3407 matches found
CVE-2026-92019
A mitigation bypass vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Mozilla Thunderbird . This issue is present in various versions, including Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3, and Thunderbird 156, 140.16, and 153.3. The vulnerability was addresse...
CVE-2026-12322
The Firefox web browser and Thunderbird email client are affected by a clickjacking vulnerability in the Widget: Gtk component. The issue stems from an incorrect limitation on the visible layers of the user interface, which could allow an attacker to cause service failures . This vulnerability ha...
CVE-2026-16397
Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
CVE-2026-74943
A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...
CVE-2026-92071
A sandbox escape vulnerability exists in the Widget: Win32 component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw allows an attacker to escape the sandbox environment, potentially leading to broader system impact. The issue was addressed in Firefox 156 , Firefox ESR ...
CVE-2002-2437
The CVE-2002-2437 entry describes an information-disclosure flaw in the JavaScript implementation of Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability arises from improper restrictions on the values returned by getComputedStyle, enabling remote ...
CVE-2006-0298
CVE-2006-0298 affects Mozilla Firefox < 1.5.0.1 and SeaMonkey
CVE-2006-0299
CVE-2006-0299 affects Mozilla Firefox up to 1.5.0.1, Thunderbird 1.5 (when JavaScript runs in mail), and SeaMonkey before 1.0. The issue arises from the E4X implementation exposing the internal AnyName object to external interfaces, allowing multiple cooperating domains to exchange information an...
CVE-2006-1725
The vulnerability affects Mozilla Firefox 1.5 before 1.5.0.2 and SeaMonkey before 1.0.1. It stems from an interaction between XUL content windows and the history mechanism that can cause certain windows to become translucent, potentially enabling user-assisted remote attackers to trick users into...
CVE-2006-2332
CVE-2006-2332 concerns Mozilla Firefox 1.5.0.3. Affected software: Firefox 1.5.0.3. Vulnerable component: HTML rendering of IMG elements where the SRC attribute is a mailto: URI. Root cause: processing a web page containing a large number of such IMG elements can trigger denial of service, with r...
CVE-2006-2613
CVE-2006-2613 affects Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly other versions before 1.8.0, as well as Netscape 7.2 and 8.1. A remote user‑assisted attacker can cause exceptions to be thrown and inspect message contents to obtain information such as the installation path. The ef...
CVE-2007-1004
CVE-2007-1004 concerns Mozilla Firefox and describes a spoofing/phishing issue: remote attackers could write to an about:blank tab and overlay the location bar, enabling deceptive UI to mislead users. The available connected sources corroborate that Firefox is the affected product and the vulnera...
CVE-2008-4723
Mozilla Firefox 3.0.1–3.0.3 is vulnerable to cross-site scripting via ftp:// URLs delivering HTML documents; a remote attacker could inject script when loading (1) JPG, (2) PDF, or (3) TXT files. OpenVAS and SUSE/Ubuntu references confirm the XSS exposure; Exploit-DB lists a dedicated Windows exp...
CVE-2008-7293
Mozilla Firefox vulnerability CVE-2008-7293 affects Firefox versions before 4. The issue allows MITM attackers to overwrite or delete cookies via a Set-Cookie header in HTTP responses because HTTPS session cookies are not properly restricted, tied to the absence of the HSTS includeSubDomains feat...
CVE-2009-2065
CVE-2009-2065 (Mozilla Firefox) : Firefox 3.0.10 (and possibly other versions) is vulnerable to a context-mixing flaw where http content can be loaded in an https page when the top-level frame is https. An MITM attacker could modify an http page to include an https iframe that loads a script from...
CVE-2011-2669
CVE-2011-2669 affects Mozilla Firefox prior to 3.6 due to an issue in certificate validation that can trigger a denial-of-service. Connected sources (e.g., JVN entries) confirm the vulnerability stems from how certificates are validated, with impact described as DoS when loading HTTPS sites with ...
CVE-2011-3653
CVE-2011-3653 affects Mozilla Firefox < 8.0 and Thunderbird
CVE-2013-5592
CVE-2013-5592 concerns multiple memory-safety vulnerabilities in Mozilla Firefox’s browser engine prior to 25.0. The issues can cause memory corruption and application crashes, possibly enabling remote arbitrary code execution via unspecified vectors. Affected components include Firefox (and rela...
CVE-2016-1940
CVE-2016-1940 affects Mozilla Firefox on Android (pre-44.0). A data: URL mishandling during shortcut opening or BOOKMARK/intent processing allows remote attackers to spoof the address bar. Affected: Firefox on Android before 44.0. Impact: address-bar spoofing. Mitigation: upgrade to Firefox 44.0 ...
CVE-2016-2826
The CVE-2016-2826 issue affects Mozilla Firefox on Windows prior to 47.0 and Firefox ESR before 45.2/45.x, where the maintenance/updater service does not prevent MAR-extracted file modification, enabling local privilege escalation via a Trojan horse file. Affected component: the updater’s MAR han...
CVE-2017-5425
CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird
CVE-2025-13027
Mozilla Firefox and Thunderbird versions prior to 145 are susceptible to memory safety bugs that can result in memory corruption . These vulnerabilities could potentially be exploited by an attacker to execute arbitrary code on the affected system, potentially via remote vectors. The issues have ...
CVE-2025-14861
The Mozilla Firefox browser is affected by memory safety bugs in versions prior to 146.0.1 . These vulnerabilities involve memory security issues that could lead to memory corruption , potentially allowing a remote attacker to execute arbitrary code . The issue has been addressed in Firefox 146.0...
CVE-2026-12307
A memory safety bug has been identified and fixed in Firefox and Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The issue was specifically addressed as a memory safety fix in the Thunderbird client. No specific technical deta...
CVE-2026-16378
Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16382
Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16402
Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-2789
CVE-2026-2789 — Use-after-free in Graphics: ImageLib Affected software: Mozilla Firefox (and Firefox ESR) and Thunderbird. The vulnerability arises from a use-after-free in the Graphics: ImageLib component. Affected versions are fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunder...
CVE-2026-2790
CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...
CVE-2026-2801
CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...
CVE-2026-4691
The CVE-2026-4691 entry describes a use-after-free in Firefox’s CSS Parsing and Computation component. Affected products/versions, as documented across connected sources, include Firefox versions prior to 149 and Firefox ESR prior to 115.34 and 140.9. The root cause is a use-after-free in the CSS...
CVE-2026-4721
Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are affected by memory safety bugs (CVE-2026-4721). These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issue impacts Firefox versions prior to 149, Firefox ESR ver...
CVE-2026-8972
The WebRTC: Audio/Video component in the Mozilla Firefox web browser and Mozilla Thunderbird email client is affected by a privilege escalation vulnerability caused by insecure privilege management . A remote attacker could exploit this flaw to cause service interruptions or achieve elevated priv...
CVE-2004-0762
CVE-2004-0762 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. An attacker could lure a remote web site to trigger interaction events to manipulate the XPInstall Security dialog, allowing installation of arbitrary extensions. The vulnerability is documented with a high ...
CVE-2005-2395
Affected software: Mozilla Firefox 1.0.4 and 1.0.5. Vulnerability type / cause: Firefox may not select the strongest available HTTP authentication challenge as required by RFC2617, potentially causing credentials to be sent in plaintext even when an encrypted channel exists. Impact (as stated): c...
CVE-2009-0071
CVE-2009-0071 affects Mozilla Firefox 3.0.5 and earlier 3.0.x (and later noted 3.0.6/3.0.7) where enabling designMode can trigger a denial of service. The vulnerability allows remote attackers to cause a crash via a crafted sequence: an (a) replaceChild or (b) removeChild call, followed by a (1) ...
CVE-2009-2043
CVE-2009-2043 affects Mozilla Firefox 3.0.2–3.0.10, where interaction with TinyMCE can trigger a NULL pointer dereference leading to a crash (remote DoS). Connected advisories (Mandriva, CentOS, OpenVAS/GLSA) corroborate Firefox-related vulnerabilities in the same era and reference Firefox 3.x co...
CVE-2009-2061
CVE-2009-2061 affects Mozilla Firefox prior to 3.0.10. The vulnerability allows a man-in-the-middle to modify the 3xx HTTP CONNECT response before SSL handshake, enabling a 302 redirect to an arbitrary HTTPS site and potential arbitrary script execution in the context of an HTTPS page. The issue ...
CVE-2009-4129
Technical details about CVE-2009-4129 are not publicly provided in the supplied documents. No concrete information on affected products, versions, impact, or fixes is present here. Monitor for updates from official advisories and vulnerability feeds.
CVE-2010-4508
CVE-2010-4508 affects Mozilla Firefox 4 through 4.0 Beta 7, in the WebSockets implementation. The vulnerability arises from improper handling of proxy upgrade negotiation, tied to an described “inherent problem” with the WebSocket spec. The impact is described as unspecified in the provided sourc...
CVE-2011-3652
CVE-2011-3652 affects Mozilla Firefox and Thunderbird prior to version 8.0 due to a browser engine memory allocation bug. This can cause memory corruption and application crashes, with potential for remote arbitrary code execution via unspecified vectors. Remediation is to upgrade to Firefox/Thun...
CVE-2011-3654
CVE-2011-3654 : The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 mishandles links from SVG mpath elements to non-SVG elements, enabling memory corruption and application crash and possibly arbitrary code execution via unspecified vectors. Impact is a high-severity memor...
CVE-2013-1715
CVE-2013-1715 affects Mozilla Firefox on Windows prior to 23.0, where the full and stub installers are vulnerable to DLL hijacking via a Trojan horse DLL placed in the default Downloads directory. Root cause traces to an incomplete fix for CVE-2012-4206. Impact described as local privilege escala...
CVE-2025-10531
A mitigation bypass vulnerability exists in the Web Compatibility: Tooling component of the Mozilla Firefox browser and Mozilla Thunderbird email client. The flaw allows a malicious actor to circumvent existing security restrictions remotely by exploiting an alternative path or channel that bypas...
CVE-2026-0892
Mozilla Firefox and Thunderbird versions 146 (and versions prior to 147) are affected by memory safety bugs that can lead to memory corruption . An attacker could potentially exploit these vulnerabilities to achieve arbitrary code execution on the system or cause a denial-of-service (DoS) attack....
CVE-2026-2762
CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...
CVE-2026-2773
CVE-2026-2773 is a Chrome-like vulnerability in Firefox’s Web Audio component caused by incorrect boundary conditions, fixed in Firefox 148 and corresponding ESR releases (ESR 115.33 and ESR 140.8). The issue is documented across multiple advisories (Firefox security notes and vendor feeds) and i...
CVE-2026-4701
CVE-2026-4701 is a use-after-free vulnerability in the JavaScript Engine. It affects Firefox and Thunderbird products and is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Exploitation status is not provided in the connected documents.
CVE-2026-8963
The Firefox web browser and Thunderbird email client are vulnerable to a spoofing issue within the Web Speech component. This flaw allows an attacker to bypass authentication through spoofing, potentially leading to a compromise of data integrity . The vulnerability has been addressed in Firefox ...