CVE-2011-3003

CVE-2011-3003 affects Mozilla Firefox < 7.0 and SeaMonkey

CVE-2011-3671

The CVE-2011-3671 entry describes a use-after-free vulnerability in Mozilla’s nsHTMLSelectElement.cpp (nsHTMLSelectElement) affecting Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey

CVE-2014-1501

Mozilla Firefox for Android is affected (before 28.0). The issue allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via the Open Link in New Tab action, enabling local file access from web content. The root cause is a Same Origin Policy bypass in the Android ...

CVE-2025-9183

CVE-2025-9183 describes a spoofing vulnerability in Firefox and Firefox ESR, caused by a flaw in the Address Bar component that can enable spoofing. Affected versions are Firefox < 142 and Firefox ESR

CVE-2026-12290

A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...

CVE-2026-12296

CVE-2026-12296 describes a sandbox escape in the Security: Process Sandboxing component. Affected products include Mozilla Firefox and Firefox ESR, and Mozilla Thunderbird with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The description does not ...

CVE-2026-16361

CVE-2026-16361 affects Firefox ESR 115.37 and 140.12, described as memory safety bugs with evidence of memory corruption. The advisory notes these could have been exploited to run arbitrary code, and fixes are applied in Firefox ESR 115.38 and 140.13. Affected components/roots are not detailed be...

CVE-2004-2657

Mozilla Firefox 1.5.0.1 (and possibly other versions) has a vulnerability where user activity records persist after uninstall, allowing local users sharing a Windows profile to view these records after a new Firefox installation (notably the Passwords Never Saved list). The vendor disputes the is...

CVE-2005-0147

CVE-2005-0147 affects Firefox before 1.0 and Mozilla before 1.7.5 when configured to use a proxy, enabling a remote attacker to steal NTLM or SPNEGO credentials by eliciting 407 proxy authentication requests. The issue is caused by the browser’s handling of proxy auth prompts, allowing credential...

CVE-2006-2613

CVE-2006-2613 affects Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before 1.8.0, as well as Netscape 7.2 and 8.1. A remote user‑assisted attacker can cause exceptions to be thrown and inspect message contents to obtain information such as the installation path. The ef...

CVE-2007-2871

CVE-2007-2871 affects Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. The flaw allows remote attackers to spoof or hide the browser chrome (notably the location bar) by placing XUL popups outside the browser’s content pane, which can be leveraged for p...

CVE-2007-5045

CVE-2007-5045 describes an argument injection in Apple QuickTime 7.1.5 and earlier when used with Mozilla Firefox

CVE-2010-1988

Technical details for CVE-2010-1988 are not provided in the connected documents. Public information in the Initial Description covers Firefox 3.6.3 on Windows XP SP3 but no additional technical specifics, vulnerable components, impact, or fixes are included here.

CVE-2010-3399

Technical details for CVE-2010-3399 are not publicly available in the provided documents; no concrete product/version/impact information is given here. Monitor for updates.

CVE-2013-1689

Mozilla Firefox is affected by CVE-2013-1689 through a denial-of-service crash related to event handling with frames. Concrete details in connected material show the vulnerability impacts Firefox 20.0a1 and earlier, with a fix released in Firefox 22. Remediation: upgrade to Firefox 22 or newer. T...

CVE-2014-1584

Mozilla Firefox prior to 33.0 is affected by CVE-2014-1584 through its Public Key Pinning (PKP) implementation. If an issuer-verification error occurs, pinning checks may be skipped, enabling a remote attacker to bypass the configured pin and potentially spoof a site by presenting a crafted certi...

CVE-2016-1948

Mozilla Firefox for Android before 44.0 is vulnerable to MITM during lightweight-theme installation because it may not require HTTPS for the client-server data stream, allowing an attacker to replace theme images/colors. Connected advisories indicate this is a real vulnerability affecting Firefox...

CVE-2016-2826

The CVE-2016-2826 issue affects Mozilla Firefox on Windows prior to 47.0 and Firefox ESR before 45.2/45.x, where the maintenance/updater service does not prevent MAR-extracted file modification, enabling local privilege escalation via a Trojan horse file. Affected component: the updater’s MAR han...

CVE-2021-43533

CVE-2021-43533 affects Firefox versions prior to 94. Root cause: during internationalized domain name parsing, high bits of URL characters could be stripped, causing display/inconsistency that could enable phishing or user confusion. Impact: user interaction required; potential phishing risk due ...

CVE-2026-16391

Information disclosure in Firefox’s Storage: IndexedDB component (CVE-2026-16391) is addressed in Firefox 153 and Firefox ESR 140.13. The CVSSv3.1 vector indicates an unaltered scope, network attack vector, high confidentiality impact with no impact to integrity/availability, and no user interact...

CVE-2026-6763

CVE-2026-6763 is a mitigation bypass in the File Handling component that was fixed in Firefox 150 and Firefox ESR 140.10, and in Thunderbird 150 and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:15892, ALSA-2… etc.) corroborate that Thunderbird/firefo...

CVE-2004-0762

CVE-2004-0762 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. An attacker could lure a remote web site to trigger interaction events to manipulate the XPInstall Security dialog, allowing installation of arbitrary extensions. The vulnerability is documented with a high ...

CVE-2005-0150

CVE-2005-0150 affects Mozilla Firefox versions prior to 1.0. The bug allows storing javascript: or data: Livefeed bookmarks that are later executed in the context of the current page, enabling remote attackers to potentially run arbitrary code. Public descriptions consistently state Firefox pre-1...

CVE-2006-0298

CVE-2006-0298 affects Mozilla Firefox < 1.5.0.1 and SeaMonkey

CVE-2006-0299

CVE-2006-0299 affects Mozilla Firefox up to 1.5.0.1, Thunderbird 1.5 (when JavaScript runs in mail), and SeaMonkey before 1.0. The issue arises from the E4X implementation exposing the internal AnyName object to external interfaces, allowing multiple cooperating domains to exchange information an...

CVE-2007-2162

The CVE-2007-2162 entry affects Mozilla Firefox 2.0.0.3 and GNU IceWeasel 2.0.0.3. It describes a remote-denial-of-service impact where an attacker can cause a browser crash or system hang by sending JavaScript that matches a long string against the regular expression /(.)*/. The description cite...

CVE-2007-6589

CVE-2007-6589 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7. The jar protocol handler fails to update the origin when an inner URL parameter yields an HTTP redirect, enabling remote XSS via a jar: URI. No exploitation details are provided in the documents. Remediation: upgrad...

CVE-2009-2043

CVE-2009-2043 affects Mozilla Firefox 3.0.2–3.0.10, where interaction with TinyMCE can trigger a NULL pointer dereference leading to a crash (remote DoS). Connected advisories (Mandriva, CentOS, OpenVAS/GLSA) corroborate Firefox-related vulnerabilities in the same era and reference Firefox 3.x co...

CVE-2009-2065

CVE-2009-2065 (Mozilla Firefox) : Firefox 3.0.10 (and possibly other versions) is vulnerable to a context-mixing flaw where http content can be loaded in an https page when the top-level frame is https. An MITM attacker could modify an http page to include an https iframe that loads a script from...

CVE-2009-3383

The entry CVE-2009-3383 affects Mozilla Firefox 3.5.x prior to 3.5.4, describing memory corruption in the JavaScript engine that could crash the browser or potentially allow arbitrary code execution via unknown vectors. Affected product is Firefox 3.5.x; impact is high (remote code execution or D...

CVE-2010-0220

CVE-2010-0220 affects Mozilla Firefox before 3.5.7, where the nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp can be exploited by a crafted site to cause memory exhaustion and trigger a Low Memory alert, potentially leading to an application crash. The bug also enables r...

CVE-2021-29958

CVE-2021-29958 affects Firefox for iOS prior to 34. The issue occurs when a download starts without verifying if the browser is in normal or private mode, causing private-mode cookies to be exposed in normal browsing. This is a client-side handling flaw in the download flow that can lead to leaka...

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2026-2634

The vulnerability CVE-2026-2634 affects Firefox for iOS . Malicious scripts could cause desynchronization between the address bar and web content before a response is received, allowing attacker‑controlled pages to be displayed under spoofed domains. The vulnerability is stated to be fixed in Fir...

CVE-2026-8959

CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...

CVE-2005-1154

CVE-2005-1154 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. A vulnerable global scope in the browser allows a malicious page to set a variable in the target domain, which is executed when the user visits that domain, enabling remote script execution in the context of the affected s...

CVE-2006-1725

The vulnerability affects Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1. It stems from an interaction between XUL content windows and the history mechanism that can cause certain windows to become translucent, potentially enabling user-assisted remote attackers to trick users into...

CVE-2010-5074

CVE-2010-5074 affects Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability stems from the layout engine comparing visited vs. unvisited links while processing CSS token sequences, causing a timing-based information disclosure. An attacker could rem...

CVE-2011-3665

CVE-2011-3665 affects Mozilla Firefox (4.x–8.0), Thunderbird (5.0–8.0), and SeaMonkey before 2.6. The issue is an improper handling of an Ogg VIDEO element after scaling, which can cause a crash or potentially other impact. Connected advisories corroborate MFSA2011-58 and related fixes across ope...

CVE-2013-1715

CVE-2013-1715 affects Mozilla Firefox on Windows prior to 23.0, where the full and stub installers are vulnerable to DLL hijacking via a Trojan horse DLL placed in the default Downloads directory. Root cause traces to an incomplete fix for CVE-2012-4206. Impact described as local privilege escala...

CVE-2013-5592

CVE-2013-5592 concerns multiple memory-safety vulnerabilities in Mozilla Firefox’s browser engine prior to 25.0. The issues can cause memory corruption and application crashes, possibly enabling remote arbitrary code execution via unspecified vectors. Affected components include Firefox (and rela...

CVE-2014-8635

CVE-2014-8635 is tied to memory-safety hazards in the Mozilla Firefox/SeaMonkey browser engine prior to versions addressing Firefox 35.0 and SeaMonkey 2.32. The public records indicate remote attacker could cause memory corruption or an application crash and potentially execute arbitrary code via...

CVE-2016-1940

CVE-2016-1940 affects Mozilla Firefox on Android (pre-44.0). A data: URL mishandling during shortcut opening or BOOKMARK/intent processing allows remote attackers to spoof the address bar. Affected: Firefox on Android before 44.0. Impact: address-bar spoofing. Mitigation: upgrade to Firefox 44.0 ...

CVE-2017-5452

CVE-2017-5452 affects Firefox for Android prior to version 53. The issue allows a spoofed address bar on a page when the new page’s location bar is scrolled out of view if an HTML editable element is user-selected. Remediation per the advisory is upgrading to Firefox 53 or newer (the fixed versio...

CVE-2025-23108

Summary (CVE-2025-23108) : Affects Firefox for iOS ≤ 134. Opening a JavaScript link in a new tab via long-press could allow a malicious script to spoof the URL shown in the new tab, potentially misleading users. Root cause described as a tab URL spoofing issue in the iOS client. Exploitation deta...

CVE-2026-12311

CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...

CVE-2026-16360

Memory safety bugs found in Mozilla Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152, with evidence of memory corruption and potential remote code execution. The issues were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected product family: Mozilla Firefox ESR (olde...

CVE-2026-8946

The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...

CVE-2002-2437

The CVE-2002-2437 entry describes an information-disclosure flaw in the JavaScript implementation of Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability arises from improper restrictions on the values returned by getComputedStyle, enabling remote ...

CVE-2009-0071

CVE-2009-0071 affects Mozilla Firefox 3.0.5 and earlier 3.0.x (and later noted 3.0.6/3.0.7) where enabling designMode can trigger a denial of service. The vulnerability allows remote attackers to cause a crash via a crafted sequence: an (a) replaceChild or (b) removeChild call, followed by a (1) ...