CVE-2026-74966

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74976

The JavaScript Engine: JIT component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a JIT miscompilation flaw (CVE-2026-74976). This issue is addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While sever...

CVE-2026-84131

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by an invalid pointer within the Graphics component . This security issue could potentially allow for the execution of arbitrary code or other unauthorized actions. Remediation is available in the followin...

CVE-2004-0757

CVE-2004-0757 describes a heap-based buffer overflow in the POP3 SendUidl capability of Mozilla < 1.7, Firefox < 0.9, and Thunderbird

CVE-2005-1476

Mozilla Firefox 1.0.3 is affected by CVE-2005-1476, where remote attackers can trigger arbitrary JavaScript execution in other domains via an IFRAME and a crafted javascript: URL, with potential arbitrary code execution when combined with CVE-2005-1477. The Linked advisories describe an IFRAME–ba...

CVE-2006-2785

CVE-2006-2785 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox prior to 1.5.0.4. An attacker could trick a user into viewing a broken image or a frame with a Javascript URL, enabling user-assisted remote script/HTML injection. The vulnerability affects Firefox Windows/Linux/macOS ...

CVE-2008-1241

CVE-2008-1241 describes a GUI overlay vulnerability in Mozilla Firefox up to 2.0.0.13 and SeaMonkey up to 1.1.9. A borderless XUL pop-up window opened from a background tab could spoof form elements and redirect user inputs, exposing users to UI manipulation. The issue is tied to how the browser ...

CVE-2008-5052

Mozilla Firefox 2.x (pre-2.0.0.18), Thunderbird 2.x (pre-2.0.0.18), and SeaMonkey 1.x (pre-1.1.13) are affected by CVE-2008-5052. The vulnerability arises in AppendAttributeValue in the JavaScript engine and is described as memory corruption that can cause a remote crash (Denial of Service) via u...

CVE-2010-0183

CVE-2010-0183 is a use-after-free in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5. The issue is in nsCycleCollector::MarkRoots and is triggered by crafting an HTML document via improper frame construction for menus, allowing remote code execution. Affected products include Firef...

CVE-2010-1212

CVE-2010-1212 affects Mozilla Firefox 3.6.x (before 3.6.7) and Thunderbird 3.1.x (before 3.1.1). The issue arises from memory-safety defects in the browser engine’s tracing/recording paths, specifically in TraceRecorder::record_JSOP_BINDNAME, depth handling in TraceRecorder::record_JSOP_GETELEM, ...

CVE-2011-2980

CVE-2011-2980 is described as a binary planting vulnerability in ThinkPadSensor::Startup that could be exploited to load a malicious DLL into the running Firefox/Thunderbird process. The issue is documented as a potential local attack vector requiring write access to an unspecified directory to p...

CVE-2013-1706

CVE-2013-1706 is a stack-based buffer overflow in the Mozilla Maintenance Service (maintenanceservice.exe) used by Mozilla Firefox/Thunderbird. Affects Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8. The root cause is...

CVE-2015-7221

CVE-2015-7221 corresponds to a buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp within Mozilla Firefox before 43.0. Mageia’s advisory MGASA-2016-0124 lists this CVE among a set of Firefox vulnerabilities resolved by updating to Firefox 43.0 and Firefox ESR 38.x, and...

CVE-2017-7767

CVE-2017-7767 involves privilege escalation and arbitrary file overwrites via the Mozilla Windows Updater and Mozilla Maintenance Service on Windows. Affected products are Firefox ESR versions older than 52.2 and Firefox versions older than 54. The root cause is the update/maintenance components ...

CVE-2023-37456

Summary of CVE-2023-37456 (Firefox for iOS) : The issue is a crash in the session restore helper when no parameter is sent to the message handler, affecting Firefox for iOS versions prior to 115. Per connected documents, this creates a denial-of-service risk that can be triggered remotely. The ro...

CVE-2025-10536

An information disclosure vulnerability exists in the Networking: Cache component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is an error within the cache component that could allow an attacker to obtain sensitive information. This vulnerability affects...

CVE-2025-8044

Mozilla Firefox and Thunderbird (specifically versions 140 and Firefox ESR ) are affected by memory safety bugs. These vulnerabilities stem from memory corruption issues where operations are executed outside of the buffer in memory. A malicious actor could exploit these flaws to cause service int...

CVE-2026-12326

The Firefox web browser and Thunderbird email client (versions 151) are affected by memory safety bugs involving operations that go beyond buffer boundaries in memory. These vulnerabilities can result in memory corruption , which could potentially be exploited by a remote attacker to achieve arbi...

CVE-2026-4722

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the IPC component caused by context privilege switching errors. An attacker could exploit this flaw to achieve arbitrary code execution or cause a denial of service (service interruption). The vulnerability ha...

CVE-2026-74984

Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2004-0905

CVE-2004-0905 affects Mozilla Firefox (before the Preview Release), Mozilla (before 1.7.3), and Thunderbird (before 0.8). The issue enables remote attackers to perform cross-domain scripting and potentially execute arbitrary code by convincing a user to drag and drop javascript: links to a frame ...

CVE-2005-0231

Firefox 1.0 is affected by CVE-2005-0231 where dragging a javascript: or data: URL to a tab can bypass the Javascript Security Manager (firetabbing). The issue is described as bypassing the security model, enabling potential remote information disclosure or execution channels. Public references a...

CVE-2011-2670

CVE-2011-2670 affects Mozilla Firefox prior to 3.6. The vulnerability arises in the rendering of Cascading Style Sheets (CSS), enabling cross-site scripting (XSS). The impact per sources is arbitrary script execution in the affected browser. Affected product/version: Firefox

CVE-2011-2997

CVE-2011-2997 affects Mozilla Firefox (browser engine) versions on Windows/Linux/macOS as Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root cause: memory corruption in the browser engine that can cause denial of service or potentially allow arbitrary code execution via unknown vec...

CVE-2013-0777

CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...

CVE-2016-1931

CVE-2016-1931 affects Mozilla Firefox before 44.0. The description cites memory safety hazards in the browser engine, including memory corruption and potential arbitrary code execution via Brotli data compression and related vectors, leading to remote denial of service or crash. Publicly document...

CVE-2017-7755

CVE-2017-7755 affects Mozilla Firefox and Thunderbird installers on Windows. The Firefox installer can be made to load malicious DLLs stored in the same directory as the installer, enabling privilege escalation when the installer runs with elevated privileges. Affected products/versions include F...

CVE-2025-23108

The Firefox iOS client is vulnerable to a flaw where opening Javascript links in a new tab via a long-press allows a malicious script to spoof the URL of the new tab. This issue specifically affects versions prior to Firefox for iOS 134 . Attackers can also leverage long hostnames in URLs to obsc...

CVE-2026-0877

A mitigation bypass vulnerability exists in the DOM: Security component of several Mozilla products. This flaw allows an attacker to remotely circumvent existing security restrictions due to a weakness in data protection mechanisms. The issue affects Mozilla Firefox (versions prior to 147), Firef...

CVE-2026-12329

A memory safety bug was identified and fixed in Mozilla Thunderbird ESR 140.12 and Firefox ESR 140.12 . The vulnerability could potentially lead to arbitrary code execution if exploited. Remediation is provided via updated packages, such as thunderbird-140.12.0-1.amzn2.0.1 for Amazon Linux 2, and...

CVE-2026-16386

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-6782

The Firefox web browser and Thunderbird email client are susceptible to an information disclosure vulnerability in the IP Protection component . This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploitat...

CVE-2026-74942

A privilege escalation vulnerability exists in the Remote Settings Client component of the Firefox browser and Thunderbird mail client. The vulnerability affects multiple versions and has been addressed in Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154...

CVE-2026-84124

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird software. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The vulnerability has been addressed in the following versions: Firefo...

CVE-2026-9308

Firefox for iOS is vulnerable to arbitrary JavaScript execution within the Reader View due to an incorrect HTML replacement order. The application incorrectly replaces page content in its HTML template before processing other internal placeholders. This flaw allows a malicious page to include a p...

CVE-2005-0146

CVE-2005-0146 affects Firefox up to 1.0 and Mozilla up to 1.7.5, where Javascript-generated middle-click events can cause a clipboard data leak on systems that paste on middle-click. This is evidenced by multiple advisories (e.g., RHSA-2005:335/094) describing Mozilla security updates and fixes f...

CVE-2005-0588

CVE-2005-0588 affects Firefox <=1.0.0.1 and Mozilla

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2005-0592

CVE-2005-0592 describes a heap-based buffer overflow in the UTF8ToNewUnicode function affecting Firefox before 1.0.1 and Mozilla before 1.7.6. The flaw can be triggered by invalid UTF-8 sequences that yield a zero length value, potentially allowing a remote attacker to crash the browser or execut...

CVE-2005-2264

CVE-2005-2264 affects Firefox prior to 1.0.5, allowing a remote attacker to steal data by guiding a user to open a malicious link in the browser’s sidebar via the _search target and then inject script into other pages using a data: URL. The connected documents corroborate Firefox involvement and ...

CVE-2006-0295

CVE-2006-0295 affects Mozilla Firefox 1.5, Thunderbird 1.5 (when JavaScript is enabled in mail), and SeaMonkey older than 1.0. The vulnerability is a memory corruption caused by the QueryInterface method on built-in Location and Navigator objects, enabling remote code execution. Public references...

CVE-2006-1726

Technical details (affected product/versions, root cause, impact, remediation) for CVE-2006-1726 are not publicly provided in the supplied documents. Monitor for updates from vendors/security advisories.

CVE-2009-1597

Summary : CVE-2009-1597 affects Mozilla Firefox. What’s affected : Firefox’s handling of a javascript: URI in the target attribute of a submit element within a form embedded in a PDF, potentially bypassing Adobe Acrobat JavaScript restrictions. Root cause / vector : DOM calls triggered by the jav...

CVE-2009-2535

CVE-2009-2535 affects Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird, enabling remote attackers to trigger memory consumption and a crash (DoS) by supplying a large integer as the length property of a Select element. Root cause and exploit details are not expande...

CVE-2009-3381

CVE-2009-3381 affects Mozilla Firefox 3.5.x prior to 3.5.4. The Mozilla Firefox browser engine vulnerabilities enable remote attackers to cause memory corruption and an application crash, with the possibility of arbitrary code execution. The issue is discussed in conjunction with MFSA 2009-64 and...

CVE-2012-1971

CVE-2012-1971 concerns Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The description identifies memory corruption and potential remote code execution or crashes related to garbage collection after certain MethodJIT execution, plus other unspecified vectors. Impact ...

CVE-2013-0797

CVE-2013-0797 affects Mozilla Updater components in Mozilla Firefox (pre-20.0), Firefox ESR (<17.0.5), Thunderbird (<17.0.5, ESR), and SeaMonkey (

CVE-2014-1586

CVE-2014-1586 affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The issue is that the code path in content/base/src/nsDocument.cpp does not consider whether WebRTC video sharing is occurring, allowing a remote attacker to obtain sensitive informa...

CVE-2015-7179

The CVE-2015-7179 entry is confirmed public with concrete details: The flaw occurs in ANGLE’s libGLES used by Mozilla Firefox on Windows, in VertexBufferInterface::reserveVertexSpace. It allocates memory for shader attribute arrays incorrectly, enabling remote attackers to run arbitrary code or c...

CVE-2017-7765

CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird