CVE-2021-43546

CVE-2021-43546 concerns cursor spoofing that could overlay the UI when a native cursor is zoomed. Affected products mentioned across connected documents include Thunderbird < 91.4.0 and Firefox < 95 (including Firefox ESR

CVE-2024-9391

The Firefox Focus for Android browser (versions prior to 131) is vulnerable to a flaw where a specially crafted web page can prevent a user from exiting full-screen mode . This can lead to spoofing other sites because the address bar becomes hidden. While the initial description specifies Firefox...

CVE-2019-11757

CVE-2019-11757 affects Mozilla Firefox (versions before 70) and Firefox ESR (before 68.2) as well as Thunderbird (before 68.2). The issue stems from following a value’s prototype chain, which allowed retaining a reference to a locale, deleting it, and then referencing it again, causing a use-afte...

CVE-2020-12419

CVE-2020-12419 describes a use-after-free in the browser/windowing code: during processing of callbacks in window flushing in the parent process, a window may die, leading to memory corruption and a potentially exploitable crash. Affected products in the provided docs include Thunderbird and Fire...

CVE-2020-26978

CVE-2020-26978 is a Firefox/Thunderbird remote-info-exposure vulnerability. A malicious webpage could probe an internal network and access services on the user’s device due to slipstream-based techniques. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR

CVE-2009-2469

CVE-2009-2469 affects Mozilla Firefox prior to 3.0.12. The vulnerability arises from improper handling of an SVG element that has a property with a watch function and an defineSetter function, enabling memory corruption that can lead to a denial of service or potentially remote code execution via...

CVE-2018-12405

The CVE-2018-12405 entry is supported by connected advisories showing memory safety bugs in Firefox 63/ESR 60.3 with potential for arbitrary code execution. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox

CVE-2019-17024

CVE-2019-17024 corresponds to memory-safety bugs in Firefox (and Thunderbird) prior to fixed versions. Affected: Firefox ESR < 68.4 and Firefox

CVE-2020-6801

CVE-2020-6801 refers to memory-safety bugs in Mozilla Firefox involving memory corruption that could be exploited to run arbitrary code. The cited description indicates these memory issues were found in Firefox 72 and could affect users on versions prior to 73, with potential impact on the browse...

CVE-2022-31744

CVE-2022-31744 involves an CSS injection flaw that could let an attacker inject CSS into stylesheets accessible via internal URIs (e.g., resource:) and bypass a page's Content Security Policy. Affected products include Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Fire...

CVE-2020-35111

CVE-2020-35111 covers a proxy.onRequest handling flaw: when an extension with proxy privileges registers for , view-source URLs fail to trigger the proxy.onRequest callback, potentially leaking the user’s IP when viewing source. Affected: Firefox < 84, Thunderbird < 78.6, Firefox ESR

CVE-2019-11758

CVE-2019-11758 is a memory-safety bug in Mozilla Firefox that can lead to arbitrary code execution when 360 Total Security is installed. The advisory notes it affects Firefox versions before 69, Thunderbird before 68.2, and Firefox ESR before 68.2. Public documentation in connected sources confir...

CVE-2019-11760

CVE-2019-11760 describes a fixed-size stack buffer overflow in nrappkit during WebRTC signaling that could lead to a potentially exploitable crash. The vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR

CVE-2021-38506

CVE-2021-38506 describes a UI spoofing risk in Mozilla products where, after a series of navigations, Firefox could enter fullscreen mode without user notification. Affected: Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2019-9793

CVE-2019-9793 describes an issue where, if Spectre mitigations are disabled, bounds checking is loosened for string/array/typed array accesses, enabling an attacker to cause the range analysis to infer controlled, incorrect values in JavaScript. Connected advisories confirm affected products and ...

CVE-2020-12410

Summary of CVE-2020-12410 : Mozilla reported memory safety bugs in Firefox 76 and Firefox ESR 68.8, which could lead to memory corruption and possibly arbitrary code execution. Affected products and versions per provided docs: Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR

CVE-2021-38498

The CVE-2021-38498 entry describes a use-after-free of the nsLanguageAtomService (languages service object) during process shutdown, causing memory corruption and potentially a crash. Affected products include Firefox < 93, Thunderbird < 91.2, and Firefox ESR

CVE-2023-5721

CVE-2023-5721 describes a UX vulnerability where certain browser prompts and dialogs could be activated or dismissed unintentionally by users due to an insufficient activation-delay. Affected products/versions per provided documents: Firefox prior to 119, Firefox ESR prior to 115.4, and Thunderbi...

CVE-2018-18498

CVE-2018-18498 is an integer overflow vulnerability in image buffer size calculations that can cause out-of-bounds writes. The description in connected advisories ties this CVE to Thunderbird and Firefox families (Thunderbird < 60.4, Firefox ESR < 60.4, Firefox

CVE-2020-15663

CVE-2020-15663 targets Mozilla Firefox (and related Thunderbird/Firefox ESR components) on Windows when Firefox is installed in a user-writable directory. The Mozilla Maintenance Service could invoke updater.exe from the install location with SYSTEM privileges, potentially after rollback to a pre...

CVE-2021-23964

CVE-2021-23964 corresponds to memory-safety bugs in Mozilla Firefox 84 and Firefox ESR 78.6 that could enable memory corruption and potentially arbitrary code execution. Affected products include Firefox <85, Thunderbird <78.7, and Firefox ESR

CVE-2019-11714

CVE-2019-11714 affects Mozilla Firefox up to version 68.x due to a Necko/UDP threading issue where Necko can access a child on the wrong thread, causing a potentially exploitable crash. Public disclosures in multiple feeds confirm the flaw lies in memory/thread handling within the browser’s netwo...

CVE-2021-29955

The CVE-2021-29955 FPVI vulnerability affects Mozilla Firefox and Firefox ESR, described as a transient execution flaw that could leak arbitrary memory addresses and potentially enable JIT type confusion. Affected versions include Firefox ESR < 78.9 and Firefox

CVE-2018-18494

CVE-2018-18494 is a same-origin policy violation in Thunderbird/Firefox components caused by using the location property with performance.getEntries to steal cross-origin URL entries. Affected: Thunderbird < 60.4, Firefox ESR < 60.4, Firefox

CVE-2020-15654

This vulnerability affects Firefox ESR < 78.1 , Firefox < 79 , and Thunderbird

CVE-2020-26953

CVE-2020-26953 : A vulnerability allowing a browser to enter fullscreen mode without displaying the security UI, enabling potential phishing or user confusion. Affected: Firefox < 83, Firefox ESR < 78.5, Thunderbird

CVE-2019-11716

Mozilla Firefox contains a memory-safety sandbox issue described as: until explicitly accessed by script, window.globalThis is not enumerable, making it invisible to Object.getOwnPropertyNames(window) and potentially bypassable sandboxing. Affects Firefox versions prior to 68.0. The public docume...

CVE-2020-35113

CVE-2020-35113 concerns memory safety bugs in Mozilla Firefox and Firefox ESR that could allow memory corruption and potential arbitrary code execution. Public docs indicate affected versions include Firefox below 84, Firefox ESR below 78.6, and Thunderbird below 78.6, with fixes coordinated in F...

CVE-2020-12393

CVE-2020-12393 affects Firefox on Windows (and related Mozilla products) where the Devtools Network tab’s Copy as cURL feature failed to properly escape the HTTP method, allowing a website-controlled method to be injected into a pasted terminal command and potentially leading to arbitrary command...

CVE-2023-4584

CVE-2023-4584 relates to memory safety bugs in Firefox and Thunderbird affecting multiple versions (e.g., Firefox 116/ESR 102.x/ Thunderbird 102.x/115.x). Connected advisories confirm the issue and map to Firefox/Thunderbird versions and the remediation path: upgrade to Firefox 117 or ESR 102.15/...

CVE-2019-11720

CVE-2019-11720 affects Mozilla Firefox before version 68. The issue arises when certain unicode characters are incorrectly treated as whitespace during web content parsing, allowing malicious code to be processed and bypass XSS filtering. The consequence is remote execution of scripts within the ...

CVE-2020-15653

CVE-2020-15653 concerns bypassing an iframe sandbox when the sandbox allows popups, via noopener links in affected Firefox ESR < 78.1, Firefox < 79, and Thunderbird

CVE-2020-15657

CVE-2020-15657 is a Windows-specific DLL hijacking flaw in Mozilla Firefox (and Thunderbird) where attacker-controlled DLLs in the installation directory could be loaded. Affected: Firefox ESR < 78.1, Firefox < 79, Thunderbird

CVE-2022-2505

CVE-2022-2505 describes memory safety bugs in Firefox 102.x (and Thunderbird <102.1) with evidence of memory corruption. Affected: Firefox ESR < 102.1, Firefox < 103, and Thunderbird

CVE-2023-25751

CVE-2023-25751 affects Firefox and Thunderbird: root cause is incorrect code generation during JIT code invalidation when following an iterator, which could lead to a potentially exploitable crash. Affected: Firefox <=111 and Firefox ESR <=102.8/9, Thunderbird

CVE-2023-4574

CVE-2023-4574 involves a use-after-free in the IPC ColorPickerShownCallback: creating multiple identical callbacks for the Color Picker over IPC, then destroying them all when one finishes. Affected: Firefox < 117, Firefox ESR < 102.15/115.2, Thunderbird

CVE-2012-0444

CVE-2012-0444 describes a heap-based memory corruption vulnerability in the libvorbis Ogg Vorbis parser that could allow remote code execution or a crash when processing crafted Ogg Vorbis files. Affected products across Mozilla ecosystem (Firefox, Thunderbird, Seamonkey and related XULRunner/Ice...

CVE-2022-45403

CVE-2022-45403 describes a vulnerability where Service Workers could infer the size of cross-origin media by correlating timing information with Range requests, potentially exposing presence/length of a media file. Affected: Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2020-12418

CVE-2020-12418 describes a flaw where manipulating individual parts of a URL object could cause an out-of-bounds read, leaking process memory to malicious JavaScript. Affected products per the provided data include Firefox ESR < 68.10, Firefox < 78, and Thunderbird

CVE-2019-11721

CVE-2019-11721 affects Mozilla Firefox prior to 68.0. The vulnerability allows spoofing of the address bar via the unicode latin 'kra' character, which can cause domain spoofing and user confusion because it may not display as punycode. The connected documents indicate Firefox versions before 68....

CVE-2021-38501

CVE-2021-38501 is a memory-safety issue affecting Firefox up to version 92/ESR 91.1 with memory-corruption risks; impacted products include Firefox <93, Thunderbird <91.2, and Firefox ESR

CVE-2020-15655

CVE-2020-15655 affects Mozilla Firefox (including ESR) and Thunderbird, where a redirected HTTP request observed or modified through a web extension could bypass Same-Origin Policy via extension APIs, potentially disclosing cross-origin information. Affected versions include Firefox ESR <78.1,...

CVE-2020-15658

The CVE-2020-15658 issue affects Mozilla Firefox (non-ESR < 79) and Firefox ESR < 78.1, and Thunderbird

CVE-2020-15678

CVE-2020-15678 involves a use-after-free in the Gecko rendering stack due to improper iterator invalidation in APZCTreeManager::ComputeClippedCompositionBounds when recursing through graphical layers during scrolling. Affected products include Firefox (before 81), Thunderbird (before 78.3), and F...

CVE-2024-0741

CVE-2024-0741 describes an out-of-bounds write in ANGLE that could corrupt memory and cause a potentially exploitable crash. Affected software includes Firefox up to version 121/122 and Firefox ESR up to 115.7, as well as Thunderbird up to 115.7. The connected advisories indicate the root cause i...

CVE-2026-15718

The Mozilla Firefox web browser and Mozilla Thunderbird mail client are affected by CVE-2026-15718 , which involves an invalid pointer in the JavaScript: WebAssembly component. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information . The flaw has been addresse...

CVE-2020-35112

CVE-2020-35112 is a Windows-specific issue in Mozilla Firefox (affecting Firefox <84, Thunderbird <78.6, and Firefox ESR

CVE-2018-12392

CVE-2018-12392 is a vulnerability affecting Firefox (pre-63 and ESR pre-60.3) and Thunderbird (pre-60.3) where manipulating user events in nested loops while opening a document via script can trigger a crash due to poor event handling. Public advisories list the impact as a potentially exploitabl...

CVE-2020-15670

CVE-2020-15670 involves memory safety bugs in Mozilla Firefox components, affecting Firefox for Android 79 and other Firefox variants prior to 80, including Firefox ESR < 78.2 and Thunderbird

CVE-2020-26966

CVE-2020-26966 affects Mozilla Firefox (Windows only) and Thunderbird; the issue arises from a memory leak via broadcasting of single-word search queries as mDNS requests on the local network. Affected products include Firefox before version 83, Firefox ESR before 78.5, and Thunderbird before 78....