CVE-2026-10701

The Firefox web browser is affected by a vulnerability caused by incorrect boundary conditions within the Graphics: Text component. This flaw allows for the execution of operations beyond the buffer boundaries in memory, which could enable an attacker to gain access to confidential data . The vul...

CVE-2026-12317

A memory safety bug exists in the Mozilla Firefox and Thunderbird web browser and email client. The vulnerability is caused by operations performing beyond the buffer boundaries in memory. Successful exploitation by a remote attacker can lead to service interruptions (Denial of Service). This iss...

CVE-2026-2767

CVE-2026-2767 is a use-after-free vulnerability in the JavaScript: WebAssembly component of Firefox/Thunderbird. Affected products include Firefox (Desktop) and Thunderbird with the WebAssembly implementation; the issue is addressed by fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and...

CVE-2026-2775

CVE-2026-2775 is a mitigation bypass in the DOM: HTML Parser component. The initial description states a fix in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources (Astra Linux bulletin and Amazon Linux advisories) reiterate the same mitig...

CVE-2026-74963

A Same-origin policy bypass exists in the Networking: Cookies component of the Mozilla Firefox and Thunderbird applications. This vulnerability affects various versions of Firefox and Thunderbird, including Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.1...

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

CVE-2026-84126

The Firefox and Thunderbird browsers are affected by a vulnerability involving incorrect boundary conditions in the Layout: Grid component . The issue has been remediated in Firefox 155 and Thunderbird 155 . While the vulnerability was identified as having a Medium base severity (CVSS 4.3) and a ...

CVE-2007-2871

CVE-2007-2871 affects Mozilla Firefox 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, and SeaMonkey 1.0.9 and 1.1.2. The flaw allows remote attackers to spoof or hide the browser chrome (notably the location bar) by placing XUL popups outside the browser’s content pane, which can be leveraged for p...

CVE-2007-6589

CVE-2007-6589 affects Mozilla Firefox before 2.0.0.10 and SeaMonkey before 1.1.7. The jar protocol handler fails to update the origin when an inner URL parameter yields an HTTP redirect, enabling remote XSS via a jar: URI. No exploitation details are provided in the documents. Remediation: upgrad...

CVE-2009-2664

CVE-2009-2664 concerns Mozilla Firefox's JavaScript engine: the function js_watch_set in jsdbgapi.cpp has a memory-safety bug that could allow a remote attacker to cause an assertion failure or potentially execute arbitrary code via a crafted .js file, leading to a denial of service or more serio...

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2010-3399

Technical details for CVE-2010-3399 are not publicly available in the provided documents; no concrete product/version/impact information is given here. Monitor for updates.

CVE-2011-2992

CVE-2011-2992 affects the Ogg reader in the browser engine of Mozilla Firefox (4.x–5) and SeaMonkey (2.x up to 2.3) and possibly other products, causing memory corruption and potential denial of service or arbitrary code execution via unspecified vectors. The root cause is memory safety issues in...

CVE-2012-3987

CVE-2012-3987 (Firefox for Android) : The issue arises when a page is transitioned into Reader Mode; the resulting page is given chrome privileges and may not be fully sanitized. Exploitation requires user activation of Reader Mode on a malicious page, enabling a cross-site scripting–like attack ...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2014-1527

CVE-2014-1527 affects Mozilla Firefox for Android (Android builds, e.g., Firefox 28.x and earlier; NVD references Firefox before 29.0 on Android). The vulnerability allows remote attackers to spoof the address bar by crafting JavaScript that uses DOM events to prevent reappearance of the real add...

CVE-2021-43533

CVE-2021-43533 affects Firefox versions prior to 94. Root cause: during internationalized domain name parsing, high bits of URL characters could be stripped, causing display/inconsistency that could enable phishing or user confusion. Impact: user interaction required; potential phishing risk due ...

CVE-2026-0885

A use-after-free vulnerability exists in the JavaScript: GC component of the Mozilla Firefox and Thunderbird products. This memory safety issue can allow a remote attacker to execute arbitrary code on the affected system. The vulnerability affects versions of Firefox earlier than 147 and Firefox ...

CVE-2026-12302

A mitigation bypass exists in the DOM: Security component of Mozilla Firefox and Thunderbird . This vulnerability affects various versions and has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not prov...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

CVE-2026-16409

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2780

CVE-2026-2780: Privilege escalation in the Netmonitor component of Firefox/Thunderbird. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products include Firefox family and Thunderbird; root cause is in the Netmonitor component. Remedi...

CVE-2026-2804

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The root cause is a mix-up in the instructions responsible for freeing memory. An attacker could exploit this flaw to execute arbitrary code , ca...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-74971

A security vulnerability in the DOM: UI Events & Focus Handling component allows for information disclosure . This issue affects the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 ,...

CVE-2026-84122

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The issue is resolved in Firefox 155 , Firefox ESR 140.1...

CVE-2004-0764

CVE-2004-0764 affects Mozilla-based browsers (Mozilla before 1.7; Firefox before 0.9; Thunderbird before 0.7) where the chrome flag and XML User Interface Language (XUL) files allow remote websites to hijack the browser UI. The vulnerability arises from XUL/UI manipulation that lets a site contro...

CVE-2004-1381

CVE-2004-1381 affects Firefox before 1.0 and Mozilla before 1.7.5. The issue allows an inactive (background) tab to capture input focus on the active tab, enabling an attacker to read sensitive data entered on other sites (possible phishing risk). The connected advisories (Ubuntu USN-149-3 and re...

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

CVE-2005-1154

CVE-2005-1154 affects Firefox before 1.0.3 and Mozilla Suite before 1.7.7. A vulnerable global scope in the browser allows a malicious page to set a variable in the target domain, which is executed when the user visits that domain, enabling remote script execution in the context of the affected s...

CVE-2006-0496

CVE-2006-0496 is an XSS in Mozilla-based browsers (Mozilla 1.7.12+, Firefox 1.0.7+, Netscape 8.x) due to a flaw in the -moz-binding CSS property that can bypass origin checks. Exploitation could allow execution of arbitrary script in a user’s browser, evidenced by the LiveJournal account compromi...

CVE-2006-4310

Mozilla Firefox 1.5.0.6 is affected by CVE-2006-4310. The vulnerability allows a remote attacker to cause a denial of service (crash) by delivering a crafted FTP response when a user attempts to connect via an FTP URI. The description across connected documents is consistent, explicitly mentionin...

CVE-2007-0779

CVE-2007-0779 concerns a GUI overlay spoofing flaw in SeaMonkey prior to 1.0.8 (and Firefox 1.5.x before 1.5.0.10 and 2.x before 2.0.0.2) where a large, transparent cursor via CSS3 hotspot could spoof UI elements such as the hostname or security indicators. The vulnerability allows remote observe...

CVE-2008-2805

CVE-2008-2805 affects Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10. The flaw allows a remote attacker to force the upload of arbitrary local files from a client computer via vectors involving originalTarget and DOM Range. The vulnerability is described in the initial record as a lo...

CVE-2009-3073

The CVE-2009-3073 entry concerns Mozilla Firefox 3.5.x prior to 3.5.3, with memory corruption via an incorrect top-level script object offset calculation that could lead to a crash or arbitrary code execution. The connected advisories (MFSA/3.5-era disclosures) and OpenVAS/SUSE entries confirm th...

CVE-2010-0220

CVE-2010-0220 affects Mozilla Firefox before 3.5.7, where the nsObserverList::FillObserverArray function in xpcom/ds/nsObserverList.cpp can be exploited by a crafted site to cause memory exhaustion and trigger a Low Memory alert, potentially leading to an application crash. The bug also enables r...

CVE-2010-0648

CVE-2010-0648 affects Mozilla Firefox (possibly before 3.6). The vulnerability allows a remote attacker to cause a user’s session to reveal a redirect’s target URL by placing the site’s URL in the HREF of a LINK element for a stylesheet and reading document.styleSheets[0].href, related to an IFRA...

CVE-2010-1987

Mozilla Firefox 3.6.3 on Windows XP SP3 is affected by CVE-2010-1987, allowing remote attackers to trigger memory consumption and a crash through crafted JavaScript that appends long strings to a P element and performs string operations. The root cause is tied to DoubleWideCharMappedString in USP...

CVE-2010-2770

CVE-2010-2770 affects Mozilla-based products on Mac OS X: Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The vulnerability arises from a crafted font in a data: URL that can trigger memory corruption, leadin...

CVE-2011-3003

CVE-2011-3003 affects Mozilla Firefox < 7.0 and SeaMonkey

CVE-2013-1700

CVE-2013-1700 affects Mozilla Firefox on Windows, where the Mozilla Maintenance Service fails to handle inability to launch the Mozilla Updater executable. This enables local privilege escalation via placing a Trojan horse executable at an arbitrary location. Affected component: Mozilla Maintenan...

CVE-2017-7768

CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox

CVE-2020-12412

This CVE (CVE-2020-12412) affects Mozilla Firefox prior to version 70, where navigating a tab via the History API could spoof the address bar to display an incorrect domain (https scheme, blocked port, no lock icon) while the page content is controlled. The vulnerability enables spoofing of the v...

CVE-2023-37455

The CVE-2023-37455 vulnerability affects Firefox for iOS prior to version 115. A permission-request prompt shown in a background tab overlays the foreground tab, potentially confusing users or leading to unintended interactions. Root cause: UI prompt handling in background context allows overlay ...

CVE-2004-0648

The CVE-2004-0648 issue affects Mozilla Suite <=1.7.0+1, Firefox <=0.9.1+1, and Thunderbird

CVE-2005-0150

CVE-2005-0150 affects Mozilla Firefox versions prior to 1.0. The bug allows storing javascript: or data: Livefeed bookmarks that are later executed in the context of the current page, enabling remote attackers to potentially run arbitrary code. Public descriptions consistently state Firefox pre-1...

CVE-2007-5045

CVE-2007-5045 describes an argument injection in Apple QuickTime 7.1.5 and earlier when used with Mozilla Firefox

CVE-2011-3671

The CVE-2011-3671 entry describes a use-after-free vulnerability in Mozilla’s nsHTMLSelectElement.cpp (nsHTMLSelectElement) affecting Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey

CVE-2016-1971

CVE-2016-1971 affects Mozilla Firefox before 45.0 on Windows, via the I420VideoFrame::CreateFrame function in WebRTC, where an unspecified status check is omitted. This can lead to memory corruption and a possible denial of service or other impacts. Public-lesson coverage in connected documents i...

CVE-2017-7766

CVE-2017-7766 is a local privilege-escalation path in Windows Mozilla updater components. An attacker who already has local access can manipulate updater.ini to abuse the Mozilla Windows Updater and Mozilla Maintenance Service, gaining privileged access to execute arbitrary files or delete files....