CVE-2007-4013

CVE-2007-4013 covers multiple unspecified vulnerabilities in Net6Helper.DLL (Net6Launcher Class, 4.5.2 and earlier) and in npCtxCAO.dll (Citrix Endpoint Analysis Client) in a Firefox plugin directory, plus a second npCtxCAO.dll (CAAOControl Object) in Citrix Access Gateway Standard Edition before...

CVE-2009-0253

Firefox 3.0.5 is vulnerable to a status bar spoofing/clickjacking attack where an onclick action moves a crafted element to the current mouse position to trick the user into visiting an arbitrary URL. This is remote, with public exploit references available (e.g., Exploit-DB). No remediation deta...

CVE-2009-2044

CVE-2009-2044 affects Mozilla Firefox 3.0.10 and earlier on Linux. The vulnerability allows a remote attacker to crash the browser by using a crafted URI for a large GIF image in the BACKGROUND attribute of a BODY element, causing a denial of service. The issue is documented with a published low–...

CVE-2009-2061

CVE-2009-2061 affects Mozilla Firefox prior to 3.0.10. The vulnerability allows a man-in-the-middle to modify the 3xx HTTP CONNECT response before SSL handshake, enabling a 302 redirect to an arbitrary HTTPS site and potential arbitrary script execution in the context of an HTTPS page. The issue ...

CVE-2009-3007

CVE-2009-3007 affects Mozilla Firefox 3.5.1, SeaMonkey 1.1.17, and Flock 2.5.1, enabling context-dependent attackers to spoof the address bar via window.open with a relative URI to reveal an arbitrary file: URL after the user navigates to a file: URL. The connected documents corroborate a family ...

CVE-2009-3378

The CVE-2009-3378 entry concerns the oggplay_data_handle_theora_frame function in liboggplay (used by Mozilla Firefox 3.5.x). The vulnerability arises when a decoding error for the first frame occurs, causing the code to reuse an earlier frame data structure. This can allow a remote attacker to t...

CVE-2010-0166

CVE-2010-0166 affects Mozilla Firefox 3.6 before 3.6.2 on macOS, due to a flaw in gfxTextRun::SanitizeGlyphRuns in gfx/thebes/src/gfxFont.cpp. The Core Text path mishandles deletions of certain invisible Unicode characters (notably U+FEFF, U+FFF9, U+FFFA, U+FFFB), enabling memory corruption that ...

CVE-2011-1300

The CVE-2011-1300 entry affects ANGLE’s WebGLES library (libGLESv2.dll) used by Mozilla Firefox 4.x on Windows and by Chrome’s GPU process, due to an off-by-three error in Program::getActiveUniformMaxLength. This allows remote code execution via unspecified vectors. Public sources indicate Chrome...

CVE-2026-4684

CVE-2026-4684 describes a race condition leading to a use-after-free in the Graphics: WebRender component. Affected products/versions are Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2006-2332

CVE-2006-2332 concerns Mozilla Firefox 1.5.0.3. Affected software: Firefox 1.5.0.3. Vulnerable component: HTML rendering of IMG elements where the SRC attribute is a mailto: URI. Root cause: processing a web page containing a large number of such IMG elements can trigger denial of service, with r...

CVE-2007-2176

CVE-2007-2176 affects Mozilla Firefox with an unspecified vulnerability involving Javascript errors that allows remote code execution. The NVD entry reports a CVSS v2 base score of 10.0 (High) with network attack vector and near-total impact (Confidentiality, Integrity, Availability). The descrip...

CVE-2009-4129

Technical details about CVE-2009-4129 are not publicly provided in the supplied documents. No concrete information on affected products, versions, impact, or fixes is present here. Monitor for updates from official advisories and vulnerability feeds.

CVE-2011-2987

The connected documents confirm CVE-2011-2987 is a heap overflow in the ANGLE library used by Mozilla’s WebGL implementation (Firefox/SeaMonkey/related) that could allow remote code execution. The issue is tied to the ANGLE heap overflow in WebGL code paths; exploitation would be via remote attac...

CVE-2011-2991

CVE-2011-2991 affects the Mozilla browser engine in Firefox 4.x–5, SeaMonkey 2.x prior to 2.3, and Thunderbird prior to 6. The issue arises from improper JavaScript handling, enabling remote attackers to trigger memory corruption and cause a crash, with potential arbitrary code execution via unsp...

CVE-2011-3652

CVE-2011-3652 affects Mozilla Firefox and Thunderbird prior to version 8.0 due to a browser engine memory allocation bug. This can cause memory corruption and application crashes, with potential for remote arbitrary code execution via unspecified vectors. Remediation is to upgrade to Firefox/Thun...

CVE-2011-3653

CVE-2011-3653 affects Mozilla Firefox < 8.0 and Thunderbird

CVE-2013-0790

CVE-2013-0790 affects Mozilla Firefox for Android prior to 20.0. It stems from a browser-engine memory-safety vulnerability that could lead to a denial of service or remote code execution via an unspecified plug-in path. The linked MFSA advisory group (MFSA 2013-30/31/32…/40) confirms memory-safe...

CVE-2013-5594

CVE-2013-5594 affects Mozilla Firefox prior to version 25. The issue allows modification of anonymous content in the binding of pluginProblem.xml, indicating an integrity-related vulnerability with no confidentiality or availability impact stated in the provided documents; exploitation details ar...

CVE-2014-8632

CVE-2014-8632 affects Mozilla Firefox (before 34.0) and SeaMonkey (before 2.31). The issue is in the structured-clone implementation where interactions with XrayWrapper property filtering do not properly enforce restrictions, allowing a remote attacker to bypass intended DOM object restrictions b...

CVE-2026-12324

CVE-2026-12324 concerns an issue in the Graphics: CanvasWebGL component caused by incorrect boundary conditions. Public sources indicate the vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The available documents do not provide exploit vectors ...

CVE-2026-8949

CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...

CVE-2004-1200

CVE-2004-1200 affects Firefox and Mozilla browsers. The vulnerability allows remote attackers to trigger high memory usage via JavaScript that repeatedly creates and sorts nested arrays, causing an application crash (DoS). The NVD entry documents a network-exposed scenario with a partial availabi...

CVE-2005-2395

Affected software: Mozilla Firefox 1.0.4 and 1.0.5. Vulnerability type / cause: Firefox may not select the strongest available HTTP authentication challenge as required by RFC2617, potentially causing credentials to be sent in plaintext even when an encrypted channel exists. Impact (as stated): c...

CVE-2006-5160

Technical details about CVE-2006-5160 are not publicly provided in the supplied documents; the records cite unspecified vulnerabilities in Mozilla Firefox with dispute from vendor/researchers. Monitor for updates.

CVE-2006-5633

Summary: CVE-2006-5633 affects Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b. The issue is a denial of service caused by a null dereference when constructing a range, calling selectNode on a DOCUMENT_TYPE_NODE, and then invoking createContextualFragment on that range. This chain triggers a crash. T...

CVE-2006-6971

Mozilla Firefox 2.0 (Windows) vulnerability: phishing-protection can be bypassed by representing an IP address in formats such as dotted-hex, dotted-octal, decimal, hex, or octal, which evade the blacklist filter. Root cause is parsing/format handling that fails to normalize these IP representati...

CVE-2007-1970

CVE-2007-1970 involves Mozilla Firefox where dynamic HTTP elements created on HTTPS pages via a delayed document.write can mislead users and enable phishing content to be served from unauthenticated sources. The vulnerability is described with a moderate base score (CVSS v2.0 base 5.0) and relate...

CVE-2009-2468

CVE-2009-2468 text describes an integer overflow in Apple CoreGraphics used by Safari/Firefox/macOS, allowing DoS or possible code execution via a long text run during font glyph rendering, related to CVE-2009-1194. Connected documents primarily provide details on CVE-2009-1194 affecting Pango: i...

CVE-2009-2478

CVE-2009-2478 affects Mozilla Firefox 3.5 and can cause a remote denial of service via a NULL pointer dereference related to a “flash bug.” The initial description specifies remote vectors but no concrete exploit details. Connected Fedora/OpenVAS entries confirm the issue is tied to Firefox 3.5 e...

CVE-2009-3012

The CVE-2009-3012 entry affects Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre. The vulnerability arises because Firefox does not properly block data: URIs in Location headers in HTTP responses, enabling remote XSS via two vectors: (1) a Location header containing a data:text...

CVE-2011-1712

CVE-2011-1712 affects Mozilla Firefox (pre-3.5.19, pre-3.6.17, pre-4.0.1) and SeaMonkey (pre-2.0.14); the vulnerability is triggered by a crafted XML document calling the XSLT generate-id function in txMozillaXPathTreeWalker.cpp and txStandaloneXPathTreeWalker.cpp, which can allow remote attacker...

CVE-2012-1943

CVE-2012-1943 involves an untrusted search path vulnerability in Updater.exe of the Mozilla Updater Service on Windows, affecting Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9. The issue allows local privilege escalation through loading a Trojan horse wsock32.dll located in an application dir...

CVE-2013-6167

The CVE-2013-6167 issue affects Mozilla Firefox before version 28 (reported as Firefox through 27) where HTTP Cookie headers are sent without validating required character-set restrictions. The root cause is improper handling/validation of cookie character sets, enabling attackers to craft a para...

CVE-2020-15651

The CVE-2020-15651 issue affects Firefox for iOS prior to 28. A Unicode RTL order character in the downloaded file name can be used in the download UI flow to rename the file and change its extension. Connected sources confirm the vulnerability and indicate Mozilla fixed it in Firefox iOS 28 (MFS...

CVE-2025-10536

Mode C: CVE-2025-10536 is an Information disclosure in the Networking: Cache component affecting Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird

CVE-2025-8044

CVE-2025-8044 corresponds to memory safety bugs found in Firefox 140 and Thunderbird 140, with memory corruption evidence and a potential to allow arbitrary code execution. Affected products are Firefox and Thunderbird versions earlier than 141. The consolidated sources indicate the issues are me...

CVE-2026-12299

CVE-2026-12299 is a JIT miscompilation vulnerability in the DOM: Core & HTML component that affects Firefox and Thunderbird products. The issue is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/...

CVE-2026-16365

CVE-2026-16365 affects the DOM: Workers component. The vulnerability is fixed in Firefox 153 and Thunderbird 153. The available data include a CVSS v3.1 base score of 8.8 (HIGH) with network attack vector, low attack complexity, no privileges required, user interaction required, and total impact ...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-8391

CVE-2026-8391 is a Mozilla Firefox JavaScript Engine issue categorized as an “Other issue in the JavaScript Engine component.” The CVE entry states fixes in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. Connected advisories reiterate this CVE among Firefox JS En...

CVE-2026-8945

CVE-2026-8945 is described across multiple sources as a sandbox escape in Firefox and Firefox Focus for Android, with the vulnerability fixed in Firefox 151. The connected documents confirm the issue affected Firefox on Android devices and state the fix is part of Firefox 151 releases. The exact ...

CVE-2005-3089

Summary of CVE-2005-3089: Firefox 1.0.6 is affected by a denial-of-service condition caused by a Proxy Auto-Config (PAC) script that uses an eval statement. The issue is specifically tied to Firefox 1.0.6 and may depend on whether an untrusted party triggers it; in the provided materials, this un...

CVE-2005-4720

The CVE-2005-4720 entry affects Mozilla Firefox 1.0.7 and earlier on Linux. The issue is triggered by an IFRAME element with a very large WIDTH value, which exposes a bug in floating-point number representation that can cause an infinite loop of widget resizes and an excessive number of function ...

CVE-2007-1004

CVE-2007-1004 concerns Mozilla Firefox and describes a spoofing/phishing issue: remote attackers could write to an about:blank tab and overlay the location bar, enabling deceptive UI to mislead users. The available connected sources corroborate that Firefox is the affected product and the vulnera...

CVE-2015-7327

Technical details about CVE-2015-7327 are not publicly available in the provided connected documents. The initial description provides context but lacks specific vendor/product/version/root cause/impact. Monitor for updates and forthcoming advisories.

CVE-2026-0877

CVE-2026-0877 is a mitigation bypass in the DOM: Security component, affecting Firefox versions below 147, including Firefox ESR <115.32 and ESR

CVE-2026-16381

CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-8953

CVE-2026-8953 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. Affected products include Firefox (fixed in Firefox 151) and Firefox ESR (115.36, 140.11), as well as Thunderbird (151, 140.11). The public records indicate a memory-unsafe defect in the D...

CVE-2026-8954

CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...