-18510

The CVE-2018-18510 entry affects Mozilla Firefox prior to version 64. The issue arises when web content can trigger the internal about:crashcontent and about:crashparent pages, enabling a non-persistent denial-of-service (DoS) against the loaded page or the browser. Affected component: Firefox re...

CVE-2019-11702

Summary of the vulnerability (CVE-2019-11702) : Mozilla Firefox versions prior to 67.0.2 on Windows are affected. A hyperlink using protocols associated with Internet Explorer (e.g., IE.HTTP:) can be used to open local files at a known location in Firefox if the user approves execution when promp...

CVE-2025-8029

CVE-2025-8029: Thunderbird and Firefox products are affected by a vulnerability where javascript: URLs are executed when used inside object and embed tags. The impact list states affected versions include Firefox < 141 and Thunderbird < 141 (and ESR branches

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2026-6754

CVE-2026-6754 is a memory-safety issue (Use-after-free) in the JavaScript Engine component that was fixed in Firefox 150 and related ESR branches, as well as Thunderbird 150/140.x lines. Public advisories confirm the flaw in the JavaScript engine leads to a potentially exploitable memory corrupti...

CVE-2005-2704

CVE-2005-2704 affects Firefox up to 1.0.6 and Mozilla Suite up to 1.7.11/12, where an XBL control implementing an internal XPCOM interface can enable remote spoofing of DOM objects. The vulnerability enables a attacker-controlled DOM objects to impersonate or misrepresent elements, aiding phishin...

CVE-2006-1993

CVE-2006-1993 – Firefox focus() designMode vulnerability : A flaw in the JavaScript focus implementation allowed a remotely triggered crash and, in theory, arbitrary code execution by referencing a deleted controller context object when contentWindow.focus is used inside an iframe with designMode...

CVE-2006-2775

The CVE-2006-2775 issue affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. It arises from XUL attribute handling that can be associated with an incorrect URL under certain conditions, potentially letting a persisted string be linked to the wrong URL and thereby bypass restrictions. The fla...

CVE-2006-3113

CVE-2006-3113 affects Mozilla Firefox

CVE-2007-2292

CVE-2007-2292 is a CRLF injection vulnerability in the Digest Authentication support of Mozilla Firefox (<2.0.0.8) and SeaMonkey (

CVE-2007-5947

The CVE-2007-5947 issue affects Mozilla Firefox up to 2.0.0.10 and SeaMonkey up to 1.1.7, where the jar protocol handler retrieves the inner URL regardless of MIME type and treats HTML documents inside a jar as same-origin with the inner URL. This enables cross-site scripting (XSS) via jar: URIs....

CVE-2008-1236

CVE-2008-1236 affects Mozilla Firefox (before 2.0.0.13), Mozilla Thunderbird (before 2.0.0.13), and SeaMonkey (before 1.1.9). The issue stems from memory-related vulnerabilities in the layout/web content processing, described as memory corruption via layout-engine interactions, allowing a remote ...

CVE-2008-2810

CVE-2008-2810 affects Mozilla Firefox prior to 2.0.0.15 and SeaMonkey prior to 1.1.10. Root cause: improper identification of the context of Windows shortcut files, enabling a user-assisted remote attacker to bypass the Same Origin Policy via a crafted site for which the user has saved a shortcut...

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2009-2472

Affected software: Mozilla Firefox before 3.0.12 (as per CVE-2009-2472). Issue: during object construction, Firefox did not always use XPCCrossOriginWrapper, allowing bypass of the Same Origin Policy and enabling cross-site scripting (XSS) via a crafted document. Impact: potential XSS vulnerabili...

CVE-2011-2983

CVE-2011-2983 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x. Root cause: improper handling of RegExp.input, which can bypass the Same Origin Policy and allow reading data from a different domain via a crafted page (potential use-after-free). E...

CVE-2012-1939

CVE-2012-1939 affects Mozilla Firefox ESR 10.x before 10.0.5 and Thunderbird ESR 10.x before 10.0.5. The issue stems from jsinfer.cpp not properly determining data types, allowing crafted JavaScript to cause memory corruption and a crash, with possible remote code execution. The related MiracleLi...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2013-1719

CVE-2013-1719 affects Mozilla Firefox (<24.0), Thunderbird (<24.0), and SeaMonkey (

CVE-2013-5600

CVE-2013-5600 is a use-after-free in Mozilla projects where the nsIOService::NewChannelFromURIWithProxyFlags function can be exploited via blob: URLs to execute arbitrary code. Affected packages/versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbir...

CVE-2013-5610

CVE-2013-5610 is a memory-corruption vulnerability in the Mozilla Firefox browser engine (pre-26.0) and SeaMonkey (pre-2.23) with potential remote code execution via unknown vectors and denial of service. Public advisories (e.g., openSUSE/MFSA entries) indicate fixes are available by upgrading Fi...

CVE-2015-4496

CVE-2015-4496 corresponds to a set of integer overflows in libstagefright that affect Mozilla Firefox’s handling of MPEG-4 MP4 metadata. The vulnerability arises when parsing crafted sample metadata in MP4 video files, enabling remote code execution. Affected product/component: libstagefright in ...

CVE-2019-25136

CVE-2019-25136 describes a vulnerability in Mozilla Firefox where a compromised child process could inject XBL Bindings into privileged CSS rules, allowing arbitrary code execution and a sandbox escape. Affected software is Firefox versions before 70; the root cause is manipulation of XBL binding...

CVE-2025-1940

The CVE-2025-1940 issue concerns Mozilla Firefox for Android, where a select option could partially obscure the confirmation prompt shown before launching external apps. Root cause: UI/UX could mislead users into unknowingly launching an external app. Affected: Firefox on Android, versions earlie...

CVE-2025-8028

CVE-2025-8028 describes a vulnerability in Firefox and Thunderbird affecting arm64 WASM, where a br_table with many entries can cause the branch label to be miscomputed due to truncation. Affected are Firefox and Firefox ESR versions prior to 141/115.26/128.13/140.1 and Thunderbird versions prior...

CVE-2025-8031

CVE-2025-8031 concerns a vulnerability where the username:password portion is not correctly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. The CVE’s context across connected documents shows affected software including Firefox and Thunderbird variants...

CVE-2025-8039

The CVE-2025-8039 entry concerns a vulnerability where search terms persist in the URL bar after navigating away from a search page. Affected software and versions are Mozilla Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2026-8388

CVE-2026-8388 corresponds to a vulnerability in the JavaScript Engine: JIT component with incorrect boundary conditions. Publicly documented fixes indicate Firefox fixed this in Firefox 150.0.3 and in Firefox ESR releases 115.36, 140.11, and Thunderbird 140.11. Connected advisories confirm Firefo...

CVE-2004-0765

The CVE-2004-0765 entry affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, where cert_TestHostName only validates the hostname portion of a certificate when the URI hostname is not an FQDN. This allows remote attackers to spoof trusted certificates. Root cause: certificat...

CVE-2004-2227

CVE-2004-2227 affects Mozilla Firefox prior to 1.0. The issue is in the file download dialog where long filenames are truncated, which can mislead users into downloading files with dangerous extensions. The documented remediation is to upgrade to Mozilla Firefox 1.0 or newer (and related Firefox/...

CVE-2005-0989

CVE-2005-0989 concerns the Mozilla family JavaScript engine. Affected products include Mozilla Suite 1.7.6, Firefox 1.0.1/1.0.2, and Netscape 7.2. The vulnerability arises in the find_replen function in jsstr.c, enabling a remote attacker to read portions of heap memory through the string replace...

CVE-2005-2263

CVE-2005-2263 affects Firefox (before 1.0.5) and Mozilla (before 1.7.9). The issue arises in InstallTrigger.install: forcing a page navigation after the install method is called causes a callback to be executed in the context of the new page, resulting in a same-origin violation. This means a rem...

CVE-2005-2265

CVE-2005-2265 affects Firefox <1.0.5, Mozilla

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...