CVE-2005-1157

CVE-2005-1157 affects Firefox < 1.0.3, Mozilla Suite

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2006-1740

CVE-2006-1740 affects Mozilla-derived browsers, allowing remote attackers to spoof secure site indicators (e.g., the lock icon) by abusing a popup window that loads the trusted site and then navigates to a malicious site. Affected products include Firefox 1.x prior to 1.5 and 1.0.x prior to 1.0.8...

CVE-2006-2784

CVE-2006-2784 affects Mozilla Firefox’s PLUGINS PAGE prior to 1.5.0.4. An attacker-supplied prompt could trick a user into installing a missing plugin and clicking Manual Install, then chain nested javascript: URLs to run privileged code. The documented impact is remote user-assisted code executi...

CVE-2006-6502

CVE-2006-6502 is a use-after-free vulnerability in the LiveConnect bridge code affecting Mozilla Firefox 2.x (before 2.0.0.1), Mozilla Firefox 1.5.x (before 1.5.0.9), SeaMonkey (before 1.0.7), and Thunderbird (before 1.5.0.9). It allows remote attackers to cause a crash (denial of service) via un...

CVE-2007-4038

Technical details for CVE-2007-4038 are not present in the provided Connected documents. The initial description mentions a mailto: argument-injection issue in Firefox/Thunderbird but lacks product/version/patch specifics. Monitor for updates.

CVE-2008-2786

MODE C: Affected Mozilla stack in 2008 (Firefox/Thunderbird/XULRunner/Iceape) with concrete issues: CVEs 2008-2785, 2008-2798, 2008-2799, 2008-2800, 2008-2801, 2008-2802, 2008-2803, 2008-2805, 2008-2807, 2008-2808, 2008-2809, 2008-2811, and 2008-2933. Root causes include missing boundary checks i...

CVE-2009-3382

CVE-2009-3382 describes a memory corruption vulnerability in Mozilla Firefox’s browser engine (nsCSSFrameConstructor.cpp) where first-letter frame handling in Firefox 3.0.x before 3.0.15 could be exploited to crash the browser or potentially execute arbitrary code via unspecified vectors. The imp...

CVE-2010-0167

CVE-2010-0167 affects Mozilla Firefox and related Mozilla products (Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; SeaMonkey before 2.0.3). The issue is a remote memory corruption vulnerability in the browser engine, tied to layout/nsBlockFrame.cpp ...

CVE-2010-3171

CVE-2010-3171 relates to the Firefox JavaScript Math.random() seed being initialized only once per document object, making it easier for remote attackers to track a user or trigger in-session phishing via spoofed pop-ups. The issue ties to an underlying fix (CVE-2008-5913) that was not fully corr...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2025-1941

CVE-2025-1941 concerns Mozilla Firefox before version 136, with an authentication-bypass in an opt-in focus setting. The initial description states bypass under certain circumstances but provides no specific root-cause or exploit details. Connected documents corroborate Firefox < 136 as affect...

CVE-2025-3031

CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...

CVE-2025-3035

Mozilla Firefox vulnerability CVE-2025-3035 affects Firefox versions earlier than 137.0. When a user opens an AI chatbot in one tab and later activates it in another, the document title from the previous tab can leak into the chat prompt. The available connected sources confirm the affected produ...

CVE-2025-8038

CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...

CVE-2005-0141

CVE-2005-0141 affects Firefox < 1.0 and Mozilla

CVE-2005-0593

CVE-2005-0593 affects Firefox before 1.0.1 and Mozilla before 1.7.6. It enables remote attackers to spoof the SSL “secure site” lock icon through scenarios where the lock display is misleading (unfinished load, non-HTTP SSL, or HTTP 204 responses). The issue is documented across multiple advisori...

CVE-2005-2267

CVE-2005-2267 affects Mozilla Firefox up to version 1.0.4 (before 1.0.5). The issue arises when a standalone application (e.g., Flash or QuickTime) opens a javascript: URL, which runs in the context of the previous page. This can lead to code execution if the standalone application subsequently l...

CVE-2006-1723

CVE-2006-1723 affects Firefox and Thunderbird prior to 1.5.0.2, and SeaMonkey prior to 1.0.1. The issue is described as an unspecified vulnerability that can cause a remote denial of service (crash) and possibly arbitrary code execution via unknown DHTML attack vectors. The initial document does ...

CVE-2006-4569

CVE-2006-4569 relates to Firefox’s popup blocker: the “blocked popups” display could be shown in the Location bar instead of the originating frame, potentially enabling remote user‑assisted XSS. The connected advisories confirm this vulnerability in Mozilla Firefox up to version 1.5.0.6 and indic...

CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...

CVE-2009-2665

CVE-2009-2665 affects Mozilla Firefox 3.5.x up to 3.5.1; the flaw arises in nsDocument::SetScriptGlobalObject when certain add-ons are enabled and a crafted Link HTTP header is processed. This allows remote attackers to execute arbitrary JavaScript with chrome privileges via a malicious page, due...

CVE-2009-3987

CVE-2009-3987 affects Mozilla Firefox (before 3.0.16 and 3.5.x before 3.5.6) and SeaMonkey (before 2.0.1); the GeckoActiveXObject function returns different exception messages based on whether a ProgID is listed in the registry, enabling remote attackers to infer installed software via multiple c...

CVE-2010-2751

Summary: CVE-2010-2751 affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7) and SeaMonkey (before 2.0.6). The issue arises in nsDocShell::OnRedirectStateChange, where a sequence of redirects plus history.back/history.forward can cause a document’s SSL security status to be spoofed to...

CVE-2012-1941

CVE-2012-1941 corresponds to a heap-based buffer overflow in Mozilla Firefox/Thunderbird/SeaMonkey components (nsHTMLReflowState::CalculateHypotheticalBox) that can be triggered when resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. Affected ...

CVE-2014-1559

Technical details for CVE-2014-1559 are not publicly available in the provided documents. Monitor for updates to confirm affected products, root cause, impact, and remediation.

CVE-2015-4522

CVE-2015-4522 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. The vulnerability stems from a buffer/overflow in nsUnicodeToUTF8::GetMaxLength, which could allow a remote attacker to cause memory corruption and a crash (DoS) via unknown vectors. Impact is memory corruption an...

CVE-2026-16390

CVE-2026-16390 describes a mitigation bypass in the Firefox Enterprise Policies component. The vulnerability is indicated as fixed in Firefox 153 and Firefox ESR 140.13. The initial entry provides a CVSS 3.1 base score of 9.1 (CRITICAL) with network attack vector, low attack complexity, and no us...

CVE-2005-1531

CVE-2005-1531 affects Mozilla Firefox <= 1.0.3 and Mozilla Suite

CVE-2006-2777

CVE-2006-2777 is a remote-code-execution issue in Mozilla Firefox up to 1.5.0.3/1.5.x and SeaMonkey up to 1.0.1/1.0.x via nsISelectionPrivate: a SelectionListener/notifications flow executes in a privileged context. Affected products: Firefox before 1.5.0.4 and SeaMonkey before 1.0.2. Root cause:...

CVE-2006-3812

CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...

CVE-2008-0413

CVE-2008-0413 affects the JavaScript engine in Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey

CVE-2008-5013

CVE-2008-5013 affects Mozilla Firefox 2.x (pre-2.0.0.18) and SeaMonkey 1.x (pre-1.1.13). The issue arises when the Flash module is dynamically unloaded via an outside JavaScript function, leading to an access of an expired memory address and allowing remote code execution with a crafted SWF file....

CVE-2009-3982

The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...

CVE-2010-0183

CVE-2010-0183 is a use-after-free in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5. The issue is in nsCycleCollector::MarkRoots and is triggered by crafting an HTML document via improper frame construction for menus, allowing remote code execution. Affected products include Firef...

CVE-2012-3974

CVE-2012-3974 is an Untrusted search path vulnerability in the installer for Mozilla Firefox (pre-15.0) and Thunderbird (pre-15.0; ESR 10.x) on Windows. Root cause: Trojan horse executable in a root directory enables local privilege escalation. Affected: Firefox before 15.0, Firefox ESR before 10...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2013-1726

CVE-2013-1726 affects Mozilla Updater in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is failure to ensure exclusive access to a MAR file, allowing a local attacker to gain privileges by plac...

CVE-2015-7217

CVE-2015-7217 affects Mozilla Firefox before 43.0 on Linux GNOME. The gdk-pixbuf configuration incorrectly enables the TGA decoder , allowing a remote attacker to trigger a heap-based buffer overflow via a crafted Truevision TGA image, resulting in a denial of service. The description and related...

CVE-2016-1945

CVE-2016-1945 affects Mozilla Firefox (nsZipArchive). The vulnerability arises from incorrect pointer handling during ZIP archive processing, enabling a remote attacker to trigger a denial of service (and potentially other impacts as per reports). Firefox versions before 44.0 are affected; remedi...

CVE-2016-1953

CVE-2016-1953 affects Mozilla Firefox before 45.0, tied to memory safety issues in the browser engine (notably js/src/jit/arm.cpp) that can cause memory corruption leading to remote code execution or denial of service. Public advisories (e.g., openSUSE/SUSE MFSA entries) relate this CVE to multip...

CVE-2025-4089

CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...

CVE-2026-6752

CVE-2026-6752 is a WebRTC boundary-conditions vulnerability in Mozilla Firefox/Thunderbird. The issue is caused by incorrect boundary conditions in the WebRTC component, leading to potential impact as described in the advisory. The connected sources confirm fixed versions: Firefox 150, Firefox ES...

CVE-2005-0143

CVE-2005-0143 affects Firefox before 1.0 and Mozilla before 1.7.5. The issue is that the SSL lock icon can be displayed when an insecure page loads a binary file from a trusted site, which could aid phishing. Connected advisories confirm Mozilla security updates were issued (e.g., RHSA-2005:335; ...

CVE-2005-0585

CVE-2005-0585 affects Firefox <1.0.1 and Mozilla

CVE-2005-0591

CVE-2005-0591 affects Firefox prior to 1.0.1, allowing remote spoofing of the security and download modal dialogs (Firespoofing). Red Hat advisory RHSA-2005:176 and CentOS notes indicate that Firefox was updated and recommend upgrading to Mozilla 1.7.7 to remediate the issue.

CVE-2005-1160

CVE-2005-1160 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. The vulnerability arises in the privileged chrome UI where an attacker could override certain properties or methods of DOM nodes, enabling privilege escalation. Attacks demonstrated via the eval function or the Script obje...

CVE-2007-0778

CVE-2007-0778 affects Mozilla Firefox (and related Gecko-based browsers like SeaMonkey) prior to 1.5.0.10 / 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The vulnerability stems from the page cache implementation, where hash collisions can cause page data to be appended to the wrong cache entry...

CVE-2007-2868

This CVE-2007-2868 entry concerns memory corruption in the JavaScript engine of Mozilla-derived products. Affected software includes Mozilla Firefox 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, Thunderbird 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. Exploitation coul...

CVE-2008-2801

CVE-2008-2801 affects Mozilla Firefox (pre-2.0.0.15) and SeaMonkey (pre-1.1.10) due to a flaw in JAR signing implementation that allows remote attackers to run arbitrary code via JavaScript in a JAR or via a JAR archive using relative URLs to JavaScript files. The underlying issue is improper han...