CVE-2008-0413

CVE-2008-0413 affects the JavaScript engine in Mozilla Firefox < 2.0.0.12, Thunderbird < 2.0.0.12, and SeaMonkey

CVE-2009-3982

The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...

CVE-2011-0079

The CVE-2011-0079 entry affects Mozilla Firefox 4.x prior to 4.0.1, where several memory-safety vulnerabilities in the browser engine (gfx/layers/d3d10 ReadbackManagerD3D10.cpp noted among others) could allow remote attackers to cause memory corruption and application crashes or possibly execute ...

CVE-2013-5591

CVE-2013-5591 affects Mozilla Firefox before 25.0 (and ESR 24.x before 24.1), Thunderbird before 24.1, and SeaMonkey before 2.22, due to an unspecified browser‑engine vulnerability that could allow a remote attacker to cause memory corruption and an application crash, or possibly execute arbitrar...

CVE-2015-4501

CVE-2015-4501 affects Mozilla Firefox browser engine prior to 41.0. Technical details across connected sources indicate multiple unspecified memory-safety vulnerabilities that could allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute a...

CVE-2016-1953

CVE-2016-1953 affects Mozilla Firefox before 45.0, tied to memory safety issues in the browser engine (notably js/src/jit/arm.cpp) that can cause memory corruption leading to remote code execution or denial of service. Public advisories (e.g., openSUSE/SUSE MFSA entries) relate this CVE to multip...

CVE-2025-4086

This vulnerability affects Thunderbird for Android and versions of Firefox prior to 138 . A specially crafted filename containing a large number of encoded newline characters can obscure the file's extension when displayed in the download dialog. The issue was resolved in Firefox 138 and Thunderb...

CVE-2026-12328

Memory safety bugs exist in Firefox ESR 115.36 , Firefox ESR 140.11 , Thunderbird ESR 140.11 , Firefox 151 , and Thunderbird 151 . These vulnerabilities may result in memory corruption, which could potentially be exploited to execute arbitrary code with sufficient effort. Remediation is available...

CVE-2026-16385

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-92035

CVE-2026-92035 is a sandbox escape vulnerability in the Graphics component caused by incorrect boundary conditions. This flaw affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Impactful remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbi...

CVE-2006-1942

CVE-2006-1942 affects Mozilla Firefox 1.5.0.2 (and earlier) with multiple products (including Netscape 8.x and K-Meleon 0.9.13). Root cause: a crafted web page containing an IMG element whose SRC uses a non-image file:// URL can mislead a user into viewing the image, enabling user-assisted local-...

CVE-2006-2777

CVE-2006-2777 is a remote-code-execution issue in Mozilla Firefox up to 1.5.0.3/1.5.x and SeaMonkey up to 1.0.1/1.0.x via nsISelectionPrivate: a SelectionListener/notifications flow executes in a privileged context. Affected products: Firefox before 1.5.0.4 and SeaMonkey before 1.0.2. Root cause:...

CVE-2008-2806

CVE-2008-2806 affects Mozilla Firefox <= 2.0.0.15 and SeaMonkey

CVE-2008-2808

Vulnerability CVE-2008-2808 affects Mozilla Firefox <2.0.0.15 and SeaMonkey

CVE-2009-1828

CVE-2009-1828 : Mozilla Firefox, version 3.0.10, is vulnerable to a remote DoS via a KEYGEN element when combined with (1) a META tag for automatic page refresh or (2) a BODY onLoad event. The description notes that earlier versions may also be affected. The provided documents do not include an e...

CVE-2009-2662

CVE-2009-2662 affects Mozilla Firefox 3.5.x prior to 3.5.2. The browser engine vulnerability (TraceRecorder::snapshot in js/src/jstracer.cpp) allows remote attackers to trigger memory corruption and crash, with possible arbitrary code execution. Affected product: Mozilla Firefox 3.5.x. Root cause...

CVE-2009-2665

CVE-2009-2665 affects Mozilla Firefox 3.5.x up to 3.5.1; the flaw arises in nsDocument::SetScriptGlobalObject when certain add-ons are enabled and a crafted Link HTTP header is processed. This allows remote attackers to execute arbitrary JavaScript with chrome privileges via a malicious page, due...

CVE-2011-3666

Based on the Connected documents, CVE-2011-3666 is tied to Mozilla Firefox and Thunderbird on Mac OS X where a fix for CVE-2011-2372 was incorrectly applied, allowing a user-assisted bypass related to executable handling of .jar-like files via crafted web content. The Nessus/OpenSSH-related advis...

CVE-2012-0443

CVE-2012-0443 affects Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0) and SeaMonkey prior to 2.7. The browser engine vulnerabilities allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vectors; several advisories reference t...

CVE-2012-0450

Mozilla Firefox (Linux/macOS) and SeaMonkey

CVE-2012-1964

CVE-2012-1964 corresponds to the certificate-warning clickjacking issue in Mozilla Firefox (4.x–12.0), Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–12.0, and SeaMonkey before 2.10. The vulnerability arises from improper handling of clickjacking on the about:certerror page, allowing a MITM atta...

CVE-2012-4217

CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey

CVE-2014-1494

CVE-2014-1494 concerns multiple memory-safety vulnerabilities in the browser engine of Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25, with remote denial of service or potential arbitrary code execution via unknown vectors. The connected docs confirm that these issues are part of MFSA ...

CVE-2025-27426

Firefox for iOS versions prior to 136 are vulnerable to an input validation error where malicious websites can utilize a server-side redirect to an internal error page. This flaw allows for a spoofed website URL , potentially leading to phishing or deceptive content. The issue was addressed in Fi...

CVE-2025-5271

Mozilla Firefox and the Thunderbird email client are affected by a vulnerability in the DevTools suite. The issue stems from a lack of mechanisms for encoding or blocking output data, which causes the previewing function to ignore Content Security Policy (CSP) headers. This oversight could allow ...

CVE-2026-12306

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability affects multiple versions, including Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. While the specific root cause is described generally as a memory safety i...

CVE-2026-74945

CVE-2026-74945 identifies an information disclosure vulnerability within the Graphics: Text component of Firefox and Thunderbird . The root cause involves an uninitialized heap disclosure that can be triggered via a crafted web font. Specifically, a malicious @font-face font can walk the OTS outp...

CVE-2026-74953

A privilege escalation vulnerability exists in the Networking: Cookies component of Mozilla Firefox and Mozilla Thunderbird . The flaw was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . No specific root cause or e...

CVE-2026-74966

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74976

The JavaScript Engine: JIT component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a JIT miscompilation flaw (CVE-2026-74976). This issue is addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While sever...

CVE-2026-84131

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by an invalid pointer within the Graphics component . This security issue could potentially allow for the execution of arbitrary code or other unauthorized actions. Remediation is available in the followin...

CVE-2026-8953

A sandbox escape vulnerability exists in the Disability Access APIs component due to a use-after-free condition. This flaw affects the Firefox web browser (including Firefox ESR ) and the Thunderbird email client. Exploitation of this vulnerability could allow an attacker to escape the sandbox en...

CVE-2005-0578

CVE-2005-0578 affects Firefox up to 1.0.0 and Mozilla Suite up to 1.7.5, where a predictable plugin temporary directory filename enables local users to delete arbitrary files via a symlink attack on plugtmp. Root cause: insecure naming of the plugtmp directory. Impact: local privilege/unauthorize...

CVE-2007-0778

CVE-2007-0778 affects Mozilla Firefox (and related Gecko-based browsers like SeaMonkey) prior to 1.5.0.10 / 2.x before 2.0.0.2, and SeaMonkey before 1.0.8. The vulnerability stems from the page cache implementation, where hash collisions can cause page data to be appended to the wrong cache entry...

CVE-2007-0896

CVE-2007-0896 affects Sage before 1.3.10 and Sage++ extensions for Firefox. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via a <SCRIPT/=''SRC=' sequence in an RSS feed. Supported sources classify the issue as active hist...

CVE-2007-1092

CVE-2007-1092 affects Mozilla Firefox 1.5.0.9 and 2.0.0.1 and SeaMonkey before 1.0.8. The issue stems from JavaScript onUnload handlers that can modify the document structure, causing memory corruption due to the absence of a finalize hook on DOM window objects, enabling remote code execution. Re...

CVE-2007-2868

This CVE-2007-2868 entry concerns memory corruption in the JavaScript engine of Mozilla-derived products. Affected software includes Mozilla Firefox 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, Thunderbird 1.5.x up to 1.5.0.12 and 2.x up to 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. Exploitation coul...

CVE-2008-3198

CVE-2008-3198 affects Mozilla Firefox 3.x prior to 3.0.1, enabling remote script injection into a chrome document (e.g., via a XUL error page). The vulnerability is potentiated by CVE-2008-2933, and some advisories indicate upgrading Firefox to 3.0.1 to address the issue. Connected sources (e.g.,...

CVE-2008-5505

CVE-2008-5505 affects Mozilla Firefox 3.x prior to 3.0.5 via the persist attribute in XUL, which can bypass privacy restrictions and allow cookie-like data to be stored and accessed. The issue is confirmed in multiple advisories referencing Firefox 3.0.5 as the fix. Remediation: upgrade Firefox t...

CVE-2009-2479

Technical details for CVE-2009-2479 are not publicly available in the provided documents. Monitor for updates.

CVE-2009-2975

CVE-2009-2975 concerns Mozilla Firefox 3.5.2 on Windows XP where, in situations involving an incompletely configured protocol handler, the browser does not properly enforce document.location values for protocols linked to external applications. This can enable a remote attacker to trigger a denia...

CVE-2009-4102

The CVE-2009-4102 entry concerns the Sage Firefox extension (1.4.3 and earlier) which processes feed descriptions with chrome privileges, enabling remote command execution and cross-domain scripting via crafted RSS/Atom feeds. Affected versions include Sage prior to 1.4.6; Debian’s advisory and J...

CVE-2011-0076

CVE-2011-0076 affects the Java Embedding Plugin (JEP) in Mac OS X builds of Firefox (before 3.5.19 and Firefox 3.6.x before 3.6.17) and SeaMonkey (before 2.0.14). The MFSA advisory indicates this could be exploited to obtain elevated access to a user’s resources. Open discussions in connected doc...

CVE-2016-1972

CVE-2016-1972 concerns Mozilla Firefox on Windows with a race condition in libvpx that could lead to a denial of service (use-after-free) or other unspecified impact via unknown vectors. The connected documents confirm the vulnerability is tied to WebRTC/LibVPX code and affected Firefox versions ...

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions

CVE-2017-7763

CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...

CVE-2021-4221

CVE-2021-4221 : Affects Firefox for Android. If a domain name contains a RTL (Right-to-Left) character, the domain could render to the right of the path, enabling user confusion and spoofing. The vulnerability is limited to Firefox for Android; other OSes are unaffected. The advisory notes Firefo...

CVE-2025-10527

A sandbox escape vulnerability exists in the Graphics: Canvas2D component of Mozilla products due to a use-after-free condition. This flaw could allow an attacker to execute arbitrary code remotely or cause a denial of service. The vulnerability affects Firefox versions earlier than 143, Firefox ...

CVE-2025-10536

An information disclosure vulnerability exists in the Networking: Cache component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is an error within the cache component that could allow an attacker to obtain sensitive information. This vulnerability affects...

CVE-2026-12326

The Firefox web browser and Thunderbird email client (versions 151) are affected by memory safety bugs involving operations that go beyond buffer boundaries in memory. These vulnerabilities can result in memory corruption , which could potentially be exploited by a remote attacker to achieve arbi...