CVE-2005-1156

CVE-2005-1156 affects Firefox <= 1.0.2 before 1.0.3, Mozilla Suite

CVE-2005-2267

CVE-2005-2267 affects Mozilla Firefox up to version 1.0.4 (before 1.0.5). The issue arises when a standalone application (e.g., Flash or QuickTime) opens a javascript: URL, which runs in the context of the previous page. This can lead to code execution if the standalone application subsequently l...

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2006-3812

CVE-2006-3812 affects Mozilla Firefox prior to 1.5.0.5, Thunderbird prior to 1.5.0.5, and SeaMonkey prior to 1.0.3. The flaw allows a remote attacker to trick a user into copying or dragging a link to reference remote files and potentially load chrome: URLs, leading to partial confidentiality/int...

CVE-2006-6498

CVE-2006-6498 is a vulnerability in the JavaScript engine affecting multiple Mozilla-era products (Firefox, SeaMonkey, Thunderbird) that could lead to memory corruption, crash, and potential remote code execution. Public advisories indicate fixes are delivered through updated Firefox/SeaMonkey/Th...

CVE-2007-3073

The CVE-2007-3073 vulnerability affects Mozilla Firefox 2.0.0.4 and earlier on Mac OS X and Unix, where a directory traversal via ..%2F in a resource:// URI could allow reading arbitrary files. The underlying issue is an input-validation problem in Firefox's handling of resource:// URIs. Impact p...

CVE-2008-2786

MODE C: Affected Mozilla stack in 2008 (Firefox/Thunderbird/XULRunner/Iceape) with concrete issues: CVEs 2008-2785, 2008-2798, 2008-2799, 2008-2800, 2008-2801, 2008-2802, 2008-2803, 2008-2805, 2008-2807, 2008-2808, 2008-2809, 2008-2811, and 2008-2933. Root causes include missing boundary checks i...

CVE-2008-2801

CVE-2008-2801 affects Mozilla Firefox (pre-2.0.0.15) and SeaMonkey (pre-1.1.10) due to a flaw in JAR signing implementation that allows remote attackers to run arbitrary code via JavaScript in a JAR or via a JAR archive using relative URLs to JavaScript files. The underlying issue is improper han...

CVE-2008-5013

CVE-2008-5013 affects Mozilla Firefox 2.x (pre-2.0.0.18) and SeaMonkey 1.x (pre-1.1.13). The issue arises when the Flash module is dynamically unloaded via an outside JavaScript function, leading to an access of an expired memory address and allowing remote code execution with a crafted SWF file....

CVE-2010-1201

CVE-2010-1201 affects Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The vulnerability is described as an unspecified memory corruption in the browser engine that could allow a remote attacker to cause a denial of service or potentially execute arbitrar...

CVE-2011-3001

CVE-2011-3001 affects Mozilla Firefox 4.x–6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows a user-assisted remote bypass of access restrictions by triggering an internal error on a crafted site that triggers adding a browser extension through a holding Enter key sequence. The...

CVE-2013-1672

CVE-2013-1672 affects Mozilla Firefox on Windows (and related Thunderbird/ESR components) where the Mozilla Maintenance Service can be exploited to bypass integrity verification and escalate privileges. The issue is tied to local privilege escalation via manipulation of data passed to the mainten...

CVE-2014-1478

This CVE (CVE-2014-1478) affects Mozilla Firefox before 27.0 and SeaMonkey before 2.24. The issue involves memory corruption in the browser engine (MPostWriteBarrier in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey) and may allow remote code execution or cause a crash...

CVE-2016-1945

CVE-2016-1945 affects Mozilla Firefox (nsZipArchive). The vulnerability arises from incorrect pointer handling during ZIP archive processing, enabling a remote attacker to trigger a denial of service (and potentially other impacts as per reports). Firefox versions before 44.0 are affected; remedi...

CVE-2025-12380

Mozilla Firefox versions starting with 142 (up to but not including 144.0.2 ) are vulnerable to a use-after-free condition. A compromised child process can trigger this vulnerability via WebGPU-related IPC calls , potentially affecting the GPU or browser process . This flaw could be exploited to ...

CVE-2026-12313

A vulnerability in the Security: Process Sandboxing component of Mozilla Firefox and Mozilla Thunderbird products allows for information disclosure and a sandbox escape . The issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Specific details...

CVE-2026-16403

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-4684

A race condition and use-after-free vulnerability exists in the Graphics: WebRender component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . This memory safety issue could allow an attacker to trigger a service failure . The vulnerability affects Firefox versions prior t...

CVE-2026-5731

Memory safety bugs in Firefox and Thunderbird (including ESR versions) could allow an attacker to execute arbitrary code via memory corruption. The issue affects Firefox < 149.0.2 , Firefox ESR < 115.34.1 , Firefox ESR < 140.9.1 , Thunderbird < 149.0.2 , and Thunderbird

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-8950

A Same-origin policy bypass exists in the Networking: HTTP component of the Firefox web browser and Thunderbird email client. The vulnerability is caused by a lack of mechanisms for verifying the source of data , which could allow an attacker to gain access to confidential data and compromise dat...

CVE-2026-8974

Memory safety bugs in Firefox ESR 140.10 , Firefox 150 , Thunderbird 140.10 , and Thunderbird 150 can lead to memory corruption. If successfully exploited with significant effort, these vulnerabilities could allow an attacker to execute arbitrary code . The issues are addressed in Firefox 151 , F...

CVE-2005-0143

CVE-2005-0143 affects Firefox before 1.0 and Mozilla before 1.7.5. The issue is that the SSL lock icon can be displayed when an insecure page loads a binary file from a trusted site, which could aid phishing. Connected advisories confirm Mozilla security updates were issued (e.g., RHSA-2005:335; ...

CVE-2005-0585

CVE-2005-0585 affects Firefox <1.0.1 and Mozilla

CVE-2006-6502

CVE-2006-6502 is a use-after-free vulnerability in the LiveConnect bridge code affecting Mozilla Firefox 2.x (before 2.0.0.1), Mozilla Firefox 1.5.x (before 1.5.0.9), SeaMonkey (before 1.0.7), and Thunderbird (before 1.5.0.9). It allows remote attackers to cause a crash (denial of service) via un...

CVE-2008-4064

CVE-2008-4064 affects Mozilla Firefox 3.x prior to 3.0.2. The description identifies three concrete vectors contributing to memory safety issues: (1) a memory corruption/possible code execution path via graphics rendering related to a long alert messagebox in cairo_surface_set_device_offset, (2) ...

CVE-2009-2465

CVE-2009-2465 affects Mozilla Firefox before 3.0.12 and Thunderbird. The vulnerability allows remote memory corruption and potential code execution via double frame construction, tied to nsHTMLContentSink.cpp, nsXMLContentSink.cpp, nsPresShell.cpp, and the nsSubDocumentFrame::Reflow function. Mir...

CVE-2009-2471

CVE-2009-2471 affects Mozilla Firefox before 3.0.12. The flaw in the setTimeout handling fails to preserve object wrapping, enabling remote attackers to run arbitrary JavaScript with chrome privileges via a crafted call (XPCNativeWrapper related). Affected product often cited with Firefox before ...

CVE-2010-3181

CVE-2010-3181 pertains to an untrusted search path (DLL loading) vulnerability in Mozilla Firefox (pre-3.5.14), Firefox 3.6.x (pre-3.6.11), Thunderbird (pre-3.0.9 and pre-3.1.5), and SeaMonkey (pre-2.0.9) on Windows. The root cause is Trojan horse DLLs loaded from the current working directory, e...

CVE-2014-1559

Technical details for CVE-2014-1559 are not publicly available in the provided documents. Monitor for updates to confirm affected products, root cause, impact, and remediation.

CVE-2015-2709

Vulnerability CVE-2015-2709 affects Mozilla Firefox browser engine (pre-38.0). The issue is described as memory-safety bugs in the engine, potentially enabling remote code execution or denial of service via unknown vectors. Affected products include Firefox up to 38.0 and Thunderbird-related comp...

CVE-2015-4522

CVE-2015-4522 affects Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3. The vulnerability stems from a buffer/overflow in nsUnicodeToUTF8::GetMaxLength, which could allow a remote attacker to cause memory corruption and a crash (DoS) via unknown vectors. Impact is memory corruption an...

CVE-2015-7217

CVE-2015-7217 affects Mozilla Firefox before 43.0 on Linux GNOME. The gdk-pixbuf configuration incorrectly enables the TGA decoder , allowing a remote attacker to trigger a heap-based buffer overflow via a crafted Truevision TGA image, resulting in a denial of service. The description and related...

CVE-2026-16362

A use-after-free vulnerability exists in the WebRTC: Audio/Video component of the Mozilla Firefox and Thunderbird browsers. This security flaw could potentially allow for the execution of arbitrary code. The issue has been resolved in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 ...

CVE-2026-74969

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw was addressed in the release of Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140...

CVE-2026-74974

CVE-2026-74974 describes a Same-origin policy bypass within the Graphics: ImageLib component of Mozilla products. The vulnerability affects Firefox and Thunderbird . This issue has been addressed in several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 15...

CVE-2005-1160

CVE-2005-1160 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. The vulnerability arises in the privileged chrome UI where an attacker could override certain properties or methods of DOM nodes, enabling privilege escalation. Attacks demonstrated via the eval function or the Script obje...

CVE-2005-2114

CVE-2005-2114 affects Gecko-based browsers (Mozilla 1.7.8, Firefox 1.0.4, Camino 0.8.4, Netscape 8.0.2, K-Meleon 0.9, etc.). The issue allows remote attackers to cause an application crash (DoS) by JavaScript that repeatedly calls an empty function. Public reports map this to Red Hat/CentOS advis...

CVE-2012-1941

CVE-2012-1941 corresponds to a heap-based buffer overflow in Mozilla Firefox/Thunderbird/SeaMonkey components (nsHTMLReflowState::CalculateHypotheticalBox) that can be triggered when resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. Affected ...

CVE-2012-3974

CVE-2012-3974 is an Untrusted search path vulnerability in the installer for Mozilla Firefox (pre-15.0) and Thunderbird (pre-15.0; ESR 10.x) on Windows. Root cause: Trojan horse executable in a root directory enables local privilege escalation. Affected: Firefox before 15.0, Firefox ESR before 10...

CVE-2015-7220

CVE-2015-7220 refers to a buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0. According to connected advisories, this vulnerability affects Firefox up to version 42.x and is triggered by crafted JavaScript code, potentially allowing a denial of ser...

CVE-2025-9183

Mozilla Firefox is affected by a spoofing issue in the Address Bar component. This vulnerability impacts Firefox versions prior to 142 and Firefox ESR versions prior to 140.2 . The issue was resolved in the mentioned versions. Exploitation details are not provided in the documents.

CVE-2026-16352

A sandbox escape vulnerability exists in the Disability Access APIs component of the Mozilla Firefox and Thunderbird browsers. This flaw is caused by a use-after-free condition. Impacting multiple components, this issue was addressed in Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thun...

CVE-2026-74977

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-84141

CVE-2026-84141 is an integer overflow in the Graphics: ImageLib component of Mozilla's image processing library, enabling remote code execution via crafted image content. The vulnerability affects Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (bef...

CVE-2026-84145

This vulnerability involves internally found bugs in Mozilla Thunderbird and Mozilla Firefox . The defects may lead to memory corruption or other security-relevant issues, which could potentially be exploited with sufficient effort. Affected versions include Thunderbird 154 , Thunderbird ESR 153....

CVE-2026-92036

The Networking: HTTP component in Mozilla Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This security flaw has been addressed in Firefox 156 and Thunderbird 156 . While the vulnerability has been reported in the wild as of September 17, 2026, specific exploitation detai...

CVE-2026-92048

A sandbox escape vulnerability exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions. This issue affects multiple versions of the browser and its email client. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , a...

CVE-2005-0232

CVE-2005-0232 affects Firefox 1.0 via a plugin-based approach (e.g., Flash) to manipulate about:config booleans, enabling a user interface fault (Fireflashing) that can be triggered by a user’s screen interaction. The vulnerability enables modification of configuration parameters with no user aut...

CVE-2005-0587

CVE-2005-0587 : Firefox versions before 1.0.1 and Mozilla before 1.7.6 are affected. A remote attacker can trick a user into downloading a .LNK file twice, causing arbitrary files referenced by the first link to be overwritten. This stems from how the .LNK files are processed during download. Aff...