CVE-2016-1940

CVE-2016-1940 affects Mozilla Firefox on Android (pre-44.0). A data: URL mishandling during shortcut opening or BOOKMARK/intent processing allows remote attackers to spoof the address bar. Affected: Firefox on Android before 44.0. Impact: address-bar spoofing. Mitigation: upgrade to Firefox 44.0 ...

CVE-2026-16364

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16401

Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-4688

CVE-2026-4688 describes a sandbox escape caused by a use-after-free in the Disability Access APIs component. The vulnerability affects Firefox versions prior to 149 and Firefox ESR versions prior to 140.9. The available documents do not provide exploit details or specific remediation steps beyond...

CVE-2026-4719

CVE-2026-4719 is a vulnerability described as incorrect boundary conditions in the Graphics: Text component. The connected advisories show affected products as Firefox (and Firefox ESR) and Thunderbird, with fixes implemented in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140...

CVE-2026-8401

A sandbox escape vulnerability exists in the Profile Backup component of Mozilla Firefox and Thunderbird . The flaw is related to a lack of data security mechanisms , which could allow an attacker to cause service interruptions . Affected versions include various builds of Firefox, Firefox ESR, a...

CVE-2026-84130

A vulnerability in the Graphics: WebGPU component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure . This issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . Exploitation details are not provided in the documents.

CVE-2026-84139

A clickjacking vulnerability exists in the DOM: Events component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wild exploitation instances were provi...

CVE-2026-8961

A spoofing issue exists in the Form Autofill component of the Firefox web browser and the Thunderbird email client. This vulnerability allows a malicious actor to potentially compromise data integrity and may facilitate authentication bypass through spearfishing . The issue is fixed in Firefox 15...

CVE-2026-8968

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Web Codecs component due to an invalid pointer . This flaw can lead to service interruptions or program crashes. The vulnerability affects the Firefox web browser and Thunderbird email client. Remediation is available in Firefox 1...

CVE-2026-92019

A mitigation bypass vulnerability exists in the Remote Settings Client component of Mozilla Firefox and Mozilla Thunderbird . This issue is present in various versions, including Firefox 156, ESR 115.41, ESR 140.16, ESR 153.3, and Thunderbird 156, 140.16, and 153.3. The vulnerability was addresse...

CVE-2026-92047

A privilege escalation vulnerability exists in the Crash Reporting component of Mozilla Firefox and Thunderbird. This flaw impacts multiple versions, including Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The vulnerability was addressed in the aforementioned release...

CVE-2004-0762

CVE-2004-0762 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. An attacker could lure a remote web site to trigger interaction events to manipulate the XPInstall Security dialog, allowing installation of arbitrary extensions. The vulnerability is documented with a high ...

CVE-2005-2395

Affected software: Mozilla Firefox 1.0.4 and 1.0.5. Vulnerability type / cause: Firefox may not select the strongest available HTTP authentication challenge as required by RFC2617, potentially causing credentials to be sent in plaintext even when an encrypted channel exists. Impact (as stated): c...

CVE-2008-4723

Mozilla Firefox 3.0.1–3.0.3 is vulnerable to cross-site scripting via ftp:// URLs delivering HTML documents; a remote attacker could inject script when loading (1) JPG, (2) PDF, or (3) TXT files. OpenVAS and SUSE/Ubuntu references confirm the XSS exposure; Exploit-DB lists a dedicated Windows exp...

CVE-2009-0071

CVE-2009-0071 affects Mozilla Firefox 3.0.5 and earlier 3.0.x (and later noted 3.0.6/3.0.7) where enabling designMode can trigger a denial of service. The vulnerability allows remote attackers to cause a crash via a crafted sequence: an (a) replaceChild or (b) removeChild call, followed by a (1) ...

CVE-2009-2043

CVE-2009-2043 affects Mozilla Firefox 3.0.2–3.0.10, where interaction with TinyMCE can trigger a NULL pointer dereference leading to a crash (remote DoS). Connected advisories (Mandriva, CentOS, OpenVAS/GLSA) corroborate Firefox-related vulnerabilities in the same era and reference Firefox 3.x co...

CVE-2009-2061

CVE-2009-2061 affects Mozilla Firefox prior to 3.0.10. The vulnerability allows a man-in-the-middle to modify the 3xx HTTP CONNECT response before SSL handshake, enabling a 302 redirect to an arbitrary HTTPS site and potential arbitrary script execution in the context of an HTTPS page. The issue ...

CVE-2009-2065

CVE-2009-2065 (Mozilla Firefox) : Firefox 3.0.10 (and possibly other versions) is vulnerable to a context-mixing flaw where http content can be loaded in an https page when the top-level frame is https. An MITM attacker could modify an http page to include an https iframe that loads a script from...

CVE-2009-4129

Technical details about CVE-2009-4129 are not publicly provided in the supplied documents. No concrete information on affected products, versions, impact, or fixes is present here. Monitor for updates from official advisories and vulnerability feeds.

CVE-2010-4508

CVE-2010-4508 affects Mozilla Firefox 4 through 4.0 Beta 7, in the WebSockets implementation. The vulnerability arises from improper handling of proxy upgrade negotiation, tied to an described “inherent problem” with the WebSocket spec. The impact is described as unspecified in the provided sourc...

CVE-2011-3652

CVE-2011-3652 affects Mozilla Firefox and Thunderbird prior to version 8.0 due to a browser engine memory allocation bug. This can cause memory corruption and application crashes, with potential for remote arbitrary code execution via unspecified vectors. Remediation is to upgrade to Firefox/Thun...

CVE-2011-3654

CVE-2011-3654 : The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 mishandles links from SVG mpath elements to non-SVG elements, enabling memory corruption and application crash and possibly arbitrary code execution via unspecified vectors. Impact is a high-severity memor...

CVE-2013-1715

CVE-2013-1715 affects Mozilla Firefox on Windows prior to 23.0, where the full and stub installers are vulnerable to DLL hijacking via a Trojan horse DLL placed in the default Downloads directory. Root cause traces to an incomplete fix for CVE-2012-4206. Impact described as local privilege escala...

CVE-2025-13027

Mozilla Firefox and Thunderbird versions prior to 145 are susceptible to memory safety bugs that can result in memory corruption . These vulnerabilities could potentially be exploited by an attacker to execute arbitrary code on the affected system, potentially via remote vectors. The issues have ...

CVE-2026-12322

The Firefox web browser and Thunderbird email client are affected by a clickjacking vulnerability in the Widget: Gtk component. The issue stems from an incorrect limitation on the visible layers of the user interface, which could allow an attacker to cause service failures . This vulnerability ha...

CVE-2026-16393

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16397

Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2026-24868

Mozilla Firefox is affected by a mitigation bypass vulnerability in the Privacy: Anti-Tracking component. This flaw allows a remote attacker to bypass security restrictions and compromise the integrity of protected information by violating data protection mechanisms. The vulnerability is present ...

CVE-2026-2790

CVE-2026-2790 is a same-origin policy bypass in the Networking: JAR component affecting Firefox and Thunderbird. Connected sources confirm the issue and its remediation: Firefox versions 148 and ESR 140.8, as well as Thunderbird 148 and 140.8, include the fix. Astra Linux bulletin also cites the ...

CVE-2026-2794

CVE-2026-2794: Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. Affected: Firefox/Firefox Focus for Android; root cause is uninitialized memory. Status: fixed in Firefox 148.0. Remediation: upgrade to Firefox 148 or later (per Mozilla advisory). Practic...

CVE-2026-2801

CVE-2026-2801 concerns an issue in the JavaScript: WebAssembly component where incorrect boundary conditions were present. Affected software includes Mozilla Firefox and Mozilla Thunderbird; reports indicate the problem was fixed in Firefox 148 and Thunderbird 148. Some sources also reference Thu...

CVE-2026-4691

The CVE-2026-4691 entry describes a use-after-free in Firefox’s CSS Parsing and Computation component. Affected products/versions, as documented across connected sources, include Firefox versions prior to 149 and Firefox ESR prior to 115.34 and 140.9. The root cause is a use-after-free in the CSS...

CVE-2026-4721

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are affected by memory safety bugs (CVE-2026-4721). These vulnerabilities involve memory corruption and could potentially be exploited to execute arbitrary code . The issue impacts Firefox versions prior to 149, Firefox ESR ver...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-8972

The WebRTC: Audio/Video component in the Mozilla Firefox web browser and Mozilla Thunderbird email client is affected by a privilege escalation vulnerability caused by insecure privilege management . A remote attacker could exploit this flaw to cause service interruptions or achieve elevated priv...

CVE-2004-1380

The CVE-2004-1380 issue affects Firefox <1.0 and Mozilla

CVE-2006-5633

Summary: CVE-2006-5633 affects Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b. The issue is a denial of service caused by a null dereference when constructing a range, calling selectNode on a DOCUMENT_TYPE_NODE, and then invoking createContextualFragment on that range. This chain triggers a crash. T...

CVE-2007-1970

CVE-2007-1970 involves Mozilla Firefox where dynamic HTTP elements created on HTTPS pages via a delayed document.write can mislead users and enable phishing content to be served from unauthenticated sources. The vulnerability is described with a moderate base score (CVSS v2.0 base 5.0) and relate...

CVE-2009-1827

CVE-2009-1827 affects Mozilla Firefox 3.0.4 via the SVG component. An attacker can trigger a denial of service (application hang) by sending a large value in the r (Radius) attribute of a circle element, related to an “unclamped loop.” Public sources in the provided documents corroborate a DoS ri...

CVE-2009-2478

CVE-2009-2478 affects Mozilla Firefox 3.5 and can cause a remote denial of service via a NULL pointer dereference related to a “flash bug.” The initial description specifies remote vectors but no concrete exploit details. Connected Fedora/OpenVAS entries confirm the issue is tied to Firefox 3.5 e...

CVE-2011-3665

CVE-2011-3665 affects Mozilla Firefox (4.x–8.0), Thunderbird (5.0–8.0), and SeaMonkey before 2.6. The issue is an improper handling of an Ogg VIDEO element after scaling, which can cause a crash or potentially other impact. Connected advisories corroborate MFSA2011-58 and related fixes across ope...

CVE-2013-6167

The CVE-2013-6167 issue affects Mozilla Firefox before version 28 (reported as Firefox through 27) where HTTP Cookie headers are sent without validating required character-set restrictions. The root cause is improper handling/validation of cookie character sets, enabling attackers to craft a para...

CVE-2014-1584

Mozilla Firefox prior to 33.0 is affected by CVE-2014-1584 through its Public Key Pinning (PKP) implementation. If an issuer-verification error occurs, pinning checks may be skipped, enabling a remote attacker to bypass the configured pin and potentially spoof a site by presenting a crafted certi...

CVE-2025-10531

A mitigation bypass vulnerability exists in the Web Compatibility: Tooling component of the Mozilla Firefox browser and Mozilla Thunderbird email client. The flaw allows a malicious actor to circumvent existing security restrictions remotely by exploiting an alternative path or channel that bypas...

CVE-2026-12307

A memory safety bug has been identified and fixed in Firefox and Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The issue was specifically addressed as a memory safety fix in the Thunderbird client. No specific technical deta...

CVE-2026-16378

Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-16402

Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-2762

CVE-2026-2762 is an integer overflow in the JavaScript: Standard Library component that affects Firefox (non-ESR) and related Mozilla products. The issue is confirmed fixed in Firefox 148 and Firefox ESR 140.8, as well as Thunderbird 148 and Thunderbird 140.8. Connected advisories (Astra Linux bu...