CVE-2024-10458

CVE-2024-10458 describes a permission leak from a trusted site to an untrusted site via embed/object in Firefox and Thunderbird. Affected products and ranges shown in the connected documents include Firefox and Thunderbird before 132 (and ESR before 128.4/115.17 for Firefox, and Thunderbird befor...

CVE-2024-5697

CVE-2024-5697 : A website could detect when a user took a page screenshot via Firefox’s built-in Screenshot feature. Affected: Firefox versions before 127. The connected documents confirm Firefox as the vulnerable product and the issue as a UI/behavioral flaw; no exploitation details or in-the-wi...

CVE-2025-0247

CVE-2025-0247 concerns memory safety bugs in Mozilla Firefox 133 and Thunderbird 133, with impact on Firefox < 134 and Thunderbird

CVE-2010-0178

CVE-2010-0178 affects Mozilla Firefox up to 3.0.19, Firefox 3.5.x up to 3.5.9, Firefox 3.6.x up to 3.6.2, and SeaMonkey up to 2.0.3 (before 2.0.4). The vulnerability allows an applet to convert a mouse click into a drag‑and‑drop, enabling remote JavaScript execution with Chrome privileges by firs...

CVE-2019-11715

CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird

CVE-2019-9788

CVE-2019-9788 affects Mozilla Thunderbird and Firefox components via memory-safety bugs that could allow arbitrary code execution. The provided documents identify memory-corruption opportunities in Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox

CVE-2020-15664

The CVE-2020-15664 issue arises from a malicious page holding a reference to eval() from an about:blank window, allowing access to InstallTrigger and prompting users to install an extension. Affected products include Firefox < 80, Thunderbird < 78.2/68.12, Firefox ESR < 68.12/78.2, and F...

CVE-2020-6825

CVE-2020-6825 is a memory-safety issue in Mozilla Firefox/Thunderbird affecting Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox

CVE-2020-6831

CVE-2020-6831 is a bug described in Debian security advisories as a buffer overflow in the SCTP chunk input validation in the usrsctp library. The Debian entries explicitly tie this CVE to Firefox ESR (<68.8), Firefox (<76) and Thunderbird (

CVE-2024-4768

CVE-2024-4768 involves a bug in the interaction between popup notifications and WebAuthn that could enable a user-permission bypass in the affected Mozilla products. The concrete impact described in connected advisories applies to Firefox and Firefox ESR (and Thunderbird): an attacker could trick...

CVE-2024-5701

CVE-2024-5701 is tied to memory safety bugs in Mozilla Firefox, affecting Firefox versions earlier than 127. The connected sources describe memory corruption risks with potential for arbitrary code execution and indicate the vulnerability is present in Firefox 126 (and affects Firefox

CVE-2024-5702

The CVE-2024-5702 entry is confirmed with concrete details in connected advisories: memory corruption in the networking stack affecting Mozilla Firefox before 125, Firefox ESR before 115.12, and Thunderbird before 115.12. The root cause is memory corruption in the networking component, potentiall...

CVE-2025-1011

CVE-2025-1011 is a WebAssembly code-generation bug that could crash the affected Mozilla components and, per the connected advisories, may enable remote code execution. Public references indicate the vulnerability affects Firefox up to version 135 (and ESR 128.7) and Thunderbird up to 128.7 (and ...

CVE-2018-18505

CVE-2018-18505 concerns an IPC privilege-escalation in Mozilla products where an authentication added during IPC process creation is not applied to channels created later, enabling potential sandbox escape through IPC channels. Public advisories tie this to Thunderbird and Firefox releases prior ...

CVE-2018-8024

Apache Spark UI cross-site scripting (CVE-2018-8024) affects Spark UI before 2.3.2, including 2.1.0–2.1.2, 2.2.0–2.2.1, and 2.3.0. A malicious user can craft a URL to the Spark UI’s /jobs/ endpoint; if a user visits the URL, JavaScript can execute in the victim’s browser within the Spark UI conte...

CVE-2021-23982

CVE-2021-23982 is a concrete WebRTC-based information-disclosure vulnerability affecting Mozilla products. The connected documents confirm that a malicious webpage could probe an internal network’s hosts and services running on the user’s machine via WebRTC. Affected products/versions: Firefox ES...

CVE-2021-29988

The CVE-2021-29988 issue is a memory safety vulnerability in Mozilla code where Firefox incorrectly treated an inline list-item as a block element, leading to an out-of-bounds read or memory corruption and a potentially exploitable crash. Affected products and versions: Thunderbird < 78.13 and...

CVE-2024-5690

Vulnerability CVE-2024-5690 affects Mozilla Firefox and Thunderbird components via a timing-attack on external protocol handler detection. Affected products explicitly include Firefox < 127, Firefox ESR < 115.12, and Thunderbird

CVE-2019-11730

CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...

CVE-2019-9813

CVE-2019-9813 describes an IonMonkey JIT type confusion caused by incorrect handling of proto mutations, enabling potential arbitrary memory read/write. Affected products include Firefox prior to 66.0.1, Firefox ESR prior to 60.6.1, and Thunderbird prior to 60.6.1. The underlying issue is a type-...

CVE-2024-5691

The CVE-2024-5691 entry describes a vulnerability where an attacker could trick a sandboxed iframe using an X-Frame-Options header to present a button that, if clicked, bypasses sandbox restrictions and opens a new window. Affected products (per the provided documents) include Mozilla Firefox and...

CVE-2024-6603

The CVE-2024-6603 entry describes an out-of-memory scenario where an allocation can fail but the pointer is free’d afterward, leading to memory corruption. Affected software: Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird

CVE-2025-1017

CVE-2025-1017: Memory-safety bugs in Firefox 134/THUNDERBIRD 134 (and related ESR) with potential for arbitrary code execution. Affects Firefox <135, Firefox ESR <128.7, Thunderbird

CVE-2025-1020

The CVE-2025-1020 entries concern memory safety bugs in Mozilla Firefox 134 and Thunderbird 134. The connected sources confirm memory-safety issues that could lead to memory corruption, with the potential to execute arbitrary code, and apply to Firefox versions before 135 and Thunderbird versions...

CVE-2019-11743

CVE-2019-11743 describes cross-origin access to unload event attributes, enabling timing-side-channel exposure of history in certain browsers. Connected docs confirm affected products and versions, with fixes noted in Thunderbird updates (e.g., Thunderbird 60.9.0) and Firefox/ESR advisories addre...

CVE-2019-9796

CVE-2019-9796 is a use-after-free in the SMIL animation controller where double registration with the refresh driver leads to a dangling pointer after the controller is removed. Affected products include Thunderbird and Firefox (Firefox ESR < 60.6, Firefox

CVE-2020-6799

CVE-2020-6799 is a vulnerability in Mozilla Firefox where command line arguments could be injected during Firefox invocation when Firefox is the default handler for non-default filetypes and a downloaded file is opened by a third‑party application that does not sanitize URL data. The issue could ...

CVE-2021-23981

CVE-2021-23981 describes a memory-safety issue in WebGL where uploading a Texture into a Pixel Buffer Object could confuse WebGL and skip binding the buffer used to unpack it, leading to an out-of-bounds read and potential information leak or crash. Affected software includes Firefox ESR < 78....

CVE-2021-23984

The CVE-2021-23984 entry describes a vulnerability in which a malicious extension could open a popup window without an address bar, allowing spoofing of a site and credential theft. Affected products include Firefox ESR < 78.9, Firefox < 87, and Thunderbird

CVE-2021-29984

CVE-2021-29984 involves instruction reordering that allowed a GC-related object misevaluation, causing memory corruption and potentially exploitable crashes in Mozilla components. Affected products include Thunderbird and Firefox ESR/Firefox releases prior to 78.13/91; the exploit would require m...

CVE-2024-10459

CVE-2024-10459 is a use-after-free vulnerability triggered when accessibility features are enabled, potentially causing a crash. The issue affects Firefox versions earlier than 132, Firefox ESR prior to 128.4 and 115.17, and Thunderbird versions earlier than 132 or 128.4, as noted across multiple...

CVE-2024-11698

CVE-2024-11698 is a macOS-specific fullscreen lock-up in Firefox/Thunderbird when a modal dialog interrupts a fullscreen transition. Affected products are Firefox and Thunderbird desktop releases older than Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird ESR 128.5. The issue can ...

CVE-2024-9401

CVE-2024-9401 affects Firefox and Thunderbird memory-safety bugs (memory corruption) in Firefox 130, ESR 115.15, ESR 128.2, and Thunderbird 128.2; vulnerable ranges extend to Firefox < 131, ESR < 128.3, ESR < 115.16, Thunderbird < 128.3, and Thunderbird

CVE-2020-15683

CVE-2020-15683 : Mozilla Firefox and Thunderbird memory-safety issues reported affecting Firefox ESR < 78.4, Firefox < 82, and Thunderbird

CVE-2022-34478

Summary: CVE-2022-34478 affects Thunderbird on Windows, where the ms-msdt, search, and search-ms protocols could deliver content to Microsoft apps via prompts opened by user interaction. The underlying risk is exploitation of a prompt-based handling in these protocols that bypasses the browser. T...

CVE-2024-6611

In CVE-2024-6611, a nested iframe could trigger cross-site navigation and allow cookies with SameSite=Strict or Lax to be sent. Affected products are Mozilla Firefox and Thunderbird prior to version 128. root cause: improper handling of SameSite cookies in nested iframes; impact includes potentia...

CVE-2025-1016

CVE-2025-1016 corresponds to memory-safety bugs in Firefox 134/Thunderbird 134 (and ESR lines) that could allow arbitrary code execution. Affected: Firefox <135, Firefox ESR <115.20/128.7, Thunderbird

CVE-2020-6814

CVE-2020-6814 refers to memory-safety bugs in Mozilla Firefox and Thunderbird (68.5 timeframe) with potential to run arbitrary code. Affected products/versions: Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR

CVE-2020-6829

CVE-2020-6829 is a vulnerability in NSS (Network Security Services) libraries (nss, nss-util, nss-softokn, nspr) where the wNAF scalar point multiplication during ECDSA signature generation leaks partial nonce information. This side-channel can enable an attacker with electromagnetic traces from ...

CVE-2021-29976

CVE-2021-29976 is a memory-safety issue affecting Mozilla code shared by Firefox and Thunderbird. The advisory details indicate memory-safety bugs that could be exploited to run arbitrary code, impacting Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox

CVE-2024-5698

CVE-2024-5698 affects Mozilla Firefox prior to version 127, where manipulating the fullscreen feature when opening a data-list could overlay a text box on the address bar, enabling user confusion and potential spoofing. The issue is confirmed across multiple sources (Mozilla advisories and vendor...

CVE-2025-1012

CVE-2025-1012 describes a race during concurrent delazification that can cause a use-after-free in Firefox and Thunderbird. Affected products include Firefox <135, Firefox ESR <115.20, Firefox ESR <128.7, Thunderbird <128.7, and Thunderbird

CVE-2019-17011

CVE-2019-17011 : A race condition in DocShell antitracking can cause a use-after-free and potentially crash the process. Affected: Thunderbird < 68.3, Firefox ESR < 68.3, Firefox

CVE-2019-9800

CVE-2019-9800 is supported by multiple connected advisories indicating memory safety bugs in Mozilla products (Thunderbird 60.x, Firefox ESR 60.x, Firefox 66–67 range) that could allow arbitrary code execution. The root cause is memory safety issues leading to memory corruption; affected versions...

CVE-2020-6797

CVE-2020-6797 describes a macOS-specific issue where downloading a file with the .fileloc extension could cause a semi-privileged extension to launch an arbitrary application on the user’s Mac. The attacker is constrained by the ability to download only quarantined files and cannot pass command-l...

CVE-2023-6209

CVE-2023-6209 corresponds to a parsing vulnerability where relative URLs starting with three slashes and a "/../" path could override the specified host, potentially enabling security issues on affected sites. The issue is documented for Firefox and Thunderbird, with affected versions cited as Fi...

CVE-2024-5699

CVE-2024-5699 affects Mozilla Firefox prior to version 127. The issue arises from cookie prefixes such as __Secure being ignored when capitalization isn’t correct, contrary to the spec that requires a case-insensitive check. This could allow behaviors not being honored as defined by the prefix, w...

CVE-2025-2857

Firefox on Windows was vulnerable to a sandbox-escape in the IPC code where a compromised child process could cause the parent to return an unintentionally powerful handle. This pattern mirrors the Chrome/CVE-2025-2783 lineage and was exploited in the wild. The issue affected Firefox on Windows o...

CVE-2019-11717

CVE-2019-11717 affects Firefox ESR <60.8, Firefox <68, and Thunderbird

CVE-2019-11746

CVE-2019-11746 is a use-after-free in video element handling that can cause a crash. Public sources in connected advisories confirm impact on Firefox versions below 69, Thunderbird <68.1 and <60.9 (and ESR branches