CVE-2011-4688

CVE-2011-4688 affects Mozilla Firefox 8.0.1 and earlier. The issue enables an attacker to infer whether a document is present in the browser cache by observing data related to the timing of Same Origin Policy violations during iframe load attempts, via crafted JavaScript. The OpenVAS entries corr...

CVE-2025-11711

This vulnerability exists in Mozilla Firefox and Thunderbird due to a flaw that allows an attacker to modify the values of JavaScript Object properties that are intended to be non-writeable. Affected versions include Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird &...

CVE-2025-13015

Mozilla Firefox and Firefox ESR are affected by a spoofing vulnerability caused by errors in the user interface's information representation. This flaw allows a remote attacker to conduct spear-phishing attacks . The issue impacts versions of Firefox prior to 145 , Firefox ESR prior to 140.5 , an...

CVE-2026-2793

CVE-2026-2793 is a memory-safety issue in Mozilla products (Firefox/Thunderbird) affecting Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. The advisory notes evidence of memory corruption and that, with enough effort, arbitrary code could potentially be exec...

CVE-2026-8960

A spoofing issue in the WebExtensions component of the Firefox web browser and Thunderbird email client allows a malicious actor to bypass authentication processes through spearfishing . Exploiting this vulnerability enables remote compromise of data integrity . The issue was resolved in Firefox ...

CVE-2026-8964

A spoofing issue exists in the Popup Blocker component of the Mozilla Firefox web browser and Mozilla Thunderbird email client. The vulnerability stems from the false representation of critical information within the user interface, which could allow a remote malicious actor to compromise data in...

CVE-2026-92006

Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This security flaw impacts various versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thund...

CVE-2026-92010

The Mozilla Firefox and Mozilla Thunderbird browsers/mail clients are vulnerable to privilege escalation due to incorrect boundary conditions within the Graphics: CanvasWebGL component. This vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Firefox ESR...

CVE-2026-92054

The Memory component in Mozilla Firefox is vulnerable to privilege escalation (CVE-2026-92054). This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit details are provided in the documentation.

CVE-2006-2057

The CVE-2006-2057 issue affects Mozilla Firefox 1.0.6. It describes an argument injection vulnerability where user-assisted attackers could alter command line arguments of an invoked mail client via double-quote characters in a mailto: handler, demonstrated by launching Outlook with an arbitrary ...

CVE-2008-4324

CVE-2008-4324 affects Mozilla Firefox 3.0.3 on Windows XP SP2, with reports also noting Firefox 3.0.2 on Mac OS X 10.5. The vulnerability is a denial of service caused by a NULL pointer dereference in the user interface event dispatcher, triggered by a sequence of UI events (keypress, click, onke...

CVE-2009-4130

Mozilla Firefox vulnerability CVE-2009-4130 affects the MakeScriptDialogTitle function in nsGlobalWindow.cpp. A visual truncation flaw allows remote attackers to spoof the origin domain name of a script by providing an excessively long name, enabling spoofing of the script’s perceived origin. Roo...

CVE-2012-4190

CVE-2012-4190 affects FreeType code path FT2FontEntry::CreateFontEntry used by the Android build of Mozilla Firefox prior to 16.0.1 on CyanogenMod 10. The underlying issue is a memory corruption vulnerability in font handling that could cause an application crash (DoS) and, potentially, arbitrary...

CVE-2025-11153

The Mozilla Firefox web browser is susceptible to a JIT miscompilation vulnerability within the JavaScript Engine: JIT component . This flaw stems from insufficient validation of input data , which can be exploited by a remote attacker to achieve arbitrary code execution on the target system. Thi...

CVE-2025-14333

CVE-2025-14333 corresponds to memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145. The advisory set indicates exploitation could allow arbitrary code execution and affects Firefox/Thunderbird versions before 146 and ESR before 140.6. Remediation guidan...

CVE-2026-2032

Mozilla Firefox for iOS is vulnerable to a security flaw where malicious scripts that interrupt new tab page loading cause a desynchronization between the address bar and the page content. This allows an attacker to spoof arbitrary HTML under a trusted domain. The vulnerability affects versions p...

CVE-2026-4686

CVE-2026-4686 targets the Graphics: Canvas2D component. The root cause is incorrect boundary conditions, exposed in Firefox versions prior to 149, Firefox ESR prior to 115.34, and Firefox ESR prior to 140.9. The connected sources confirm the affected products and versions without detailing exploi...

CVE-2026-4696

The CVE-2026-4696 entry describes a Use-after-free in Firefox’s Layout: Text and Fonts component. Affected products are Firefox versions newer than? actually older than 149 for Firefox, and ESR variants: <115.34 and

CVE-2026-8951

A spoofing issue exists in the Toolbar component of Mozilla Firefox for Android (versions prior to 151.0). This vulnerability allows an attacker to spoof the user interface , potentially misleading the user into performing inaccurate actions. The issue was addressed in Firefox 151 . Exploitation ...

CVE-2026-92050

This vulnerability allows for a sandbox escape due to a race condition in the XPConnect component . The issue has been resolved in Firefox 156 and Thunderbird 156 . While a security sighting was reported on 2026-09-17, specific details regarding exploit vectors or in-the-wild exploitation methods...

CVE-2026-92055

The DevTools component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation . This flaw was addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific technical root cause is not detailed beyond the compo...

CVE-2026-92075

CVE-2026-92075 is a mitigation bypass vulnerability within the Networking component of the Mozilla software suite. The issue was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Technical details from the provided documents indicate that the vulnerability i...

CVE-2006-1273

The CVE-2006-1273 entries pertain to Mozilla Firefox 1.0.7–1.5.0.1, where a DoS could be triggered by an HTML tag containing a large number of script handlers (e.g., onload, onmouseover) when the page source is viewed. The core issue is reported as a crash in Firefox, but Red Hat and Mozilla disp...

CVE-2006-4561

CVE-2006-4561 affects Mozilla Firefox 1.5.0.6. The vulnerability allows remote attackers to execute arbitrary JavaScript in the browser context by hosting a script on an Internet server under the attacker’s control that DNS-pin dropped and triggers a new DNS query, after scripts are already runni...

CVE-2007-1256

CVE-2007-1256 affects Mozilla Firefox 2.0.0.2. A malicious page can spoof the address bar, favicons, and document source by repeatedly setting document.location in the onunload attribute when navigating to another site, a variant of CVE-2007-1092. Affected component: Firefox; vulnerable behavior:...

CVE-2025-10535

The Mozilla Firefox browser for Android contains an information disclosure and mitigation bypass vulnerability in its Privacy component . The root cause is related to the insufficient protection of sensitive data , which could allow a remote attacker to bypass security restrictions and obtain sen...

CVE-2025-11716

Mozilla Firefox and Mozilla Thunderbird versions prior to 144.0 are vulnerable to a security bypass where links in a sandboxed iframe can open external apps on Android without the required "allow-" permission. This flaw allows attackers to bypass security restrictions. Remediation involves updati...

CVE-2025-11717

CVE-2025-11717 affects Mozilla Firefox versions earlier than 144. The issue occurs when switching between Android apps via the card carousel, causing a black screen for the card image if a password-related screen was the last used; before 144, the password edit screen was visible. Practical impac...

CVE-2025-13018

Mozilla Firefox and Thunderbird are affected by a mitigation bypass in the DOM: Security component. This vulnerability allows attackers to circumvent existing security restrictions remotely due to flaws in data protection mechanisms. The issue impacts Firefox versions prior to 145, Firefox ESR ve...

CVE-2025-14329

The Netmonitor component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a privilege escalation flaw due to insecure management of privileges. An attacker could exploit this vulnerability to remotely enhance their privileges. This issue is fixed in Firefox 146 , Firefox ESR 14...

CVE-2025-8364

Mozilla Firefox for Android versions prior to 141 are vulnerable to a flaw where a crafted URL using a blob: URI can hide the true origin of a page. This allows an attacker to perform a spoofing attack by falsely representing information to the user interface. The issue is specific to the Android...

CVE-2026-0890

A spoofing issue exists in the DOM: Copy & Paste and Drag & Drop components of Mozilla Firefox and Mozilla Thunderbird . This vulnerability allows attackers to carry out deceptive attacks by exploiting errors in these specific components. Affected versions include Firefox < 147 , Firefox ESR &...

CVE-2026-16394

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-4705

CVE-2026-4705 is an undefined-behavior issue in the WebRTC: Signaling component. Public disclosures in the initial document indicate the vulnerability affected Firefox and Thunderbird products, with patches delivered in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The accompanying connect...

CVE-2026-4720

Memory safety bugs exist in Mozilla Firefox and Thunderbird (specifically versions Firefox ESR 140.8 , Thunderbird ESR 140.8 , Firefox 148 , and Thunderbird 148 ). These vulnerabilities involve memory corruption that could potentially be exploited with significant effort to achieve arbitrary code...

CVE-2026-92074

CVE-2026-92074 involves a mitigation bypass in the Popup Blocker component of the Mozilla Firefox browser and Thunderbird mail client. This vulnerability is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The provided documents do not specify the underlyin...

CVE-2007-3657

CVE-2007-3657 affects Mozilla Firefox 2.0.0.4, where opening multiple tabs in a popup window may cause a denial of service. The connected records consistently describe the DoS symptom but do not provide a concrete root cause, exploit details, affected sub-versions beyond 2.0.0.4, or an available ...

CVE-2025-10859

An information disclosure vulnerability exists in Mozilla Firefox for iOS due to the incorrect sharing of cookie storage for non-HTML temporary documents with normal browsing content. This flaw allows sensitive information from private tabs to escape Incognito mode , persisting even after the use...

CVE-2025-11152

Mozilla Firefox versions prior to 143.0.3 are vulnerable to a sandbox escape caused by an integer overflow in the Graphics:Canvas2D component. This vulnerability is also described as a security bypass related to deficiencies in access control within isolated environments, potentially allowing a m...

CVE-2025-54143

A security bypass vulnerability exists in Mozilla Firefox for iOS prior to version 141 . The flaw resides in the sandboxed iframe technology, where a sandboxed iframe could potentially allow downloads to the device by bypassing the sandbox restrictions declared on the parent page. Exploitation al...

CVE-2025-55028

Mozilla Firefox for iOS is affected by a denial of service vulnerability prior to version 142 . Malicious scripts utilizing repetitive JavaScript alerts can prevent client user interaction in certain scenarios, potentially leading to a service failure. This issue was addressed in version 142 . Ex...

CVE-2026-0891

Mozilla Firefox and Thunderbird products are affected by memory safety bugs that can lead to memory corruption. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the system. This issue impacts Firefox ESR 140.6 , Thunderbird ESR 140.6 , Firefox 146 , and Thu...

CVE-2026-4725

CVE-2026-4725 describes a sandbox escape due to a use-after-free in the Graphics: Canvas2D component, affecting Firefox versions older than 149. The vulnerability impact is described in public CVE records; no exploitation details are provided in the connected documents. Affected software: Firefox...

CVE-2026-92028

A Use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . While ...

CVE-2026-92032

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird due to an invalid pointer . This flaw allows for the execution of arbitrary code. Impacted versions include Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 1...

CVE-2026-92060

A use-after-free vulnerability exists in the Internationalization component of Mozilla Firefox and Thunderbird . The issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Specific details regarding exploitation vectors or impacts are not provided ...

CVE-2026-92066

A sandbox escape vulnerability exists in the Profile Backup component of Firefox and Thunderbird . The vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific root cause technical details are not provided in the documents, the impact involves a potential escape from the ap...

CVE-2006-3352

CVE-2006-3352 concerns a cross-domain information exposure in Mozilla Firefox via an object tag with a data parameter referencing an attacker’s site, enabling access to restricted content through the object’s outerHTML. The description notes that the original report was retracted and disputed; as...

CVE-2025-11719

CVE-2025-11719 affects Mozilla Firefox and Thunderbird. On Windows, use of the native messaging API by web extensions can trigger use-after-free memory corruption, leading to crashes. Affected versions: Firefox < 144 and Thunderbird

CVE-2025-14323

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the DOM: Notifications component. The root cause involves the execution of operations outside the buffer while processing DOM objects, which could allow an attacker to increase their privileges remotely. Affec...