CVE-2026-74963

A Same-origin policy bypass exists in the Networking: Cookies component of the Mozilla Firefox and Thunderbird applications. This vulnerability affects various versions of Firefox and Thunderbird, including Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.1...

CVE-2026-74971

A security vulnerability in the DOM: UI Events & Focus Handling component allows for information disclosure . This issue affects the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 ,...

CVE-2026-84122

A use-after-free vulnerability exists in the Audio/Video component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The issue is resolved in Firefox 155 , Firefox ESR 140.1...

CVE-2026-8962

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and the Thunderbird email client. Exploiting this vulnerability could allow an attacker to access confidential data and compromise data integrity . This issue was resolved in Firefox 151 , Firefox ESR 140.11 , Th...

CVE-2026-8973

Memory safety bugs in Firefox 150 and Thunderbird 150 allow for memory corruption due to operations exceeding buffer boundaries. While the impact primarily involves potential service interruptions , it is presumed that with sufficient effort, these flaws could be exploited to achieve arbitrary co...

CVE-2004-2225

CVE-2004-2225 affects Mozilla Firefox up to version 0.10.0, where saving a remote resource via a crafted data: URI could allow a remote attacker to delete arbitrary files in the user’s download directory due to improper handling when the Save button is clicked. The information specifies Firefox b...

CVE-2005-0147

CVE-2005-0147 affects Firefox before 1.0 and Mozilla before 1.7.5 when configured to use a proxy, enabling a remote attacker to steal NTLM or SPNEGO credentials by eliciting 407 proxy authentication requests. The issue is caused by the browser’s handling of proxy auth prompts, allowing credential...

CVE-2006-0293

Technical details for CVE-2006-0293 are not present in the connected documents. Public discussion notes Firefox 1.5 function allocation issue causing memory corruption/DoS. No additional product/version specifics found here. Monitor for updates.

CVE-2006-1650

CVE-2006-1650 affects Firefox 1.5.0.1, where a window reopened to a malicious Shockwave Flash app and then navigated back to a trusted URL while the Flash is loading could allow spoofing of the address bar and phishing-like behavior. The description notes a followup failed to replicate; no remedi...

CVE-2007-2162

The CVE-2007-2162 entry affects Mozilla Firefox 2.0.0.3 and GNU IceWeasel 2.0.0.3. It describes a remote-denial-of-service impact where an attacker can cause a browser crash or system hang by sending JavaScript that matches a long string against the regular expression /(.)*/. The description cite...

CVE-2009-3383

The entry CVE-2009-3383 affects Mozilla Firefox 3.5.x prior to 3.5.4, describing memory corruption in the JavaScript engine that could crash the browser or potentially allow arbitrary code execution via unknown vectors. Affected product is Firefox 3.5.x; impact is high (remote code execution or D...

CVE-2010-1988

Technical details for CVE-2010-1988 are not provided in the connected documents. Public information in the Initial Description covers Firefox 3.6.3 on Windows XP SP3 but no additional technical specifics, vulnerable components, impact, or fixes are included here.

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2013-1689

Mozilla Firefox is affected by CVE-2013-1689 through a denial-of-service crash related to event handling with frames. Concrete details in connected material show the vulnerability impacts Firefox 20.0a1 and earlier, with a fix released in Firefox 22. Remediation: upgrade to Firefox 22 or newer. T...

CVE-2014-1501

Mozilla Firefox for Android is affected (before 28.0). The issue allows remote attackers to bypass the Same Origin Policy and access arbitrary file: URLs via the Open Link in New Tab action, enabling local file access from web content. The root cause is a Same Origin Policy bypass in the Android ...

CVE-2014-1554

CVE-2014-1554 concerns multiple vulnerabilities in the Mozilla Firefox browser engine prior to 32.0, enabling remote attackers to cause memory corruption, crash the browser, or potentially execute arbitrary code via unknown vectors. The issue is tied to Firefox 32.x timeframe and is discussed acr...

CVE-2014-8635

CVE-2014-8635 is tied to memory-safety hazards in the Mozilla Firefox/SeaMonkey browser engine prior to versions addressing Firefox 35.0 and SeaMonkey 2.32. The public records indicate remote attacker could cause memory corruption or an application crash and potentially execute arbitrary code via...

CVE-2017-5452

CVE-2017-5452 affects Firefox for Android prior to version 53. The issue allows a spoofed address bar on a page when the new page’s location bar is scrolled out of view if an HTML editable element is user-selected. Remediation per the advisory is upgrading to Firefox 53 or newer (the fixed versio...

CVE-2017-7761

Summary: CVE-2017-7761 affects Firefox on Windows (Firefox ESR < 52.2 and Firefox

CVE-2026-10701

The Firefox web browser is affected by a vulnerability caused by incorrect boundary conditions within the Graphics: Text component. This flaw allows for the execution of operations beyond the buffer boundaries in memory, which could enable an attacker to gain access to confidential data . The vul...

CVE-2026-12320

An information disclosure vulnerability exists in the Password Manager component of the Firefox and Thunderbird web browsers. This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 152 and Thunderbird 152 . Exploitation details are not...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

CVE-2026-2769

A use-after-free vulnerability exists in the Storage: IndexedDB component of the Firefox browser and the Thunderbird email client. This flaw occurs because the software uses memory after it has been released, which could allow a remote attacker to induce a service failure . The issue is fixed in ...

CVE-2026-2771

CVE-2026-2771 is an undefined-behavior vulnerability in the DOM: Core & HTML component of Mozilla Firefox/Thunderbird family that was fixed in Firefox 148, Firefox ESR 115.33 and 140.8, Thunderbird 148 and 140.8. The issue is reported across multiple advisories (Astra Linux bulletin and Amazon Li...

CVE-2026-2787

CVE-2026-2787 is a use-after-free in the DOM: Window and Location component, with fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connected sources corroborate the issue in Firefox-related components and list the affected products as Firefox/Th...

CVE-2026-2799

CVE-2026-2799 is a use-after-free vulnerability in the DOM: Core & HTML components of Mozilla Firefox and Thunderbird. The issue, identified across multiple advisories, is resolved in Firefox 148 and Thunderbird 148. Public exploit activity is noted in connected sources. Affected products include...

CVE-2026-2802

A race condition exists in the JavaScript: GC component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from simultaneous execution using a shared resource with incorrect synchronization. If exploited, an attacker could gain access to confidential ...

CVE-2026-2806

CVE-2026-2806 involves an uninitialized memory issue in the Graphics: Text component of Firefox/Thunderbird. Affected products are Mozilla Firefox and Mozilla Thunderbird (before versions 148). Root cause per the documents is uninitialized memory in the Text rendering path, with a fix implemented...

CVE-2026-4695

The CVE-2026-4695 entry concerns the Audio/Video: Web Codecs component and affects Firefox versions before 149 and Firefox ESR before 140.9. The root cause is described as incorrect boundary conditions in that component. Connected records (NVD/CVE lists) reiterate the same description. No explici...

CVE-2026-4698

CVE-2026-4698 — JIT miscompilation in the JavaScript Engine (JIT component) . The issue is disclosed for Firefox/Thunderbird products and is described as a JIT miscompilation in the JavaScript engine’s JIT path. Affected versions are Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2026-5734

CVE-2026-5734 involves memory safety bugs in Mozilla products. Affected: Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. Some bugs show memory corruption and could potentially be exploited to run arbitrary code. The issue is addressed by fixes in Firefox 14...

CVE-2026-6775

The WebRTC component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to incorrect boundary conditions, specifically involving the execution of operations outside of the buffer in memory. This vulnerability could allow an attacker to gain unauthorized access to protected information . The...

CVE-2026-74967

A Same-origin policy bypass vulnerability exists in the Audio/Video: Playback component of the Firefox web browser and Thunderbird email client. This flaw allows for the circumvention of origin-based security boundaries during media playback. The vulnerability has been addressed in Firefox 154 , ...

CVE-2002-2437

The CVE-2002-2437 entry describes an information-disclosure flaw in the JavaScript implementation of Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability arises from improper restrictions on the values returned by getComputedStyle, enabling remote ...

CVE-2006-0298

CVE-2006-0298 affects Mozilla Firefox < 1.5.0.1 and SeaMonkey

CVE-2006-0299

CVE-2006-0299 affects Mozilla Firefox up to 1.5.0.1, Thunderbird 1.5 (when JavaScript runs in mail), and SeaMonkey before 1.0. The issue arises from the E4X implementation exposing the internal AnyName object to external interfaces, allowing multiple cooperating domains to exchange information an...

CVE-2006-1725

The vulnerability affects Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1. It stems from an interaction between XUL content windows and the history mechanism that can cause certain windows to become translucent, potentially enabling user-assisted remote attackers to trick users into...

CVE-2006-2332

CVE-2006-2332 concerns Mozilla Firefox 1.5.0.3. Affected software: Firefox 1.5.0.3. Vulnerable component: HTML rendering of IMG elements where the SRC attribute is a mailto: URI. Root cause: processing a web page containing a large number of such IMG elements can trigger denial of service, with r...

CVE-2006-2613

CVE-2006-2613 affects Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before 1.8.0, as well as Netscape 7.2 and 8.1. A remote user‑assisted attacker can cause exceptions to be thrown and inspect message contents to obtain information such as the installation path. The ef...

CVE-2007-1004

CVE-2007-1004 concerns Mozilla Firefox and describes a spoofing/phishing issue: remote attackers could write to an about:blank tab and overlay the location bar, enabling deceptive UI to mislead users. The available connected sources corroborate that Firefox is the affected product and the vulnera...

CVE-2008-7293

Mozilla Firefox vulnerability CVE-2008-7293 affects Firefox versions before 4. The issue allows MITM attackers to overwrite or delete cookies via a Set-Cookie header in HTTP responses because HTTPS session cookies are not properly restricted, tied to the absence of the HSTS includeSubDomains feat...

CVE-2011-2669

CVE-2011-2669 affects Mozilla Firefox prior to 3.6 due to an issue in certificate validation that can trigger a denial-of-service. Connected sources (e.g., JVN entries) confirm the vulnerability stems from how certificates are validated, with impact described as DoS when loading HTTPS sites with ...

CVE-2011-3653

CVE-2011-3653 affects Mozilla Firefox < 8.0 and Thunderbird

CVE-2013-5592

CVE-2013-5592 concerns multiple memory-safety vulnerabilities in Mozilla Firefox’s browser engine prior to 25.0. The issues can cause memory corruption and application crashes, possibly enabling remote arbitrary code execution via unspecified vectors. Affected components include Firefox (and rela...

CVE-2016-2826

The CVE-2016-2826 issue affects Mozilla Firefox on Windows prior to 47.0 and Firefox ESR before 45.2/45.x, where the maintenance/updater service does not prevent MAR-extracted file modification, enabling local privilege escalation via a Trojan horse file. Affected component: the updater’s MAR han...

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2026-16380

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16406

Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-4688

CVE-2026-4688 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9. The available documents do not provide exploit details or specific remediation steps beyond...

CVE-2026-4719

CVE-2026-4719 is a vulnerability described as incorrect boundary conditions in the Graphics: Text component. The connected advisories show affected products as Firefox (and Firefox ESR) and Thunderbird, with fixes implemented in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140...