CVE-2012-1971

CVE-2012-1971 concerns Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The description identifies memory corruption and potential remote code execution or crashes related to garbage collection after certain MethodJIT execution, plus other unspecified vectors. Impact ...

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2013-1673

The CVE-2013-1673 entry concerns Mozilla Firefox on Windows. The issue arises in the Mozilla Updater/Maintenance Service where registry entries were not properly updated during upgrades from older Firefox versions, allowing local users with write access to a trusted path to escalate privileges. A...

CVE-2016-1971

CVE-2016-1971 affects Mozilla Firefox before 45.0 on Windows, via the I420VideoFrame::CreateFrame function in WebRTC, where an unspecified status check is omitted. This can lead to memory corruption and a possible denial of service or other impacts. Public-lesson coverage in connected documents i...

CVE-2017-7761

Summary: CVE-2017-7761 affects Firefox on Windows (Firefox ESR < 52.2 and Firefox

CVE-2017-7766

CVE-2017-7766 is a local privilege-escalation path in Windows Mozilla updater components. An attacker who already has local access can manipulate updater.ini to abuse the Mozilla Windows Updater and Mozilla Maintenance Service, gaining privileged access to execute arbitrary files or delete files....

CVE-2020-12412

This CVE (CVE-2020-12412) affects Mozilla Firefox prior to version 70, where navigating a tab via the History API could spoof the address bar to display an incorrect domain (https scheme, blocked port, no lock icon) while the page content is controlled. The vulnerability enables spoofing of the v...

CVE-2025-4086

CVE-2025-4086 affects Thunderbird for Android and Firefox/ Thunderbird versions earlier than 138. The issue is triggered by a filename containing a large number of encoded newline characters that can obscure the file extension in the download dialog, potentially misleading users about the downloa...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...

CVE-2004-0648

The CVE-2004-0648 issue affects Mozilla Suite <=1.7.0+1, Firefox <=0.9.1+1, and Thunderbird

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2007-1377

CVE-2007-1377 affects Adobe Reader's AcroPDF.DLL when loaded from browsers (e.g., Firefox/Netscape/Opera). A remote adversary can trigger a denial of service by passing a PDF URL whose anchor starts with search= followed by a long sequence of %n characters, causing resource exhaustion (DoS). This...

CVE-2007-5335

CVE-2007-5335 affects Mozilla Firefox 2.0 prior to 2.0.0.8. According to the description, a remote attacker could obtain sensitive information by abusing the addMicrosummaryGenerator sidebar method to access file: URIs. The CVSS base score is 4.3 (Medium) with network access and no authentication...

CVE-2010-0648

CVE-2010-0648 affects Mozilla Firefox (possibly before 3.6). The vulnerability allows a remote attacker to cause a user’s session to reveal a redirect’s target URL by placing the site’s URL in the HREF of a LINK element for a stylesheet and reading document.styleSheets[0].href, related to an IFRA...

CVE-2010-1987

Mozilla Firefox 3.6.3 on Windows XP SP3 is affected by CVE-2010-1987, allowing remote attackers to trigger memory consumption and a crash through crafted JavaScript that appends long strings to a P element and performs string operations. The root cause is tied to DoubleWideCharMappedString in USP...

CVE-2011-2992

CVE-2011-2992 affects the Ogg reader in the browser engine of Mozilla Firefox (4.x–5) and SeaMonkey (2.x up to 2.3) and possibly other products, causing memory corruption and potential denial of service or arbitrary code execution via unspecified vectors. The root cause is memory safety issues in...

CVE-2011-3649

CVE-2011-3649 affects Mozilla Firefox 7.0 and Thunderbird 7.0 on Windows when using Direct2D with the Azure graphics backend, allowing cross-origin image data to be read via a manipulated canvas (Same Origin Policy bypass). The issue stems from a regression introduced by CVE-2011-2986. According ...

CVE-2012-3987

CVE-2012-3987 (Firefox for Android) : The issue arises when a page is transitioned into Reader Mode; the resulting page is given chrome privileges and may not be fully sanitized. Exploitation requires user activation of Reader Mode on a malicious page, enabling a cross-site scripting–like attack ...

CVE-2013-1700

CVE-2013-1700 affects Mozilla Firefox on Windows, where the Mozilla Maintenance Service fails to handle inability to launch the Mozilla Updater executable. This enables local privilege escalation via placing a Trojan horse executable at an arbitrary location. Affected component: Mozilla Maintenan...

CVE-2014-1527

CVE-2014-1527 affects Mozilla Firefox for Android (Android builds, e.g., Firefox 28.x and earlier; NVD references Firefox before 29.0 on Android). The vulnerability allows remote attackers to spoof the address bar by crafting JavaScript that uses DOM events to prevent reappearance of the real add...

CVE-2014-1554

CVE-2014-1554 concerns multiple vulnerabilities in the Mozilla Firefox browser engine prior to 32.0, enabling remote attackers to cause memory corruption, crash the browser, or potentially execute arbitrary code via unknown vectors. The issue is tied to Firefox 32.x timeframe and is discussed acr...

CVE-2014-8631

CVE-2014-8631 affects Firefox (before 34.0) and SeaMonkey (before 2.31) where the Chrome Object Wrapper (COW) allows native-interface passing, potentially bypassing DOM object restrictions via an unspecified method. This remote vulnerability could be exploited without user interaction; exploitati...

CVE-2016-1941

CVE-2016-1941 concerns Mozilla Firefox on OS X prior to 44.0 where the file-download dialog allows a button to become available too quickly, enabling a crafted site to trigger a clickjacking action intended for a double-click. Exploitation would allow a remote attacker to perform a single-click a...

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2017-7768

CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox

CVE-2025-27426

CVE-2025-27426 affects Firefox for iOS

CVE-2026-12329

CVE-2026-12329 is a memory-safety bug fixed in Thunderbird ESR 140.12 (and Firefox ESR 140.12). Affected products include Thunderbird/Firefox ESR 140.12; CVSSv3.1 base score 7.5 (HIGH) with NETWORK attack vector, high confidentiality/integrity/availability impact, user interaction required. Remed...

CVE-2026-16368

CVE-2026-16368: Affects Firefox JavaScript/WebAssembly component due to incorrect boundary conditions. Root cause described as boundary-condition flaw with all three security properties potentially impacted (high confidentiality, integrity, availability). Public fixed versions: Firefox 153 and Fi...

CVE-2026-6759

CVE-2026-6759 is a use-after-free in the Mozilla Widget: Cocoa component. Affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This is confirmed across multiple connected advisories and CVE l...

CVE-2004-0764

CVE-2004-0764 affects Mozilla-based browsers (Mozilla before 1.7; Firefox before 0.9; Thunderbird before 0.7) where the chrome flag and XML User Interface Language (XUL) files allow remote websites to hijack the browser UI. The vulnerability arises from XUL/UI manipulation that lets a site contro...

CVE-2004-1380

The CVE-2004-1380 issue affects Firefox <1.0 and Mozilla

CVE-2004-1381

CVE-2004-1381 affects Firefox before 1.0 and Mozilla before 1.7.5. The issue allows an inactive (background) tab to capture input focus on the active tab, enabling an attacker to read sensitive data entered on other sites (possible phishing risk). The connected advisories (Ubuntu USN-149-3 and re...

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

CVE-2005-0144

CVE-2005-0144 affects Mozilla/Firefox prior to 1.0/1.7.5. The issue arises when a view-source: URL targets a secure SSL page while a non-secure page loads, causing the secure site lock icon to misrepresent the page state and could enable phishing. Public documents confirm affected versions and th...

CVE-2006-0293

Technical details for CVE-2006-0293 are not present in the connected documents. Public discussion notes Firefox 1.5 function allocation issue causing memory corruption/DoS. No additional product/version specifics found here. Monitor for updates.

CVE-2007-5959

CVE-2007-5959 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7, with memory corruption in the layout/jar handling that could crash the browser and potentially allow arbitrary code execution. Connected advisories note that SeaMonkey updates fixed these issues (and related CVEs li...

CVE-2009-3010

The CVE-2009-3010 issue is a cross-site scripting (XSS) vulnerability in Mozilla-based products where data: URIs in Refresh headers are not properly blocked in HTTP responses. Affected versions include Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozi...

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2011-2669

CVE-2011-2669 affects Mozilla Firefox prior to 3.6 due to an issue in certificate validation that can trigger a denial-of-service. Connected sources (e.g., JVN entries) confirm the vulnerability stems from how certificates are validated, with impact described as DoS when loading HTTPS sites with ...

CVE-2025-5271

Summary : CVE-2025-5271 corresponds to a vulnerability where Devtools’ preview of responses failed to enforce CSP headers, potentially enabling content-injection attacks. The public records indicate affected products include Mozilla Firefox version prior to 139 and Mozilla Thunderbird prior to 13...

CVE-2026-6762

CVE-2026-6762 is a spoofing issue in the DOM: Core & HTML component. Connected advisories confirm it affects Firefox/Thunderbird stacks and was fixed in Firefox 150, ESR 115.35, ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS 3.1 base score is 6.3 (MEDIUM) with NETWORK attack vector...

CVE-2004-2225

CVE-2004-2225 affects Mozilla Firefox up to version 0.10.0, where saving a remote resource via a crafted data: URI could allow a remote attacker to delete arbitrary files in the user’s download directory due to improper handling when the Save button is clicked. The information specifies Firefox b...

CVE-2006-0496

CVE-2006-0496 is an XSS in Mozilla-based browsers (Mozilla 1.7.12+, Firefox 1.0.7+, Netscape 8.x) due to a flaw in the -moz-binding CSS property that can bypass origin checks. Exploitation could allow execution of arbitrary script in a user’s browser, evidenced by the LiveJournal account compromi...

CVE-2006-1650

CVE-2006-1650 affects Firefox 1.5.0.1, where a window reopened to a malicious Shockwave Flash app and then navigated back to a trusted URL while the Flash is loading could allow spoofing of the address bar and phishing-like behavior. The description notes a followup failed to replicate; no remedi...

CVE-2006-5159

CVE-2006-5159 describes a stack-based buffer overflow in Mozilla Firefox involving JavaScript that could allow remote code execution. The incident has been disputed by the vendor and researchers, with claims that the code demonstrator only caused crashes and resource exhaustion rather than reliab...

CVE-2007-2869

CVE-2007-2869 affects Mozilla Firefox 1.5.x ≤1.5.0.12 and Firefox 2.x ≤2.0.0.4 (and possibly earlier). The issue is in the form autocomplete feature: submitting a form with a large amount of characters can cause a denial of service via persistent high CPU usage. The linked advisories indicate rem...

CVE-2008-4723

Mozilla Firefox 3.0.1–3.0.3 is vulnerable to cross-site scripting via ftp:// URLs delivering HTML documents; a remote attacker could inject script when loading (1) JPG, (2) PDF, or (3) TXT files. OpenVAS and SUSE/Ubuntu references confirm the XSS exposure; Exploit-DB lists a dedicated Windows exp...

CVE-2008-7293

Mozilla Firefox vulnerability CVE-2008-7293 affects Firefox versions before 4. The issue allows MITM attackers to overwrite or delete cookies via a Set-Cookie header in HTTP responses because HTTPS session cookies are not properly restricted, tied to the absence of the HSTS includeSubDomains feat...