CVE-2021-43538

CVE-2021-43538 is a race condition in the notification code that could allow spoofing by hiding fullscreen/pointer-lock notifications on affected Mozilla products. Affected: Thunderbird < 91.4.0, Firefox ESR < 91.4.0, Firefox

CVE-2022-31744

CVE-2022-31744 involves an CSS injection flaw that could let an attacker inject CSS into stylesheets accessible via internal URIs (e.g., resource:) and bypass a page's Content Security Policy. Affected products include Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Fire...

CVE-2021-38509

CVE-2021-38509 describes an issue where, due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary contents could be displayed over an attacker’s chosen page. Affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2021-38500

CVE-2021-38500 corresponds to memory-safety bugs in Firefox 92/ESR 91.1–93 and affects Thunderbird and Firefox ESR up to certain versions (Thunderbird <78.15, <91.2; Firefox ESR <91.2, <78.15; Firefox

CVE-2020-15663

CVE-2020-15663 targets Mozilla Firefox (and related Thunderbird/Firefox ESR components) on Windows when Firefox is installed in a user-writable directory. The Mozilla Maintenance Service could invoke updater.exe from the install location with SYSTEM privileges, potentially after rollback to a pre...

CVE-2021-23964

CVE-2021-23964 corresponds to memory-safety bugs in Mozilla Firefox 84 and Firefox ESR 78.6 that could enable memory corruption and potentially arbitrary code execution. Affected products include Firefox <85, Thunderbird <78.7, and Firefox ESR

CVE-2020-12393

CVE-2020-12393 affects Firefox on Windows (and related Mozilla products) where the Devtools Network tab’s Copy as cURL feature failed to properly escape the HTTP method, allowing a website-controlled method to be injected into a pasted terminal command and potentially leading to arbitrary command...

CVE-2020-35113

CVE-2020-35113 concerns memory safety bugs in Mozilla Firefox and Firefox ESR that could allow memory corruption and potential arbitrary code execution. Public docs indicate affected versions include Firefox below 84, Firefox ESR below 78.6, and Thunderbird below 78.6, with fixes coordinated in F...

CVE-2018-18494

CVE-2018-18494 is a same-origin policy violation in Thunderbird/Firefox components caused by using the location property with performance.getEntries to steal cross-origin URL entries. Affected: Thunderbird < 60.4, Firefox ESR < 60.4, Firefox

CVE-2020-15653

CVE-2020-15653 concerns bypassing an iframe sandbox when the sandbox allows popups, via noopener links in affected Firefox ESR < 78.1, Firefox < 79, and Thunderbird

CVE-2020-26953

CVE-2020-26953 : A vulnerability allowing a browser to enter fullscreen mode without displaying the security UI, enabling potential phishing or user confusion. Affected: Firefox < 83, Firefox ESR < 78.5, Thunderbird

CVE-2021-29955

The CVE-2021-29955 FPVI vulnerability affects Mozilla Firefox and Firefox ESR, described as a transient execution flaw that could leak arbitrary memory addresses and potentially enable JIT type confusion. Affected versions include Firefox ESR < 78.9 and Firefox

CVE-2021-43543

CVE-2021-43543 is a CSP sandbox bypass where documents loaded with the CSP sandbox directive could escape restrictions by embedding additional content. Affected products include Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox

CVE-2023-5171

CVE-2023-5171 describes a use-after-free in the Ion compiler’s garbage collection that could allow memory corruption and a potentially exploitable crash, by allowing an attacker to write two NUL bytes. Affected products include Firefox and Thunderbird: Firefox ≤ 117.x (with ESR ≤ 115.3) prior to ...

CVE-2024-9391

CVE-2024-9391: A bug in Firefox Focus for Android could prevent exiting full-screen mode on a specially crafted page, potentially enabling spoofing since the address bar is hidden. Affected: Firefox Focus for Android; Firefox versions before 131. Documented remediation: update to the latest Firef...

CVE-2021-43541

CVE-2021-43541 is a vulnerability in how external protocol handler URLs are processed. In affected products (Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox

CVE-2019-11714

CVE-2019-11714 affects Mozilla Firefox up to version 68.x due to a Necko/UDP threading issue where Necko can access a child on the wrong thread, causing a potentially exploitable crash. Public disclosures in multiple feeds confirm the flaw lies in memory/thread handling within the browser’s netwo...

CVE-2019-11716

Mozilla Firefox contains a memory-safety sandbox issue described as: until explicitly accessed by script, window.globalThis is not enumerable, making it invisible to Object.getOwnPropertyNames(window) and potentially bypassable sandboxing. Affects Firefox versions prior to 68.0. The public docume...

CVE-2020-15658

The CVE-2020-15658 issue affects Mozilla Firefox (non-ESR < 79) and Firefox ESR < 78.1, and Thunderbird

CVE-2020-12418

CVE-2020-12418 describes a flaw where manipulating individual parts of a URL object could cause an out-of-bounds read, leaking process memory to malicious JavaScript. Affected products per the provided data include Firefox ESR < 68.10, Firefox < 78, and Thunderbird

CVE-2021-43545

CVE-2021-43545: Denial of Service via the Location API loop in Firefox/Thunderbird. Affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox

CVE-2020-26958

The CVE-2020-26958 issue is a MIME-type handling flaw: Firefox did not block script execution when responses with incorrect MIME types were intercepted and cached via a ServiceWorker, enabling a cross-site script inclusion or CSP bypass. Affected products are Firefox (non-ESR) < 83, Firefox ES...

CVE-2020-12420

CVE-2020-12420 describes a race-condition use-after-free when connecting to a STUN server, leading to memory corruption and potentially exploitable crashes. Affected products include Thunderbird and Firefox variants prior to versions 68.10.x (Thunderbird < 68.10.0; Firefox ESR < 68.10, Fire...

CVE-2020-15657

CVE-2020-15657 is a Windows-specific DLL hijacking flaw in Mozilla Firefox (and Thunderbird) where attacker-controlled DLLs in the installation directory could be loaded. Affected: Firefox ESR < 78.1, Firefox < 79, Thunderbird

CVE-2022-2505

CVE-2022-2505 describes memory safety bugs in Firefox 102.x (and Thunderbird <102.1) with evidence of memory corruption. Affected: Firefox ESR < 102.1, Firefox < 103, and Thunderbird

CVE-2023-5721

CVE-2023-5721 describes a UX vulnerability where certain browser prompts and dialogs could be activated or dismissed unintentionally by users due to an insufficient activation-delay. Affected products/versions per provided documents: Firefox prior to 119, Firefox ESR prior to 115.4, and Thunderbi...

CVE-2021-38506

CVE-2021-38506 describes a UI spoofing risk in Mozilla products where, after a series of navigations, Firefox could enter fullscreen mode without user notification. Affected: Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2019-11720

CVE-2019-11720 affects Mozilla Firefox before version 68. The issue arises when certain unicode characters are incorrectly treated as whitespace during web content parsing, allowing malicious code to be processed and bypass XSS filtering. The consequence is remote execution of scripts within the ...

CVE-2019-11721

CVE-2019-11721 affects Mozilla Firefox prior to 68.0. The vulnerability allows spoofing of the address bar via the unicode latin 'kra' character, which can cause domain spoofing and user confusion because it may not display as punycode. The connected documents indicate Firefox versions before 68....

CVE-2020-12421

CVE-2020-12421 describes a flaw where add-on updates could reject certificate chains terminating in non-built-in roots, causing add-ons to appear out-of-date without user notification. Public advisories place affected products as Mozilla Firefox ESR (<68.10) and Firefox (<78) and Thunderbird (

CVE-2023-5169

CVE-2023-5169 (Firefox/Thunderbird) involves a compromised content process that could feed malicious data into PathRecording, causing an out-of-bounds write and potentially a crash in a privileged process. Affected products include Firefox <118, Firefox ESR <115.3, and Thunderbird

CVE-2021-43542

CVE-2021-43542 is a information-disclosure vulnerability involving XMLHttpRequest: error messages could reveal the existence of an external protocol handler, enabling an attacker to identify installed applications. Connected sources indicate the issue affects Thunderbird < 91.4.0, Firefox ESR ...

CVE-2019-11718

CVE-2019-11718 affects Mozilla Firefox (before 68.0). The issue arises from Activity Stream writing unsanitized content to innerHTML, enabling potential access to information such as browsing history if the Snippet Service is compromised. The CVE is documented with a CVSS v3.1 base score of 5.3 (...

CVE-2020-12419

CVE-2020-12419 describes a use-after-free in the browser/windowing code: during processing of callbacks in window flushing in the parent process, a window may die, leading to memory corruption and a potentially exploitable crash. Affected products in the provided docs include Thunderbird and Fire...

CVE-2020-15678

CVE-2020-15678 involves a use-after-free in the Gecko rendering stack due to improper iterator invalidation in APZCTreeManager::ComputeClippedCompositionBounds when recursing through graphical layers during scrolling. Affected products include Firefox (before 81), Thunderbird (before 78.3), and F...

CVE-2020-26966

CVE-2020-26966 affects Mozilla Firefox (Windows only) and Thunderbird; the issue arises from a memory leak via broadcasting of single-word search queries as mDNS requests on the local network. Affected products include Firefox before version 83, Firefox ESR before 78.5, and Thunderbird before 78....

CVE-2020-26973

The provided connected sources confirm CVE-2020-26973 affects Mozilla Firefox and Thunderbird, tied to the CSS Sanitizer. Affected versions include Firefox prior to 84 and Thunderbird prior to 78.6 (Firefox ESR

CVE-2020-35112

CVE-2020-35112 is a Windows-specific issue in Mozilla Firefox (affecting Firefox <84, Thunderbird <78.6, and Firefox ESR

CVE-2012-0444

CVE-2012-0444 describes a heap-based memory corruption vulnerability in the libvorbis Ogg Vorbis parser that could allow remote code execution or a crash when processing crafted Ogg Vorbis files. Affected products across Mozilla ecosystem (Firefox, Thunderbird, Seamonkey and related XULRunner/Ice...

CVE-2013-0753

CVE-2013-0753 is a Use‑after‑free vulnerability in Mozilla Firefox’s XMLSerializer.serializeToStream, affecting Firefox before 18.0 (and ESR/Thunderbird/SeaMonkey variants) and allowing remote code execution via crafted content. The issue is exploitable as part of Firefox 17.x lineage; Metasploit...

CVE-2020-15677

CVE-2020-15677 is an Open Redirect vulnerability affecting Firefox < 81, Thunderbird < 78.3, and Firefox ESR

CVE-2022-45403

CVE-2022-45403 describes a vulnerability where Service Workers could infer the size of cross-origin media by correlating timing information with Range requests, potentially exposing presence/length of a media file. Affected: Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2023-4574

CVE-2023-4574 involves a use-after-free in the IPC ColorPickerShownCallback: creating multiple identical callbacks for the Color Picker over IPC, then destroying them all when one finishes. Affected: Firefox < 117, Firefox ESR < 102.15/115.2, Thunderbird

CVE-2023-4584

CVE-2023-4584 relates to memory safety bugs in Firefox and Thunderbird affecting multiple versions (e.g., Firefox 116/ESR 102.x/ Thunderbird 102.x/115.x). Connected advisories confirm the issue and map to Firefox/Thunderbird versions and the remediation path: upgrade to Firefox 117 or ESR 102.15/...

CVE-2023-4585

CVE-2023-4585 describes memory safety bugs in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1, with evidence of memory corruption and the potential for arbitrary code execution. Affected versions are Firefox < 117, Firefox ESR < 115.2, and Thunderbird

CVE-2019-11710

CVE-2019-11710 concerns Mozilla Firefox memory-safety bugs in the browser engine present before Firefox 68. The cited issues allow a remote attacker to potentially execute arbitrary code (and cause DoS) by convincing a user to visit a crafted site. The IBM advisory consolidates multiple CVEs incl...

CVE-2020-12415

CVE-2020-12415 describes AppCache manifest poisoning in Firefox when a URL contains a %2F, which could allow serving a manifest from a subdirectory and potentially cause the appcache to service top-level directory requests. Public references confirm this vulnerability affects Firefox versions ear...

CVE-2020-15654

CVE-2020-15654 affects Mozilla Firefox and Thunderbird where a site-based CSS-override cursor can overlay the UI, causing a perceived broken state and interfering with dialogs. Affected: Firefox ESR earlier than 78.1, Firefox earlier than 79, and Thunderbird earlier than 78.1. Root cause: an erro...

CVE-2019-11725

CVE-2019-11725 affects Mozilla Firefox prior to version 68. The issue is that when a user navigates to a site flagged as unsafe by Safebrowsing, Firefox displays a warning and interrupts navigation, but resources loaded from the same site via websockets are not blocked, allowing unsafe resources ...

CVE-2020-12410

Summary of CVE-2020-12410 : Mozilla reported memory safety bugs in Firefox 76 and Firefox ESR 68.8, which could lead to memory corruption and possibly arbitrary code execution. Affected products and versions per provided docs: Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR