CVE-2009-2465

CVE-2009-2465 affects Mozilla Firefox before 3.0.12 and Thunderbird. The vulnerability allows remote memory corruption and potential code execution via double frame construction, tied to nsHTMLContentSink.cpp, nsXMLContentSink.cpp, nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function. Mir...

CVE-2009-2471

CVE-2009-2471 affects Mozilla Firefox before 3.0.12. The flaw in the setTimeout handling fails to preserve object wrapping, enabling remote attackers to run arbitrary JavaScript with chrome privileges via a crafted call (XPCNativeWrapper related). Affected product often cited with Firefox before ...

CVE-2009-3382

CVE-2009-3382 describes a memory corruption vulnerability in Mozilla Firefox’s browser engine (nsCSSFrameConstructor.cpp) where first-letter frame handling in Firefox 3.0.x before 3.0.15 could be exploited to crash the browser or potentially execute arbitrary code via unspecified vectors. The imp...

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2013-1672

CVE-2013-1672 affects Mozilla Firefox on Windows (and related Thunderbird/ESR components) where the Mozilla Maintenance Service can be exploited to bypass integrity verification and escalate privileges. The issue is tied to local privilege escalation via manipulation of data passed to the mainten...

CVE-2014-1478

This CVE (CVE-2014-1478) affects Mozilla Firefox before 27.0 and SeaMonkey before 2.24. The issue involves memory corruption in the browser engine (MPostWriteBarrier in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey) and may allow remote code execution or cause a crash...

CVE-2014-1534

Technical details about CVE-2014-1534 are not publicly available in the provided connected documents. Monitor for updates; no specifics on affected products/versions, exploit vectors, or fixes are included here.

CVE-2014-1551

CVE-2014-1551 is a concrete use-after-free vulnerability in Mozilla Firefox’s FontTableRec destructor that can be triggered by crafted fonts in MathML content. Root cause: improper handling of a DirectWrite font-face object, allowing remote attackers to execute arbitrary code. Affected products/v...

CVE-2015-4522

CVE-2015-4522 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. The vulnerability stems from a buffer/overflow in nsUnicodeToUTF8::GetMaxLength, which could allow a remote attacker to cause memory corruption and a crash (DoS) via unknown vectors. Impact is memory corruption an...

CVE-2017-5409

The CVE-2017-5409 issue affects Mozilla Firefox on Windows (Firefox ESR <45.8 and Firefox

CVE-2021-43531

CVE-2021-43531 affects Firefox prior to version 94. The issue arises when a Web Extension loads a context menu and could access the post-redirect URL of the clicked element if it lacked WebRequest permissions for the involved hosts, causing a same-origin-violation that leaks data the extension wo...

CVE-2025-3031

CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...

CVE-2025-8038

CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...

CVE-2026-16383

CVE-2026-16383 is a mitigation bypass in the DOM: Networking component. It affects Firefox (including ESR) and Thunderbird where the issue was addressed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The root cause is described as a DOM mitigation bypass within the N...

CVE-2026-6760

Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...

CVE-2026-6784

CVE-2026-6784 covers memory safety bugs in Mozilla Firefox 149 and Thunderbird 149 that could lead to memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is evidenced across multiple feeds and is mitigated by upgrading to Firefox 150 and Thunderb...

CVE-2005-0141

CVE-2005-0141 affects Firefox < 1.0 and Mozilla

CVE-2005-0593

CVE-2005-0593 affects Firefox before 1.0.1 and Mozilla before 1.7.6. It enables remote attackers to spoof the SSL “secure site” lock icon through scenarios where the lock display is misleading (unfinished load, non-HTTP SSL, or HTTP 204 responses). The issue is documented across multiple advisori...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2006-4569

CVE-2006-4569 relates to Firefox’s popup blocker: the “blocked popups” display could be shown in the Location bar instead of the originating frame, potentially enabling remote user‑assisted XSS. The connected advisories confirm this vulnerability in Mozilla Firefox up to version 1.5.0.6 and indic...

CVE-2006-6502

CVE-2006-6502 is a use-after-free vulnerability in the LiveConnect bridge code affecting Mozilla Firefox 2.x (before 2.0.0.1), Mozilla Firefox 1.5.x (before 1.5.0.9), SeaMonkey (before 1.0.7), and Thunderbird (before 1.5.0.9). It allows remote attackers to cause a crash (denial of service) via un...

CVE-2008-2786

MODE C: Affected Mozilla stack in 2008 (Firefox/Thunderbird/XULRunner/Iceape) with concrete issues: CVEs 2008-2785, 2008-2798, 2008-2799, 2008-2800, 2008-2801, 2008-2802, 2008-2803, 2008-2805, 2008-2807, 2008-2808, 2008-2809, 2008-2811, and 2008-2933. Root causes include missing boundary checks i...

CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...

CVE-2010-0167

CVE-2010-0167 affects Mozilla Firefox and related Mozilla products (Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; SeaMonkey before 2.0.3). The issue is a remote memory corruption vulnerability in the browser engine, tied to layout/nsBlockFrame.cpp ...

CVE-2012-1941

CVE-2012-1941 corresponds to a heap-based buffer overflow in Mozilla Firefox/Thunderbird/SeaMonkey components (nsHTMLReflowState::CalculateHypotheticalBox) that can be triggered when resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. Affected ...

CVE-2014-1559

Technical details for CVE-2014-1559 are not publicly available in the provided documents. Monitor for updates to confirm affected products, root cause, impact, and remediation.

CVE-2015-7217

CVE-2015-7217 affects Mozilla Firefox before 43.0 on Linux GNOME. The gdk-pixbuf configuration incorrectly enables the TGA decoder , allowing a remote attacker to trigger a heap-based buffer overflow via a crafted Truevision TGA image, resulting in a denial of service. The description and related...

CVE-2025-1941

CVE-2025-1941 concerns Mozilla Firefox before version 136, with an authentication-bypass in an opt-in focus setting. The initial description states bypass under certain circumstances but provides no specific root-cause or exploit details. Connected documents corroborate Firefox < 136 as affect...

CVE-2026-16390

CVE-2026-16390 describes a mitigation bypass in the Firefox Enterprise Policies component. The vulnerability is indicated as fixed in Firefox 153 and Firefox ESR 140.13. The initial entry provides a CVSS 3.1 base score of 9.1 (CRITICAL) with network attack vector, low attack complexity, and no us...

CVE-2026-6752

CVE-2026-6752 is a WebRTC boundary-conditions vulnerability in Mozilla Firefox/Thunderbird. The issue is caused by incorrect boundary conditions in the WebRTC component, leading to potential impact as described in the advisory. The connected sources confirm fixed versions: Firefox 150, Firefox ES...

CVE-2005-0591

CVE-2005-0591 affects Firefox prior to 1.0.1, allowing remote spoofing of the security and download modal dialogs (Firespoofing). Red Hat advisory RHSA-2005:176 and CentOS notes indicate that Firefox was updated and recommend upgrading to Mozilla 1.7.7 to remediate the issue.

CVE-2005-1160

CVE-2005-1160 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. The vulnerability arises in the privileged chrome UI where an attacker could override certain properties or methods of DOM nodes, enabling privilege escalation. Attacks demonstrated via the eval function or the Script obje...

CVE-2005-1531

CVE-2005-1531 affects Mozilla Firefox <= 1.0.3 and Mozilla Suite

CVE-2006-1529

CVE-2006-1529 affects Firefox and Thunderbird up to versions prior to 1.5.0.2 and SeaMonkey up to 1.0.1, with exploitation possible via DHTML. The entry notes no public details as of 2006-04-13, and exact attack vectors, root cause, and fix status are not fully disclosed in the provided documents...

CVE-2006-2777

CVE-2006-2777 is a remote-code-execution issue in Mozilla Firefox up to 1.5.0.3/1.5.x and SeaMonkey up to 1.0.1/1.0.x via nsISelectionPrivate: a SelectionListener/notifications flow executes in a privileged context. Affected products: Firefox before 1.5.0.4 and SeaMonkey before 1.0.2. Root cause:...

CVE-2006-3812

CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...

CVE-2008-3198

CVE-2008-3198 affects Mozilla Firefox 3.x prior to 3.0.1, enabling remote script injection into a chrome document (e.g., via a XUL error page). The vulnerability is potentiated by CVE-2008-2933, and some advisories indicate upgrading Firefox to 3.0.1 to address the issue. Connected sources (e.g.,...

CVE-2009-2665

CVE-2009-2665 affects Mozilla Firefox 3.5.x up to 3.5.1; the flaw arises in nsDocument::SetScriptGlobalObject when certain add-ons are enabled and a crafted Link HTTP header is processed. This allows remote attackers to execute arbitrary JavaScript with chrome privileges via a malicious page, due...

CVE-2009-3987

CVE-2009-3987 affects Mozilla Firefox (before 3.0.16 and 3.5.x before 3.5.6) and SeaMonkey (before 2.0.1); the GeckoActiveXObject function returns different exception messages based on whether a ProgID is listed in the registry, enabling remote attackers to infer installed software via multiple c...

CVE-2010-2751

Summary: CVE-2010-2751 affects Mozilla Firefox (3.5.x before 3.5.11; 3.6.x before 3.6.7) and SeaMonkey (before 2.0.6). The issue arises in nsDocShell::OnRedirectStateChange, where a sequence of redirects plus history.back/history.forward can cause a document’s SSL security status to be spoofed to...

CVE-2012-3974

CVE-2012-3974 is an Untrusted search path vulnerability in the installer for Mozilla Firefox (pre-15.0) and Thunderbird (pre-15.0; ESR 10.x) on Windows. Root cause: Trojan horse executable in a root directory enables local privilege escalation. Affected: Firefox before 15.0, Firefox ESR before 10...

CVE-2013-1726

CVE-2013-1726 affects Mozilla Updater in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is failure to ensure exclusive access to a MAR file, allowing a local attacker to gain privileges by plac...

CVE-2015-7220

CVE-2015-7220 refers to a buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0. According to connected advisories, this vulnerability affects Firefox up to version 42.x and is triggered by crafted JavaScript code, potentially allowing a denial of ser...

CVE-2016-1945

CVE-2016-1945 affects Mozilla Firefox (nsZipArchive). The vulnerability arises from incorrect pointer handling during ZIP archive processing, enabling a remote attacker to trigger a denial of service (and potentially other impacts as per reports). Firefox versions before 44.0 are affected; remedi...

CVE-2025-6435

CVE-2025-6435 corresponds to a Mozilla Firefox/Thunderbird issue where saving a response from Devtools Network tab via the Save As menu may fail to preserve the .download extension. This could allow a user to inadvertently run a malicious executable. The FreeBSD advisory also notes memory safety ...

CVE-2026-16365

CVE-2026-16365 affects the DOM: Workers component. The vulnerability is fixed in Firefox 153 and Thunderbird 153. The available data include a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, user interaction required, and total impact ...

CVE-2026-6768

CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...

CVE-2005-0578

CVE-2005-0578 affects Firefox up to 1.0.0 and Mozilla Suite up to 1.7.5, where a predictable plugin temporary directory filename enables local users to delete arbitrary files via a symlink attack on plugtmp. Root cause: insecure naming of the plugtmp directory. Impact: local privilege/unauthorize...

CVE-2007-0778

CVE-2007-0778 affects Mozilla Firefox (and related Gecko-based browsers like SeaMonkey) prior to 1.5.0.10 / 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The vulnerability stems from the page cache implementation, where hash collisions can cause page data to be appended to the wrong cache entry...

CVE-2007-2868

This CVE-2007-2868 entry concerns memory corruption in the JavaScript engine of Mozilla-derived products. Affected software includes Mozilla Firefox 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, Thunderbird 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. Exploitation coul...