CVE-2026-16386

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16359

The Audio/Video: GMP component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw can lead to security risks, including potential arbitrary code execution, as indicated by related security advisories. The vulnerability has been addressed in Firefox 153 , Firefox...

CVE-2026-16366

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16370

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2778

CVE-2026-2778: Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. Affected: Firefox (pre-148), Firefox ESR (pre-115.33/140.8); Thunderbird (pre-148, pre-140.8). Fixes: Firefox 148, ESR 115.33/140.8; Thunderbird 148/140.8. Practical impact: sandbox escape potent...

CVE-2026-4692

This CVE (CVE-2026-4692) is a confirmed issue in the Responsive Design Mode component, leading to sandbox escape. The primary affected product is Mozilla Firefox (and related ESR builds) with versions prior to the fixed releases: Firefox 149, Firefox ESR 115.34, and Firefox ESR 140.9; Thunderbird...

CVE-2026-6757

The JavaScript: WebAssembly component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client contains an invalid pointer vulnerability. This flaw relates to an uninitialized pointer , which a malicious actor could exploit to trigger a service failure or service interruptions. The vul...

CVE-2026-74948

A vulnerability in the Graphics component of Mozilla Firefox and Thunderbird leads to information disclosure . This issue has been addressed in several releases, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunde...

CVE-2026-8947

A use-after-free vulnerability exists in the DOM: Bindings (WebIDL) component of the Firefox browser and the Thunderbird email client. This memory safety issue allows a remote attacker to execute arbitrary code . The vulnerability has been addressed in Firefox 151 , Firefox ESR 115.36 , Firefox E...

CVE-2026-8958

A vulnerability in the Security: Process Sandboxing component of Firefox and Thunderbird allows for information disclosure and a sandbox escape . Exploiting this flaw can permit a remote attacker to access confidential data . The issue was addressed in Firefox 151 , Firefox ESR 140.11 , Thunderbi...

CVE-2004-0866

CVE-2004-0866 involves Internet Explorer 6.0. The vulnerability allows websites to set cookies for country‑specific top‑level domains (e.g., .ltd.uk, .plc.uk, .sch.uk), which could enable a remote attacker to perform a session fixation attack and hijack a user’s HTTP session. The provided documen...

CVE-2005-0230

Technical details (affected products/versions/root cause/fixes) are not publicly provided in the connected documents. Monitor for updates.

CVE-2005-0584

CVE-2005-0584 affects Firefox before 1.0.1 and Mozilla before 1.7.6: when the HTTP Authentication dialog is shown, focus is not moved to the prompting tab, enabling possible spoofing or phishing. The provided documents confirm the vulnerability and the affected products/versions. Remediation guid...

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2007-1562

CVE-2007-1562 affects Mozilla Firefox prior to 1.5.0.11 and 2.x prior to 2.0.0.3, where the FTP PASV response could be exploited by a remote server to force the client to connect to an alternate address, enabling proxied port scans or information disclosure. The vulnerability arises from how the ...

CVE-2009-0821

CVE-2009-0821 affects Mozilla Firefox 2.0.0.20 and earlier, where an INPUT element with onclick calling window.print can be nested (window.print(window.print())), leading to a denial of service through an application crash. Public references in the connected records confirm this DoS pattern (prin...

CVE-2012-3105

Affected software: Mozilla Firefox (WebGL glBufferData path) and related Mozilla components (Firefox 4.x–12.0, ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, SeaMonkey before 2.10). Vulnerability and root cause: The description states a flaw in an NVIDIA driver allows remote attackers to trigger m...

CVE-2012-3979

CVE-2012-3979 : The OpenVAS/Nessus entries indicate a vulnerability in Mozilla Firefox for Android where insecure use of __android_log_print can be triggered by a crafted web page using the dump() function, potentially allowing remote code execution. The issue is tied to Firefox for Android speci...

CVE-2013-1683

The CVE-2013-1683 entry concerns Mozilla Firefox before 22.0, where multiple unspecified vulnerabilities in the browser engine can cause memory corruption leading to denial of service or possibly arbitrary code execution. The attached context references MFSA advisories and vendor updates that fix...

CVE-2014-1560

CVE-2014-1560 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. The issue is in parsing X.509 certificates: a crafted certificate that does not use ASCII character encoding in a required context can trigger a denial of service. The vulnerability is triggered during certificate pars...

CVE-2014-1588

CVE-2014-1588 affects Mozilla Firefox (before 34.0) and SeaMonkey (before 2.31). The underlying issue is memory safety bugs in the browser engine that could be exploited remotely to cause memory corruption, a denial of service, or potentially arbitrary code execution via unspecified vectors. Publ...

CVE-2015-2714

CVE-2015-2714 affects Mozilla Firefox on Android prior to 38.0. The vulnerability arises from not properly restricting writing URL data to the Android logging system, enabling a local attacker with READ_LOGS permission to obtain sensitive information via a crafted app (e.g., exploiting Android 4....

CVE-2016-1943

Consolidated details show CVE-2016-1943 affects Mozilla Firefox on Android, where the address bar can be spoofed via the scrollTo method. OpenSUSE release notes (openSUSE-2016-128/0306-1/0309) document Firefox 44.0 and NSS/NSPR updates as fixes, explicitly listing CVE-2016-1943 as part of address...

CVE-2017-5471

Summary (CVE-2017-5471): Firefox

CVE-2025-10533

An integer overflow vulnerability exists in the SVG component of Mozilla Firefox , Firefox ESR , and Thunderbird . This flaw allows an attacker to potentially achieve remote code execution or cause a denial of service on the affected system. The vulnerability has been addressed in Firefox 143 , F...

CVE-2026-0884

A use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox , Firefox ESR , and Thunderbird . An attacker could exploit this flaw to execute arbitrary code on a system or cause service interruptions . The issue was resolved in Firefox 147 , Firefox ESR 140.7 , Thun...

CVE-2026-12314

A memory safety bug was identified and fixed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause for CVE-2026-12314 is not detailed beyond its classification as a memory safety issue, several connected documents indicate that si...

CVE-2026-16353

The Firefox browser and Thunderbird mail client are affected by a vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component. This flaw could lead to multiple security consequences, including the potential execution of arbitrary code , privilege escalation , information di...

CVE-2026-16400

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16408

Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2792

CVE-2026-2792 involves memory safety bugs found in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some flaws showed memory corruption indicators and could potentially be exploited to run arbitrary code; Mozilla fixed these in Firefox 148, Firefox ESR 140.8, Thunderbird...

CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...

CVE-2004-0779

The vulnerability affects Mozilla 1.6, Firebird 0.7, and Firefox 0.8, where cached passwords for SSL sites are not properly restricted to SSL sessions. This allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site. Root cause: insufficient verification of SSL-...

CVE-2005-0589

CVE-2005-0589 affects Firefox before 1.0.1. The Form Fill feature can allow remote attackers to steal potentially sensitive information by monitoring values generated by the autocomplete capability. This is described in the NVD entry and echoed by multiple advisories (e.g., RHSA-2005:176, GLSA-20...

CVE-2006-5159

CVE-2006-5159 describes a stack-based buffer overflow in Mozilla Firefox involving JavaScript that could allow remote code execution. The incident has been disputed by the vendor and researchers, with claims that the code demonstrator only caused crashes and resource exhaustion rather than reliab...

CVE-2008-1238

CVE-2008-1238 affects Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9. The vulnerability arises when generating the HTTP Referer header: if the URL contains Basic Authentication credentials without a username, the Referer header may not include the full URL, potentially allowing remote...

CVE-2009-1232

CVE-2009-1232 affects Mozilla Firefox 3.0.x (including 3.0.8 and earlier; 3.0.10 and earlier also affected) where an XML document consisting of a long series of start-tags with no end-tags can trigger a memory corruption in the XUL parser, leading to a denial-of-service (crash). Multiple Red Hat ...

CVE-2011-3866

CVE-2011-3866 affects Mozilla Firefox prior to 7.0 and SeaMonkey prior to 2.4, where motion data events were not properly restricted. The underlying issue is an improper restriction of motion data events, enabling a remote attacker to read keystrokes via JavaScript running in a background tab. Ex...

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2012-4206

CVE-2012-4206 describes an untrusted search path vulnerability in the Windows installers of Mozilla Firefox (pre-17.0) and Firefox ESR (pre-10.0.11). A Trojan horse DLL in the user’s default downloads directory can be loaded, enabling local privilege escalation. The issue is tied to the installer...

CVE-2012-4212

Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.

CVE-2013-0798

CVE-2013-0798 affects Firefox for Android. The issue is that the app_tmp directory used during addon installation is world-writable and world-readable, allowing an attacker to replace or modify addons during the window when they are staged before installation. This is specific to Firefox for Andr...

CVE-2014-1537

CVE-2014-1537 describes a use-after-free in Mozilla Firefox (function mozilla::dom::workers::WorkerPrivateParent) that, in Firefox releases before 30.0, could allow a remote attacker to execute arbitrary code or cause a crash via unspecified vectors (heap corruption). The vulnerability stems from...

CVE-2014-8631

CVE-2014-8631 affects Firefox (before 34.0) and SeaMonkey (before 2.31) where the Chrome Object Wrapper (COW) allows native-interface passing, potentially bypassing DOM object restrictions via an unspecified method. This remote vulnerability could be exploited without user interaction; exploitati...

CVE-2016-2812

CVE-2016-2812 affects Mozilla Firefox prior to 46.0 due to a race condition in the ServiceWorkerManager.get implementation of the Service Worker subsystem. The issue can lead to a buffer overflow and application crash, with the potential for remote code execution or denial of service as described...

CVE-2017-5463

CVE-2017-5463 affects Firefox for Android prior to version 53.0. The issue arises when Android intents can launch Firefox in reader mode with a user-supplied URL, allowing spoofing of the address bar contents shown to users. Public details in the provided sources confirm the affected product (Fir...

CVE-2026-13356

A malicious webpage can exploit a vulnerability in Firefox for iOS by enqueuing a synchronous JavaScript dialog to interrupt a pending navigation. This results in a UI misrepresentation where the address bar displays the destination origin while the browser continues to render attacker-controlled...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-16388

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2760

CVE-2026-2760 is a Firefox/Thunderbird Firefox Graphics: WebRender sandbox escape caused by incorrect boundary conditions. Multiple public advisories confirm the issue and that it is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected comp...