CVE-2013-1673

The CVE-2013-1673 entry concerns Mozilla Firefox on Windows. The issue arises in the Mozilla Updater/Maintenance Service where registry entries were not properly updated during upgrades from older Firefox versions, allowing local users with write access to a trusted path to escalate privileges. A...

CVE-2014-1506

Mozilla Firefox for Android prior to 28.0 (including ESR lines in some releases) contains a directory traversal vulnerability in the Android Crash Reporter. A crafted application can manipulate Crash Reporter arguments to cause local files to be transmitted to arbitrary servers or trigger a denia...

CVE-2014-1575

CVE-2014-1575 : Mozilla Firefox before 33.0 contains multiple unspecified vulnerabilities in the browser engine that can lead to memory corruption, crashes, or potentially arbitrary code execution. The described vector involves improper interaction between threading and garbage collection in GCRu...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2026-13356

A malicious webpage can exploit a vulnerability in Firefox for iOS by enqueuing a synchronous JavaScript dialog to interrupt a pending navigation. This results in a UI misrepresentation where the address bar displays the destination origin while the browser continues to render attacker-controlled...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-16388

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2760

CVE-2026-2760 is a Firefox/Thunderbird Firefox Graphics: WebRender sandbox escape caused by incorrect boundary conditions. Multiple public advisories confirm the issue and that it is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected comp...

CVE-2026-2763

CVE-2026-2763 is a use-after-free in the JavaScript Engine component of Mozilla Firefox. The vulnerability affects Firefox and related ESR branches, and has been fixed in Firefox 148 and ESR versions 115.33, 140.8; Thunderbird 148/140.8 are also listed in fixed advisories. Connected sources corro...

CVE-2026-74973

A race condition and use-after-free vulnerability exists in the Graphics component of Firefox and Thunderbird . This flaw affects several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , and the corresponding versions of Thunderbird . Remediation is ...

CVE-2026-74981

Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74982

Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-8956

An integer overflow vulnerability exists in the Networking: JAR component of the Firefox web browser and the Thunderbird email client. Exploiting this numerical overflow condition can allow a remote attacker to cause service interruptions . The vulnerability has been addressed in Firefox 151 , Fi...

CVE-2026-8975

Memory safety bugs exist in Firefox ESR 115.35 , Firefox ESR 140.10 , and Firefox 150 , as well as Thunderbird 140.10 and Thunderbird 150 . These vulnerabilities involve memory corruption , which could potentially be exploited by an attacker with sufficient effort to execute arbitrary code . The ...

CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...

CVE-2005-1158

CVE-2005-1158 affects Mozilla Firefox prior to 1.0.3. The issue arises from missing security checks that allow an attacker to inject arbitrary JavaScript into privileged pages by abusing the sidebar’s _search target. This could enable code execution within the context of the affected site, as des...

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2007-1116

Technical details about CVE-2007-1116 are not provided in the connected documents. The initial description mentions Firefox 1.8 handling of about: as ChromeProtocol, but no further specifics are available here. Monitor for updates.

CVE-2007-5335

CVE-2007-5335 affects Mozilla Firefox 2.0 prior to 2.0.0.8. According to the description, a remote attacker could obtain sensitive information by abusing the addMicrosummaryGenerator sidebar method to access file: URIs. The CVSS base score is 4.3 (Medium) with network access and no authentication...

CVE-2009-3010

The CVE-2009-3010 issue is a cross-site scripting (XSS) vulnerability in Mozilla-based products where data: URIs in Refresh headers are not properly blocked in HTTP responses. Affected versions include Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; SeaMonkey 1.1.17; and Mozi...

CVE-2009-3014

This CVE (CVE-2009-3014) concerns multiple Mozilla products: Firefox up to 3.0.13 and earlier, plus versions in the 3.5, 3.6 a1 pre, and 3.7 a1 pre series; SeaMonkey 1.1.17; and Mozilla 1.7.x and earlier. The vulnerability arises from improper handling of javascript: URIs in HTML links inside 302...

CVE-2011-2987

The connected documents confirm CVE-2011-2987 is a heap overflow in the ANGLE library used by Mozilla’s WebGL implementation (Firefox/SeaMonkey/related) that could allow remote code execution. The issue is tied to the ANGLE heap overflow in WebGL code paths; exploitation would be via remote attac...

CVE-2011-2996

CVE-2011-2996 concerns an unspecified vulnerability in the Firefox plugin API present in Firefox 3.6.x up to (but before) 3.6.23. The issue could enable a remote attacker to cause memory corruption and an application crash, with the potential for arbitrary code execution via unknown vectors. Publ...

CVE-2012-0454

CVE-2012-0454 describes a use-after-free in Mozilla Firefox (including Firefox 4.x–10.0 and ESR 10.x before 10.0.3), Thunderbird 5.0–10.0, and SeaMonkey before 2.8 on 32-bit Windows 7. The issue arises when using the file-open dialog in a child window, related to IUnknown_QueryService in shlwapi....

CVE-2014-1595

Affected software: Mozilla Firefox (non-ESR) < 34.0 and Firefox ESR < 31.3, plus Mozilla Thunderbird

CVE-2025-6431

In Firefox for Android , a security bypass vulnerability exists in the Link Handler component where the prompt for opening links in external applications can be circumvented. This flaw could allow an attacker to bypass security restrictions, potentially leading to security vulnerabilities or priv...

CVE-2026-12305

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . This vulnerability specifically affected the Thunderbird application and was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described ...

CVE-2026-12316

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and Thunderbird email client. This vulnerability stems from a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise data integrity . The issue h...

CVE-2026-16395

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2782

CVE-2026-2782 affects Firefox (Netmonitor component) and is fixed in Firefox 148 and Firefox ESR 140.8, also addressed in Thunderbird 148/140.8. The connected sources corroborate privilege-escalation via Netmonitor across Mozilla products and note remediation as upgrading to Firefox 148+/Thunderb...

CVE-2026-74968

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74972

A vulnerability in the DOM: Push Subscriptions component of the Mozilla Firefox browser and Mozilla Thunderbird mail client leads to information disclosure . This issue was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 1...

CVE-2026-8957

A privilege escalation vulnerability exists in the Enterprise Policies component of Mozilla Firefox and Thunderbird . In the case of Firefox, this issue affects versions prior to 151 and ESR 140.11 . For Thunderbird, it affects versions prior to 151 and 140.11 . One report indicates that exploiti...

CVE-2026-8970

A privilege escalation vulnerability exists in the Security component of the Firefox web browser and the Thunderbird email client. This vulnerability is related to the insecure management of privileges and could allow a malicious actor to cause service interruptions . The issue has been addressed...

CVE-2005-1477

CVE-2005-1477 describes an arbitrary JavaScript execution flaw in Firefox 1.0.3 via the installer’s IconURL handling, enabling code execution with chrome privileges when a trusted extension install site (e.g., update.mozilla.org/addon.mozilla.org) is used, potentially chaining with CVE-2005-1476....

CVE-2007-1377

CVE-2007-1377 affects Adobe Reader's AcroPDF.DLL when loaded from browsers (e.g., Firefox/Netscape/Opera). A remote adversary can trigger a denial of service by passing a PDF URL whose anchor starts with search= followed by a long sequence of %n characters, causing resource exhaustion (DoS). This...

CVE-2007-2869

CVE-2007-2869 affects Mozilla Firefox 1.5.x ≤1.5.0.12 and Firefox 2.x ≤2.0.0.4 (and possibly earlier). The issue is in the form autocomplete feature: submitting a form with a large amount of characters can cause a denial of service via persistent high CPU usage. The linked advisories indicate rem...

CVE-2007-5959

CVE-2007-5959 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7, with memory corruption in the layout/jar handling that could crash the browser and potentially allow arbitrary code execution. Connected advisories note that SeaMonkey updates fixed these issues (and related CVEs li...

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2010-3400

CVE-2010-3400 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, and SeaMonkey before 2.0.5. The JavaScript Math.random() RNG is seeded with the current time, enabling remote attackers to guess the seed via brute-force. The description does not specify exploits; it indicates...

CVE-2011-3649

CVE-2011-3649 affects Mozilla Firefox 7.0 and Thunderbird 7.0 on Windows when using Direct2D with the Azure graphics backend, allowing cross-origin image data to be read via a manipulated canvas (Same Origin Policy bypass). The issue stems from a regression introduced by CVE-2011-2986. According ...

CVE-2016-1941

CVE-2016-1941 concerns Mozilla Firefox on OS X prior to 44.0 where the file-download dialog allows a button to become available too quickly, enabling a crafted site to trigger a clickjacking action intended for a double-click. Exploitation would allow a remote attacker to perform a single-click a...

CVE-2016-1948

Mozilla Firefox for Android before 44.0 is vulnerable to MITM during lightweight-theme installation because it may not require HTTPS for the client-server data stream, allowing an attacker to replace theme images/colors. Connected advisories indicate this is a real vulnerability affecting Firefox...

CVE-2017-7760

CVE-2017-7760 affects Mozilla Firefox/Firefox ESR on Windows via the Mozilla Windows Updater and Maintenance Service. The vulnerability stems from the updater reading the original file and applying changes, with a malicious actor able to pass a crafted path to the callback parameter, enabling man...

CVE-2021-43530

Affected software: Firefox for Android. The CVE-2021-43530 entry describes a Universal XSS vulnerability caused by improper sanitization when processing a URL scanned from a QR code, affecting Firefox versions before 94. The condition is explicit in multiple sources (NVD/Nessus aggregation and re...

CVE-2026-16400

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16407

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2777

CVE-2026-2777 is a privilege-escalation vulnerability in the Firefox/Thunderbird Messaging System component. The issue is fixed in Firefox 148, Firefox ESR 115.33/140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux, AWS advisories, Debian security notes) confirm the same...

CVE-2026-8948

A same-origin policy bypass exists in the DOM: Networking component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability is caused by the use of an untrusted network policy file , which can allow a remote attacker to execute arbitrary code . The issue was res...

CVE-2007-0801

CVE-2007-0801 affects Mozilla Firefox 1.5.x (notably 1.5.0.9 in the description) where nsExternalAppHandler::SetUpTempFile creates temporary files with filenames based on creation time. This predictable naming enables a remote attacker to craft an XMLHttpRequest that could execute arbitrary web-s...