CVE-2025-8036

CVE-2025-8036 : Affects Mozilla Firefox (prior to 141, ESR prior to 140.1) and Thunderbird (prior to 141, 140.1). Root cause is caching of CORS preflight responses across IP address changes, enabling bypass of same-origin policy via DNS rebinding. Connected sources corroborate a DNS-rebinding vec...

CVE-2026-16390

CVE-2026-16390 describes a mitigation bypass in the Firefox Enterprise Policies component. The vulnerability is indicated as fixed in Firefox 153 and Firefox ESR 140.13. The initial entry provides a CVSS 3.1 base score of 9.1 (CRITICAL) with network attack vector, low attack complexity, and no us...

CVE-2026-7324

CVE-2026-7324 involves memory safety bugs in Firefox 150.0.0 and Thunderbird 150.0.0. Some bugs show evidence of memory corruption, with the description noting that, with sufficient effort, some could be exploited to run arbitrary code. The vulnerability was fixed in Firefox 150.0.1. The connecte...

CVE-2004-0866

CVE-2004-0866 involves Internet Explorer 6.0. The vulnerability allows websites to set cookies for country‑specific top‑level domains (e.g., .ltd.uk, .plc.uk, .sch.uk), which could enable a remote attacker to perform a session fixation attack and hijack a user’s HTTP session. The provided documen...

CVE-2005-0146

CVE-2005-0146 affects Firefox up to 1.0 and Mozilla up to 1.7.5, where Javascript-generated middle-click events can cause a clipboard data leak on systems that paste on middle-click. This is evidenced by multiple advisories (e.g., RHSA-2005:335/094) describing Mozilla security updates and fixes f...

CVE-2005-0589

CVE-2005-0589 affects Firefox before 1.0.1. The Form Fill feature can allow remote attackers to steal potentially sensitive information by monitoring values generated by the autocomplete capability. This is described in the NVD entry and echoed by multiple advisories (e.g., RHSA-2005:176, GLSA-20...

CVE-2005-0592

CVE-2005-0592 describes a heap-based buffer overflow in the UTF8ToNewUnicode function affecting Firefox before 1.0.1 and Mozilla before 1.7.6. The flaw can be triggered by invalid UTF-8 sequences that yield a zero length value, potentially allowing a remote attacker to crash the browser or execut...

CVE-2005-2114

CVE-2005-2114 affects Gecko-based browsers (Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, K-Meleon 0.9, etc.). The issue allows remote attackers to cause an application crash (DoS) by JavaScript that repeatedly calls an empty function. Public reports map this to Red Hat/CentOS advis...

CVE-2006-0295

CVE-2006-0295 affects Mozilla Firefox 1.5, Thunderbird 1.5 (when JavaScript is enabled in mail), and SeaMonkey older than 1.0. The vulnerability is a memory corruption caused by the QueryInterface method on built-in Location and Navigator objects, enabling remote code execution. Public references...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2006-1942

CVE-2006-1942 affects Mozilla Firefox 1.5.0.2 (and earlier) with multiple products (including Netscape 8.x and K-Meleon 0.9.13). Root cause: a crafted web page containing an IMG element whose SRC uses a non-image file:// URL can mislead a user into viewing the image, enabling user-assisted local-...

CVE-2008-5052

Mozilla Firefox 2.x (pre-2.0.0.18), Thunderbird 2.x (pre-2.0.0.18), and SeaMonkey 1.x (pre-1.1.13) are affected by CVE-2008-5052. The vulnerability arises in AppendAttributeValue in the JavaScript engine and is described as memory corruption that can cause a remote crash (Denial of Service) via u...

CVE-2009-0821

CVE-2009-0821 affects Mozilla Firefox 2.0.0.20 and earlier, where an INPUT element with onclick calling window.print can be nested (window.print(window.print())), leading to a denial of service through an application crash. Public references in the connected records confirm this DoS pattern (prin...

CVE-2013-0777

CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...

CVE-2014-1586

CVE-2014-1586 affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The issue is that the code path in content/base/src/nsDocument.cpp does not consider whether WebRTC video sharing is occurring, allowing a remote attacker to obtain sensitive informa...

CVE-2014-1588

CVE-2014-1588 affects Mozilla Firefox (before 34.0) and SeaMonkey (before 2.31). The underlying issue is memory safety bugs in the browser engine that could be exploited remotely to cause memory corruption, a denial of service, or potentially arbitrary code execution via unspecified vectors. Publ...

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions

CVE-2017-5471

Summary (CVE-2017-5471): Firefox

CVE-2017-7765

CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2025-4090

CVE-2025-4090 affects Thunderbird for Android and Firefox/Thunderbird before version 138 (Thunderbird <138; Firefox

CVE-2026-12292

CVE-2026-12292 : Incorrect boundary conditions in the Web Audio component are fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Affected software is Mozilla Firefox/Thunderbird Web Audio implementation; mitigation is upgrade to the stated fixed versions. Other con...

CVE-2005-0231

Firefox 1.0 is affected by CVE-2005-0231 where dragging a javascript: or data: URL to a tab can bypass the Javascript Security Manager (firetabbing). The issue is described as bypassing the security model, enabling potential remote information disclosure or execution channels. Public references a...

CVE-2005-0584

CVE-2005-0584 affects Firefox before 1.0.1 and Mozilla before 1.7.6: when the HTTP Authentication dialog is shown, focus is not moved to the prompting tab, enabling possible spoofing or phishing. The provided documents confirm the vulnerability and the affected products/versions. Remediation guid...

CVE-2006-1726

Technical details (affected product/versions, root cause, impact, remediation) for CVE-2006-1726 are not publicly provided in the supplied documents. Monitor for updates from vendors/security advisories.

CVE-2009-2479

Technical details for CVE-2009-2479 are not publicly available in the provided documents. Monitor for updates.

CVE-2011-2670

CVE-2011-2670 affects Mozilla Firefox prior to 3.6. The vulnerability arises in the rendering of Cascading Style Sheets (CSS), enabling cross-site scripting (XSS). The impact per sources is arbitrary script execution in the affected browser. Affected product/version: Firefox

CVE-2011-3666

Based on the Connected documents, CVE-2011-3666 is tied to Mozilla Firefox and Thunderbird on Mac OS X where a fix for CVE-2011-2372 was incorrectly applied, allowing a user-assisted bypass related to executable handling of .jar-like files via crafted web content. The Nessus/OpenSSH-related advis...

CVE-2016-1943

Consolidated details show CVE-2016-1943 affects Mozilla Firefox on Android, where the address bar can be spoofed via the scrollTo method. OpenSUSE release notes (openSUSE-2016-128/0306-1/0309) document Firefox 44.0 and NSS/NSPR updates as fixes, explicitly listing CVE-2016-1943 as part of address...

CVE-2016-2812

CVE-2016-2812 affects Mozilla Firefox prior to 46.0 due to a race condition in the ServiceWorkerManager.get implementation of the Service Worker subsystem. The issue can lead to a buffer overflow and application crash, with the potential for remote code execution or denial of service as described...

CVE-2025-4088

CVE-2025-4088 describes a cross-origin CSRF issue in Thunderbird (and affected Firefox) where malicious sites could exploit Redirects via the Storage Access API to send credentialed requests to arbitrary endpoints. Affected products: Firefox < 138 and Thunderbird

CVE-2005-1477

CVE-2005-1477 describes an arbitrary JavaScript execution flaw in Firefox 1.0.3 via the installer’s IconURL handling, enabling code execution with chrome privileges when a trusted extension install site (e.g., update.mozilla.org/addon.mozilla.org) is used, potentially chaining with CVE-2005-1476....

CVE-2005-2264

CVE-2005-2264 affects Firefox prior to 1.0.5, allowing a remote attacker to steal data by guiding a user to open a malicious link in the browser’s sidebar via the _search target and then inject script into other pages using a data: URL. The connected documents corroborate Firefox involvement and ...

CVE-2007-1116

Technical details about CVE-2007-1116 are not provided in the connected documents. The initial description mentions Firefox 1.8 handling of about: as ChromeProtocol, but no further specifics are available here. Monitor for updates.

CVE-2007-4041

CVE-2007-4041 describes multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and Firefox 3.0alpha that allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in certain URI handlers (mailto, nntp, news, snews, telnet). The issue is a ...

CVE-2008-1238

CVE-2008-1238 affects Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9. The vulnerability arises when generating the HTTP Referer header: if the URL contains Basic Authentication credentials without a username, the Referer header may not include the full URL, potentially allowing remote...

CVE-2008-5502

CVE-2008-5502 affects the layout engine in Mozilla Firefox 3.x up to 3.0.4/3.0.5? and Mozilla-derived apps (Thunderbird 2.x pre-2.0.0.19, SeaMonkey 1.x pre-1.1.14). The vulnerability causes a denial of service (crash) via vectors that trigger memory corruption, related to GetXMLEntity and FastApp...

CVE-2011-2996

CVE-2011-2996 concerns an unspecified vulnerability in the Firefox plugin API present in Firefox 3.6.x up to (but before) 3.6.23. The issue could enable a remote attacker to cause memory corruption and an application crash, with the potential for arbitrary code execution via unknown vectors. Publ...

CVE-2012-3979

CVE-2012-3979 : The OpenVAS/Nessus entries indicate a vulnerability in Mozilla Firefox for Android where insecure use of __android_log_print can be triggered by a crafted web page using the dump() function, potentially allowing remote code execution. The issue is tied to Firefox for Android speci...

CVE-2014-1575

CVE-2014-1575 : Mozilla Firefox before 33.0 contains multiple unspecified vulnerabilities in the browser engine that can lead to memory corruption, crashes, or potentially arbitrary code execution. The described vector involves improper interaction between threading and garbage collection in GCRu...

CVE-2016-1931

CVE-2016-1931 affects Mozilla Firefox before 44.0. The description cites memory safety hazards in the browser engine, including memory corruption and potential arbitrary code execution via Brotli data compression and related vectors, leading to remote denial of service or crash. Publicly document...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2025-12380

Mozilla Firefox is affected by CVE-2025-12380: starting with Firefox 142, a compromised child process could trigger a use-after-free in the GPU or browser process via WebGPU IPC calls, potentially escaping the sandbox and achieving arbitrary code execution. Affected versions are Firefox 142.x up ...

CVE-2025-3032

The CVE-2025-3032 entry describes a vulnerability in Firefox and Thunderbird where file descriptors leak from the fork server to web content processes, enabling privilege escalation. Affected products are Firefox and Thunderbird versions prior to 137. The root cause is the unintended propagation ...

CVE-2025-5272

CVE-2025-5272 arises from memory-safety bugs in Mozilla Firefox 138 and Thunderbird 138, with some bugs showing memory corruption that could potentially allow arbitrary code execution. The affected products are Firefox versions prior to 139 and Thunderbird versions prior to 139. The issue is addr...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-12293

CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...

CVE-2026-16377

Mitigation bypass in Firefox’s PDF Viewer component (CVE-2026-16377) is confirmed. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. According to the sources, the CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, low complexity, and no user interaction required, a...

CVE-2002-2436

CVE-2002-2436 affects Mozilla's CSS :visited handling in Firefox (pre-4.0), Thunderbird (pre-3.3), and SeaMonkey (pre-2.1). The flaw allows a crafted HTML document to trigger information disclosure about visited pages, constituting a partial confidentiality impact. The vulnerability is described ...

CVE-2005-0230

Technical details (affected products/versions/root cause/fixes) are not publicly provided in the connected documents. Monitor for updates.

CVE-2007-0801

CVE-2007-0801 affects Mozilla Firefox 1.5.x (notably 1.5.0.9 in the description) where nsExternalAppHandler::SetUpTempFile creates temporary files with filenames based on creation time. This predictable naming enables a remote attacker to craft an XMLHttpRequest that could execute arbitrary web-s...