CVE-2007-1084

Affected software: Mozilla Firefox 2.0.0.1 and earlier. Vulnerability: saving a bookmarklet with a data: scheme does not prompt, enabling execution in the context of the last visited page and thereby bypassing the same-domain policy. Root cause: lack of user prompt when saving bookmarklets. Impac...

CVE-2009-1827

CVE-2009-1827 affects Mozilla Firefox 3.0.4 via the SVG component. An attacker can trigger a denial of service (application hang) by sending a large value in the r (Radius) attribute of a circle element, related to an “unclamped loop.” Public sources in the provided documents corroborate a DoS ri...

CVE-2009-3978

The vulnerability CVE-2009-3978 affects Mozilla Firefox up to version 3.5.4 (libpr0n’s nsGIFDecoder2::GifWrite in decoders/gif/nsGIFDecoder2.cpp). An animated GIF with a large image size could trigger a NULL pointer dereference, causing a denial of service (application crash). This is tied to the...

CVE-2010-4508

CVE-2010-4508 affects Mozilla Firefox 4 through 4.0 Beta 7, in the WebSockets implementation. The vulnerability arises from improper handling of proxy upgrade negotiation, tied to an described “inherent problem” with the WebSocket spec. The impact is described as unspecified in the provided sourc...

CVE-2011-2368

The CVE-2011-2368 entry describes a WebGL write restriction flaw in Mozilla Firefox 4.x–4.0.1 that could allow remote code execution or a crash via unspecified vectors. Connected documents corroborate Firefox-focused WebGL/memory issues and reference MFSA2011-26. The OpenVAS/PTSecurity advisories...

CVE-2011-2598

CVE-2011-2598 affects Mozilla Firefox 4.x WebGL implementation. The vulnerability allows remote attackers to obtain screenshots of the windows of arbitrary desktop applications via vectors involving an SVG filter, an IFRAME element, and uninitialized data in graphics memory. Connected sources con...

CVE-2011-2668

Mozilla Firefox 1.5.0.3 and earlier contains a vulnerability in processing the content-length header that can allow script injection from another domain when viewing a malicious page. Affected product: Mozilla Firefox (pre-1.5.0.4). Root cause: improper handling of the content-length header. Impa...

CVE-2011-3654

CVE-2011-3654 : The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 mishandles links from SVG mpath elements to non-SVG elements, enabling memory corruption and application crash and possibly arbitrary code execution via unspecified vectors. Impact is a high-severity memor...

CVE-2017-7770

CVE-2017-7770 describes a spoofing vulnerability in Firefox for Android: when a new tab is loaded via JavaScript events and fullscreen is entered, the address bar may not be rendered, allowing a malicious site to spoof the displayed URL. Affected: Firefox for Android, Firefox

CVE-2025-10527

The CVE-2025-10527 entry corresponds to a sandbox escape via use-after-free in the Graphics: Canvas2D component. Affected products include Firefox <143, Firefox ESR <140.3, Thunderbird <143, and Thunderbird

CVE-2026-12297

CVE-2026-12297 describes a sandbox escape caused by incorrect boundary conditions in Mozilla Firefox/Thunderbird networking code. Affects Firefox and Thunderbird components; underlying fault is boundary-condition handling in the Networking component that allowed escape from the sandbox. Impact pe...

CVE-2026-12325

CVE-2026-12325 is a denial-of-service vulnerability in the Graphics: ImageLib component. Affected products include Mozilla Firefox and Thunderbird; root cause and impact are described as DoS in ImageLib. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbir...

CVE-2026-16389

CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...

CVE-2026-16411

CVE-2026-16411 affects Firefox 152, with memory safety bugs that show evidence of memory corruption and could potentially be exploited to run arbitrary code. The issue is mitigated by upgrading to Firefox 153 (the fix is listed as per sources). The NVD entry notes a high-severity impact (CVSS 3.1...

CVE-2026-6782

This CVE (CVE-2026-6782) affects the IP Protection component and is addressed by upgrading Firefox to version 150 and Thunderbird to version 150 (per multiple advisories). Public records in Fedora/Nessus notes indicate an information disclosure vulnerability resolved by these upgrades; no detaile...

CVE-2006-6507

The CVE-2006-6507 issue affects Mozilla Firefox 2.0 prior to 2.0.0.1, where a regression in Function.prototype allows remote XSS protection bypass. Public advisories (SUSE/Ubuntu) indicate fixes in newer Firefox releases (2.0.0.1 or later). Remediation guidance: upgrade Firefox to 2.0.0.1+ (or ap...

CVE-2008-7244

The CVE-2008-7244 entry covers Mozilla Firefox 3.0.1 and earlier, where a remote attacker can cause a denial of service by repeatedly invoking window.print in a loop (a printing DoS). This document notes the vulnerability affects Firefox and is related to the issue tracked as CVE-2009-0821 (neste...

CVE-2009-2953

CVE-2009-2953 affects Mozilla Firefox 3.0.6–3.0.13 and 3.5.x, where JavaScript processing of location.hash (hash property) can trigger CPU-driven denial of service. The root cause is related to handling of long string values for hash in JavaScript. Public references document the issue as a follow...

CVE-2010-2117

CVE-2010-2117 affects Mozilla Firefox 3.0.19, 3.5.x, and 3.6.x. The vulnerability allows remote attackers to cause a denial of service through JavaScript that runs an infinite loop creating IFRAME elements for invalid news:// or nntp:// URIs, leading to resource consumption. The provided document...

CVE-2011-3664

Affected software: Mozilla Firefox, Thunderbird, and SeaMonkey on Mac OS X. Vulnerable behavior: plugins can delete a DOM frame, triggering an incorrect pointer dereference that may crash the application (DoS) and potentially other unspecified impacts. Severity: base CVSS 2.0 score 6.8 (MEDIUM). ...

CVE-2025-6431

The connected documents confirm CVE-2025-6431 affects Firefox for Android and describes a bypass where the prompt to open a link in an external application could be bypassed, potentially exposing users to security/privacy risks in external apps. The vulnerability is limited to Firefox for Android...

CVE-2026-12310

CVE-2026-12310 is a memory-safety bug in Mozilla Firefox/Thunderbird fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction required, and impact limited to confidentiality. The connec...

CVE-2026-16396

CVE-2026-16396 is a privilege-escalation issue in WebExtensions that affects Mozilla Firefox and Thunderbird components. Public advisories indicate the vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The CVSS data from the initial document show...

CVE-2026-16412

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-8706

Summary: CVE-2026-8706 affects Firefox for iOS Reader mode when it runs its own unauthenticated local web server. The issue allows another app on the same device to request arbitrary URLs and receive the response rendered using the signed-in user’s cookies. Affected component: Firefox for iOS Rea...

CVE-2004-1753

The CVE-2004-1753 issue affects the Apple Java plugin used by Netscape 7.1/7.2, Mozilla 1.7.2, and Firefox 0.9.3 on MacOS X 10.3.5. The vulnerability stems from improper handling of SetWindow(NULL) calls when tabbed browsing is enabled, allowing Java applets from one tab to draw to other tabs and...

CVE-2005-4809

CVE-2005-4809 affects Mozilla Firefox 1.0.1 (and possibly other Mozilla products such as Mozilla and Thunderbird) and describes a UI spoofing issue where an attacker can spoof the URL shown in the Status Bar. The root cause is a crafted A HREF tag that includes a TABLE tag containing another A ta...

CVE-2007-5341

CVE-2007-5341 (Firefox Venkman RCE) : The connected documents confirm a remote code execution vulnerability in the Venkman script debugger of Mozilla Firefox, affecting versions before 2.0.0.8. They identify the affected component and vulnerable version but do not provide the underlying root caus...

CVE-2010-1122

Technical details for CVE-2010-1122 are not provided in the connected documents. The materials reference other Firefox/WOFF issues but do not disclose affected components, versions, or fixes for this CVE. Monitor for updates.

CVE-2023-37455

The CVE-2023-37455 vulnerability affects Firefox for iOS prior to version 115. A permission-request prompt shown in a background tab overlays the foreground tab, potentially confusing users or leading to unintended interactions. Root cause: UI prompt handling in background context allows overlay ...

CVE-2025-10533

CVE-2025-10533 describes an integer overflow in the SVG component affecting Firefox before 143, Firefox ESR before 115.28 and 140.3, Thunderbird before 143 and 140.3. Connected sources confirm the same vulnerability details. The Astra Linux security bulletin echoes this issue and lists the affect...

CVE-2026-74935

Mozilla Firefox's DOM Networking component has a privilege escalation flaw, scoring CVSS 8.8 (HIGH). An attacker can trigger it via a malicious webpage (network vector, low complexity). Affected users should upgrade to Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1. No in-the-wild exploitation...

CVE-2006-3731

Firefox 1.5.0.4 and earlier is vulnerable: remote, user-assisted crash via a form using multipart/form-data with a user-uploaded file. The root cause is not detailed in the provided documents; no remediation steps are stated. Note also the issue has been linked to a third-party claim about the Li...

CVE-2010-1990

CVE-2010-1990 affects Mozilla Firefox 3.6.x, 3.5.x, 3.0.19 and earlier, and SeaMonkey. The issue arises when an HTML document contains many IFRAME elements with a src of mailto:, causing the mail application to be launched repeatedly and leading to a denial of service via excessive application la...

CVE-2011-0082

The CVE-2011-0082 entry concerns Mozilla Firefox 4.0.x–4.0.1 where the X.509 certificate validation does not properly implement single-session security exceptions. This could allow user-assisted remote attackers to spoof an SSL server using an untrusted certificate and trigger potentially unwante...

CVE-2026-12315

The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...

CVE-2026-16410

CVE-2026-16410: A JIT miscompilation in the JavaScript Engine's JIT component of Firefox was fixed in Firefox 153. Affected versions are prior to 153; use of the vulnerable JIT code could lead to high-severity impact per reported CVSS metrics (CRITICAL, HIGH confidentiality, integrity, availabili...

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-74939

Mozilla Firefox's DOM: Navigation component contains a privilege escalation flaw (CVSS 8.8 HIGH). Exploitation requires a network-based attacker to lure a user into visiting a crafted page. Affected versions must be upgraded to Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 1...

CVE-2026-8955

CVE-2026-8955 describes a privilege-escalation flaw in the DOM: Workers component. The vulnerability is fixed in Firefox 151 and Firefox ESR 140.11, as well as Thunderbird 151 and Thunderbird 140.11. The core issue is in the Workers implementation of the DOM, leading to elevated permissions. Per ...

CVE-2026-9078

Firefox for iOS suffers a rendering issue in link-preview UI where specially crafted RTL and internationalized domain names could cause the displayed domain to visually reorder, making attacker-controlled sites appear as trusted origins. The vulnerability affects the RTL/IDN rendering surface wit...

CVE-2005-1576

Affected software: Mozilla Firefox on Windows (versions 0.10.1 and 1.0). Vulnerability: The file download dialog uses the Content-Type HTTP header to determine file type, but when selecting “Save to Disk,” it preserves the original file extension, allowing remote attackers to mask the true file t...

CVE-2007-5415

CVE-2007-5415 describes an XSS in Mozilla Firefox 2.0 where UTF-7 document content rendered in UTF-7 allows remote attackers to inject arbitrary script/HTML via a gopher: URI using '/' to delimit a literal string within an XSS sequence. A related issue is CVE-2007-5414 (single-quote delimiter). T...

CVE-2014-1515

CVE-2014-1515 affects Mozilla Firefox for Android prior to 28.0.1. It occurs when processing a file: URL by copying a local file to the SD card, allowing an attacker with a crafted application to read sensitive data from the Firefox profile directory. CVSSv2 base score 1.9 (LOW) with LOCAL access...

CVE-2026-16387

CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-74990

CVE-2026-74990 affects Thunderbird ESR 140.13, ESR 153.0, and Thunderbird 153, where internally found bugs showed evidence of memory corruption or security-relevant defects. Mozilla assesses that, with enough effort, some could have been exploitable, scoring it Critical (CVSS 9.8). The vulnerabil...

CVE-2026-8950

CVE-2026-8950 is a reported same-origin policy bypass in the Networking: HTTP component, with root cause not explicitly detailed in the provided documents. Affected software includes Firefox (fixed in version 151) and Firefox ESR (140.11), as well as Thunderbird (fixed in 151 and 140.11). The CVS...

CVE-2005-1575

The CVE-2005-1575 issue concerns Mozilla Firefox for Windows (versions 0.10.1 and 1.0) where the file download dialog could misrepresent a file’s type. The root cause described across connected records is that a malicious HTTP Content-Type header combined with a filename containing whitespace, do...