CVE-2008-2805

CVE-2008-2805 affects Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10. The flaw allows a remote attacker to force the upload of arbitrary local files from a client computer via vectors involving originalTarget and DOM Range. The vulnerability is described in the initial record as a lo...

CVE-2009-2664

CVE-2009-2664 concerns Mozilla Firefox's JavaScript engine: the function js_watch_set in jsdbgapi.cpp has a memory-safety bug that could allow a remote attacker to cause an assertion failure or potentially execute arbitrary code via a crafted .js file, leading to a denial of service or more serio...

CVE-2009-3014

This CVE (CVE-2009-3014) concerns multiple Mozilla products: Firefox up to 3.0.13 and earlier, plus versions in the 3.5, 3.6 a1 pre, and 3.7 a1 pre series; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier. The vulnerability arises from improper handling of javascript: URIs in HTML links inside 302...

CVE-2009-3381

CVE-2009-3381 affects Mozilla Firefox 3.5.x prior to 3.5.4. The Mozilla Firefox browser engine vulnerabilities enable remote attackers to cause memory corruption and an application crash, with the possibility of arbitrary code execution. The issue is discussed in conjunction with MFSA 2009-64 and...

CVE-2011-3866

CVE-2011-3866 affects Mozilla Firefox prior to 7.0 and SeaMonkey prior to 2.4, where motion data events were not properly restricted. The underlying issue is an improper restriction of motion data events, enabling a remote attacker to read keystrokes via JavaScript running in a background tab. Ex...

CVE-2012-4206

CVE-2012-4206 describes an untrusted search path vulnerability in the Windows installers of Mozilla Firefox (pre-17.0) and Firefox ESR (pre-10.0.11). A Trojan horse DLL in the user’s default downloads directory can be loaded, enabling local privilege escalation. The issue is tied to the installer...

CVE-2013-5591

CVE-2013-5591 affects Mozilla Firefox before 25.0 (and ESR 24.x before 24.1), Thunderbird before 24.1, and SeaMonkey before 2.22, due to an unspecified browser‑engine vulnerability that could allow a remote attacker to cause memory corruption and an application crash, or possibly execute arbitrar...

CVE-2014-1537

CVE-2014-1537 describes a use-after-free in Mozilla Firefox (function mozilla::dom::workers::WorkerPrivateParent) that, in Firefox releases before 30.0, could allow a remote attacker to execute arbitrary code or cause a crash via unspecified vectors (heap corruption). The vulnerability stems from...

CVE-2014-1595

Affected software: Mozilla Firefox (non-ESR) < 34.0 and Firefox ESR < 31.3, plus Mozilla Thunderbird

CVE-2015-2714

CVE-2015-2714 affects Mozilla Firefox on Android prior to 38.0. The vulnerability arises from not properly restricting writing URL data to the Android logging system, enabling a local attacker with READ_LOGS permission to obtain sensitive information via a crafted app (e.g., exploiting Android 4....

CVE-2017-5463

CVE-2017-5463 affects Firefox for Android prior to version 53.0. The issue arises when Android intents can launch Firefox in reader mode with a user-supplied URL, allowing spoofing of the address bar contents shown to users. Public details in the provided sources confirm the affected product (Fir...

CVE-2025-8040

CVE-2025-8040 corresponds to memory-safety bugs in Mozilla Firefox/Thunderbird products (Firefox/Thunderbird 140 line, ESR 140.0 and related versions) with evidence of memory corruption that could potentially lead to arbitrary code execution. Affected components are the Firefox and Thunderbird br...

CVE-2026-16355

JIT miscompilation in the JavaScript Engine (JIT component) for Mozilla Firefox ESR and Firefox affects Firefox ESR releases earlier than 115.38. The issue is fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected entries from multiple sources confirm the vulnerability is tied...

CVE-2026-6755

CVE-2026-6755 describes a mitigation bypass in the DOM: postMessage component. Affected products reference Mozilla Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 6.5 (Network attack vector, Low attack complexity, Privileges requ...

CVE-2026-6758

CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component. Affected: Firefox and Thunderbird; fixed in Firefox 150 and Thunderbird 150. CVSS v3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No explicit exploit details provided in the connected documents.

CVE-2026-6761

CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...

CVE-2004-0761

CVE-2004-0761 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. The vulnerability allows remote attackers to use certain redirect sequences to spoof the security lock icon, making a web page appear encrypted. This is documented with a CVSS base score of 5.0 (Network atta...

CVE-2004-0779

The vulnerability affects Mozilla 1.6, Firebird 0.7, and Firefox 0.8, where cached passwords for SSL sites are not properly restricted to SSL sessions. This allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. Root cause: insufficient verification of SSL-...

CVE-2004-0905

CVE-2004-0905 affects Mozilla Firefox (before the Preview Release), Mozilla (before 1.7.3), and Thunderbird (before 0.8). The issue enables remote attackers to perform cross-domain scripting and potentially execute arbitrary code by convincing a user to drag and drop javascript: links to a frame ...

CVE-2005-0588

CVE-2005-0588 affects Firefox <=1.0.0.1 and Mozilla

CVE-2006-2785

CVE-2006-2785 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox prior to 1.5.0.4. An attacker could trick a user into viewing a broken image or a frame with a Javascript URL, enabling user-assisted remote script/HTML injection. The vulnerability affects Firefox Windows/Linux/macOS ...

CVE-2006-4310

Mozilla Firefox 1.5.0.6 is affected by CVE-2006-4310. The vulnerability allows a remote attacker to cause a denial of service (crash) by delivering a crafted FTP response when a user attempts to connect via an FTP URI. The description across connected documents is consistent, explicitly mentionin...

CVE-2008-1241

CVE-2008-1241 describes a GUI overlay vulnerability in Mozilla Firefox up to 2.0.0.13 and SeaMonkey up to 1.1.9. A borderless XUL pop-up window opened from a background tab could spoof form elements and redirect user inputs, exposing users to UI manipulation. The issue is tied to how the browser ...

CVE-2008-5015

CVE-2008-5015 affects Mozilla Firefox 3.x prior to 3.0.4. The issue arises when a file: URI is accessed in the same tab as a chrome or privileged about: page, allowing a user-assisted attacker to run arbitrary JavaScript with chrome privileges via code saved locally. The underlying vulnerability ...

CVE-2009-1232

CVE-2009-1232 affects Mozilla Firefox 3.0.x (including 3.0.8 and earlier; 3.0.10 and earlier also affected) where an XML document consisting of a long series of start-tags with no end-tags can trigger a memory corruption in the XUL parser, leading to a denial-of-service (crash). Multiple Red Hat ...

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2010-1212

CVE-2010-1212 affects Mozilla Firefox 3.6.x (before 3.6.7) and Thunderbird 3.1.x (before 3.1.1). The issue arises from memory-safety defects in the browser engine’s tracing/recording paths, specifically in TraceRecorder::record_JSOP_BINDNAME, depth handling in TraceRecorder::record_JSOP_GETELEM, ...

CVE-2010-2770

CVE-2010-2770 affects Mozilla-based products on Mac OS X: Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The vulnerability arises from a crafted font in a data: URL that can trigger memory corruption, leadin...

CVE-2010-3400

CVE-2010-3400 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5. The JavaScript Math.random() RNG is seeded with the current time, enabling remote attackers to guess the seed via brute-force. The description does not specify exploits; it indicates...

CVE-2012-4212

Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.

CVE-2013-0798

CVE-2013-0798 affects Firefox for Android. The issue is that the app_tmp directory used during addon installation is world-writable and world-readable, allowing an attacker to replace or modify addons during the window when they are staged before installation. This is specific to Firefox for Andr...

CVE-2013-1683

The CVE-2013-1683 entry concerns Mozilla Firefox before 22.0, where multiple unspecified vulnerabilities in the browser engine can cause memory corruption leading to denial of service or possibly arbitrary code execution. The attached context references MFSA advisories and vendor updates that fix...

CVE-2014-1506

Mozilla Firefox for Android prior to 28.0 (including ESR lines in some releases) contains a directory traversal vulnerability in the Android Crash Reporter. A crafted application can manipulate Crash Reporter arguments to cause local files to be transmitted to arbitrary servers or trigger a denia...

CVE-2014-1560

CVE-2014-1560 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. The issue is in parsing X.509 certificates: a crafted certificate that does not use ASCII character encoding in a required context can trigger a denial of service. The vulnerability is triggered during certificate pars...

CVE-2017-7760

CVE-2017-7760 affects Mozilla Firefox/Firefox ESR on Windows via the Mozilla Windows Updater and Maintenance Service. The vulnerability stems from the updater reading the original file and applying changes, with a malicious actor able to pass a crafted path to the callback parameter, enabling man...

CVE-2023-37456

Summary of CVE-2023-37456 (Firefox for iOS) : The issue is a crash in the session restore helper when no parameter is sent to the message handler, affecting Firefox for iOS versions prior to 115. Per connected documents, this creates a denial-of-service risk that can be triggered remotely. The ro...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird

CVE-2026-5731

CVE-2026-5731 refers to memory-safety bugs across Mozilla Firefox/Thunderbird products. The initial entry lists memory corruption possibilities in Firefox ESR 115.34.0 and 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1, with fixes in Firefox 149.0.2, Firefox ESR 115.34...

CVE-2026-6753

CVE-2026-6753 : This is a memory/boundary-condition vulnerability in the WebRTC component. The initial report identifies the root cause as incorrect boundary conditions in the WebRTC component, with an impact profile of Confidentiality, Integrity, and Availability all rated Low, and an overall CV...

CVE-2026-6765

CVE-2026-6765 affects Firefox and Thunderbird. The vulnerability is an information disclosure in the Form Autofill component. Root cause details are not provided beyond disclosure, but the issue is mitigated by fixes in Firefox 150 , Firefox ESR 140.10 , Thunderbird 150 , and Thunderbird 140.10 ....

CVE-2026-8094

CVE-2026-8094 : A vulnerability in the WebRTC component reported in multiple feeds (CVE-2026-8094) affecting Mozilla Firefox ESR builds and Thunderbird. The available documents identify a WebRTC issue but do not provide detailed root cause, impacted products beyond Firefox ESR and Thunderbird, or...

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2005-1158

CVE-2005-1158 affects Mozilla Firefox prior to 1.0.3. The issue arises from missing security checks that allow an attacker to inject arbitrary JavaScript into privileged pages by abusing the sidebar’s _search target. This could enable code execution within the context of the affected site, as des...

CVE-2007-1562

CVE-2007-1562 affects Mozilla Firefox prior to 1.5.0.11 and 2.x prior to 2.0.0.3, where the FTP PASV response could be exploited by a remote server to force the client to connect to an alternate address, enabling proxied port scans or information disclosure. The vulnerability arises from how the ...

CVE-2012-0454

CVE-2012-0454 describes a use-after-free in Mozilla Firefox (including Firefox 4.x–10.0 and ESR 10.x before 10.0.3), Thunderbird 5.0–10.0, and SeaMonkey before 2.8 on 32-bit Windows 7. The issue arises when using the file-open dialog in a child window, related to IUnknown_QueryService in shlwapi....

CVE-2021-43530

Affected software: Firefox for Android. The CVE-2021-43530 entry describes a Universal XSS vulnerability caused by improper sanitization when processing a URL scanned from a QR code, affecting Firefox versions before 94. The condition is explicit in multiple sources (NVD/Nessus aggregation and re...

CVE-2026-16350

CVE-2026-16350 affects Mozilla Firefox and Firefox ESR (Audio/Video: cubeb). The issue is caused by incorrect boundary conditions in cubeb, with a remediation by upgrading to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13. Public CVSS 3.1 vector indicates NETWORK attack, no user interacti...

CVE-2026-6750

CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...

CVE-2007-0779

CVE-2007-0779 concerns a GUI overlay spoofing flaw in SeaMonkey prior to 1.0.8 (and Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2) where a large, transparent cursor via CSS3 hotspot could spoof UI elements such as the hostname or security indicators. The vulnerability allows remote observe...

CVE-2009-3073

The CVE-2009-3073 entry concerns Mozilla Firefox 3.5.x prior to 3.5.3, with memory corruption via an incorrect top-level script object offset calculation that could lead to a crash or arbitrary code execution. The connected advisories (MFSA/3.5-era disclosures) and OpenVAS/SUSE entries confirm th...