CVE-2015-7219

CVE-2015-7219 affects Mozilla Firefox before 43.0 via the HTTP/2 implementation. A malformed PushPromise frame can trigger decompressed-buffer length miscalculation and incorrect memory allocation, leading to a denial of service (integer underflow, assertion failure, and application exit). The is...

CVE-2026-16354

CVE-2026-16354 is an information disclosure vulnerability within the Graphics: ImageLib component of the Mozilla Firefox and Thunderbird browsers. The flaw was addressed in Firefox versions 153 , ESR 115.38 , and ESR 140.13 , as well as Thunderbird versions 153 and 140.13 . No specific exploit de...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-6759

A use-after-free vulnerability exists in the Widget: Cocoa component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. An attacker could exploit this memory safety issue to compromise the accessibility of protected information . The vulnerability has been addressed in Firefox 1...

CVE-2026-74964

An integer overflow vulnerability exists in the Graphics component of the Mozilla Firefox and Mozilla Thunderbird applications. This flaw was addressed in the release of Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While spe...

CVE-2026-92005

A Use-after-free vulnerability exists in the Audio/Video: Web Codecs component of Mozilla Firefox and Thunderbird . This flaw was addressed in Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . Exploitation details are not provide...

CVE-2026-92018

A sandbox escape vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird . This flaw allows an attacker to bypass the sandbox environment, potentially leading to a significant impact on the host system. Affected versions include Firefox 156 , Firefox ESR 115.41 ,...

CVE-2006-2784

CVE-2006-2784 affects Mozilla Firefox’s PLUGINS PAGE prior to 1.5.0.4. An attacker-supplied prompt could trick a user into installing a missing plugin and clicking Manual Install, then chain nested javascript: URLs to run privileged code. The documented impact is remote user-assisted code executi...

CVE-2006-4566

CVE-2006-4566 is a heap corruption vulnerability in Mozilla family browsers caused by parsing a malformed JavaScript regular expression that ends with a backslash () in an unterminated character class (e.g., []). It affects Mozilla Firefox, Thunderbird, and SeaMonkey as listed in connected adviso...

CVE-2008-0420

The CVE-2008-0420 issue affects Mozilla Firefox (before 2.0.0.12), Mozilla Thunderbird (before 2.0.0.12), and SeaMonkey (before 1.1.8). It stems from incorrect calculations in the BMP decoder (nsBMPDecoder.cpp) related to the mColors table for 8-bit BMPs, enabling an out-of-bounds read of heap me...

CVE-2008-4582

CVE-2008-4582 describes an information leak through local Windows shortcut files (.url) that could bypass Same Origin Policy and disclose data via an HTML document. Publicly documented details indicate affected products include Mozilla Firefox 3.0.1–3.0.3, Firefox 2.x prior to 2.0.0.18, and SeaMo...

CVE-2009-3987

CVE-2009-3987 affects Mozilla Firefox (before 3.0.16 and 3.5.x before 3.5.6) and SeaMonkey (before 2.0.1); the GeckoActiveXObject function returns different exception messages based on whether a ProgID is listed in the registry, enabling remote attackers to infer installed software via multiple c...

CVE-2011-0058

CVE-2011-0058 describes a buffer overflow in Mozilla Firefox (before 3.5.17 and 3.6.x before 3.6.14) and SeaMonkey (before 2.0.12) on Windows. A long string can trigger construction of a long text run, leading to remote code execution or memory corruption and potential denial of service. Affected...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2016-1939

CVE-2016-1939 affects Mozilla Firefox before 44.0, where cookies with vertical tab characters can leak sensitive information via HTTP Cookie headers. This issue is noted as stemming from an incomplete fix for CVE-2015-7208. The vulnerability is limited to cookie-name handling and can lead to info...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2026-74958

Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-84123

CVE-2026-84123 identifies a privilege escalation vulnerability caused by a use-after-free flaw in the Graphics: WebGPU component. This issue affects Mozilla Firefox , Mozilla Thunderbird , and associated packages. Remediation is available in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and...

CVE-2005-1157

CVE-2005-1157 affects Firefox < 1.0.3, Mozilla Suite

CVE-2005-1531

CVE-2005-1531 affects Mozilla Firefox <= 1.0.3 and Mozilla Suite

CVE-2005-2269

CVE-2005-2269 affects Firefox <1.0.5, Mozilla

CVE-2006-1740

CVE-2006-1740 affects Mozilla-derived browsers, allowing remote attackers to spoof secure site indicators (e.g., the lock icon) by abusing a popup window that loads the trusted site and then navigates to a malicious site. Affected products include Firefox 1.x prior to 1.5 and 1.0.x prior to 1.0.8...

CVE-2006-4569

CVE-2006-4569 relates to Firefox’s popup blocker: the “blocked popups” display could be shown in the Location bar instead of the originating frame, potentially enabling remote user‑assisted XSS. The connected advisories confirm this vulnerability in Mozilla Firefox up to version 1.5.0.6 and indic...

CVE-2006-6500

CVE-2006-6500 describes a heap-based buffer overflow in Mozilla-related products. A remote attacker could crash the application or possibly execute arbitrary code by crafting CSS cursor images that trigger an incorrect Windows bitmap size calculation during conversion. Affected software per the d...

CVE-2007-4038

Technical details for CVE-2007-4038 are not present in the provided Connected documents. The initial description mentions a mailto: argument-injection issue in Firefox/Thunderbird but lacks product/version/patch specifics. Monitor for updates.

CVE-2009-2467

CVE-2009-2467 affects Mozilla Firefox versions before 3.0.12 and 3.5 before 3.5.1. The described vulnerability allows a remote attacker to cause an application crash or potentially execute arbitrary code through a Flash-related sequence: a Flash object interaction, a slow-script dialog, and unloa...

CVE-2009-3382

CVE-2009-3382 describes a memory corruption vulnerability in Mozilla Firefox’s browser engine (nsCSSFrameConstructor.cpp) where first-letter frame handling in Firefox 3.0.x before 3.0.15 could be exploited to crash the browser or potentially execute arbitrary code via unspecified vectors. The imp...

CVE-2010-3171

CVE-2010-3171 relates to the Firefox JavaScript Math.random() seed being initialized only once per document object, making it easier for remote attackers to track a user or trigger in-session phishing via spoofed pop-ups. The issue ties to an underlying fix (CVE-2008-5913) that was not fully corr...

CVE-2010-3770

CVE-2010-3770 refers to multiple XSS vulnerabilities in the Mozilla Firefox/SeaMonkey rendering engine. The issue allows remote attackers to inject arbitrary scripts via certain character encodings: x-mac-arabic, x-mac-farsi, or x-mac-hebrew, which may be converted to angle brackets during render...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2015-2726

CVE-2015-2726 : Mozilla Firefox before 39.0 contains memory-safety vulnerabilities in the browser engine that could allow a remote attacker to cause a crash (DoS) or potentially execute arbitrary code via unknown vectors. Affected product: Firefox up to version 39.0 (multiples CVEs described in r...

CVE-2015-4514

CVE-2015-4514 is a memory-safety vulnerability in Mozilla Firefox’s browser engine, reported across multiple advisories. The issue is among several memory safety hazards that could allow remote code execution or a denial of service via unknown vectors. Affected products include Firefox (and ESR) ...

CVE-2016-9065

CVE-2016-9065 affects Firefox for Android and is a UI spoofing flaw where the location bar can be spoofed by forcing fullscreen mode, blocking exit, and displaying a fake address bar without user notification. The issue is limited to Firefox for Android; other OSes are not affected, and the vulne...

CVE-2017-5409

The CVE-2017-5409 issue affects Mozilla Firefox on Windows (Firefox ESR <45.8 and Firefox

CVE-2024-31392

A security bypass vulnerability exists in Mozilla Firefox for iOS versions

CVE-2025-3032

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability involving a file descriptor leak from the fork server to web content processes. This flaw could allow an attacker to perform privilege escalation attacks. The issue is present in versions prior to 137...

CVE-2026-12297

Mozilla products Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by incorrect boundary conditions in the Networking component . This security flaw was addressed in the release of Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbir...

CVE-2026-16361

Mozilla Thunderbird and Firefox ESR are affected by memory safety bugs that can lead to memory corruption . If successfully exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed in Thunderbird 140.13 , Firefox ESR 115.38 , and Firefox ESR 1...

CVE-2026-16379

CVE-2026-16379 involves a privilege escalation vulnerability within the DOM: Content Processes component of the Mozilla Firefox browser and Thunderbird mail client. The issue allows for elevated privileges and was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 1...

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-74959

A mitigation bypass vulnerability exists in the Storage: Cache API component of Mozilla Firefox and Mozilla Thunderbird . The flaw allows attackers to bypass established security mitigations. The issue has been resolved in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , T...

CVE-2026-84138

A Denial-of-Service (DoS) vulnerability exists in the PDF Viewer component of Firefox and Thunderbird . The vulnerability has been addressed in Firefox 155 and Thunderbird 155 . While specific root cause details are not provided in the documents, the impact is a high availability loss as indicate...

CVE-2026-9078

Mozilla Firefox for iOS versions prior to 151.1 are vulnerable to a flaw where specially crafted right-to-left (RTL) and internationalized domain names (IDNs) are displayed incorrectly in link preview UI surfaces. An attacker can use a crafted RTL hostname to visually reorder the displayed domain...

CVE-2005-0586

CVE-2005-0586 affects Firefox < 1.0.1 and Mozilla

CVE-2005-0591

CVE-2005-0591 affects Firefox prior to 1.0.1, allowing remote spoofing of the security and download modal dialogs (Firespoofing). Red Hat advisory RHSA-2005:176 and CentOS notes indicate that Firefox was updated and recommend upgrading to Mozilla 1.7.7 to remediate the issue.

CVE-2005-0593

CVE-2005-0593 affects Firefox before 1.0.1 and Mozilla before 1.7.6. It enables remote attackers to spoof the SSL “secure site” lock icon through scenarios where the lock display is misleading (unfinished load, non-HTTP SSL, or HTTP 204 responses). The issue is documented across multiple advisori...

CVE-2005-1153

CVE-2005-1153 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. When a popup is blocked, a javascript: URL executed via the user-visible Show javascript option can lead to remote code execution. The issue is documented in multiple advisories (e.g., RHSA-2005:383/384/386) and affected F...