CVE-2020-26973

The provided connected sources confirm CVE-2020-26973 affects Mozilla Firefox and Thunderbird, tied to the CSS Sanitizer. Affected versions include Firefox prior to 84 and Thunderbird prior to 78.6 (Firefox ESR

CVE-2023-4581

CVE-2023-4581 covers a blocklist gap where Excel .xll add-in files could be downloaded without warnings due to Firefox’s executable blocklist lacking an entry. Affected products/versions shown in the documents: Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 10...

CVE-2026-15718

The Mozilla Firefox web browser and Mozilla Thunderbird mail client are affected by CVE-2026-15718 , which involves an invalid pointer in the JavaScript: WebAssembly component. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information . The flaw has been addresse...

CVE-2009-2408

CVE-2009-2408 affects Mozilla NSS up to 3.12.2/Firefox up to 3.0.12/ Thunderbird up to 2.0.0.22 and SeaMonkey up to 1.1.17. The issue is improper handling of a '\0' character in the domain name present in the certificate subject’s Common Name (CN) field of an X.509 certificate. This enables a man...

CVE-2017-5436

CVE-2017-5436 is an out-of-bounds write in the Graphite 2 library triggered by a malicious Graphite font, causing a potentially exploitable crash. The issue was fixed in Graphite 2 and in Mozilla products; affected Mozilla components include Thunderbird < 52.1, Firefox ESR < 45.9 and < 5...

CVE-2019-11718

CVE-2019-11718 affects Mozilla Firefox (before 68.0). The issue arises from Activity Stream writing unsanitized content to innerHTML, enabling potential access to information such as browsing history if the Snippet Service is compromised. The CVE is documented with a CVSS v3.1 base score of 5.3 (...

CVE-2020-12421

CVE-2020-12421 describes a flaw where add-on updates could reject certificate chains terminating in non-built-in roots, causing add-ons to appear out-of-date without user notification. Public advisories place affected products as Mozilla Firefox ESR (<68.10) and Firefox (<78) and Thunderbird (

CVE-2023-4580

CVE-2023-4580 : Pushed notifications stored on disk in private browsing mode were not encrypted, potentially leaking sensitive information. Affected: Firefox < 117, Firefox ESR < 115.2, Thunderbird

CVE-2023-5728

CVE-2023-5728 : In the Firefox/Thunderbird stack, during garbage collection extra operations on an object that should not be touched could lead to a potentially exploitable crash. Affected: Firefox < 119, Firefox ESR < 115.4, and Thunderbird

CVE-2023-4573

The CVE-2023-4573 issue is a memory corruption/use-after-free in Mozilla's IPC path (mStream) that can be triggered when rendering data is received via IPC. Connected documents confirm affected products include Firefox and Thunderbird (multiple ESR branches) with vulnerable components tied to IPC...

CVE-2023-4578

CVE-2023-4578 affects Firefox and Thunderbird: a failure in JS::CheckRegExpSyntax could mishandle an out-of-memory (OOM) condition as a Syntax Error, potentially leading to crashes. Affected versions are Firefox < 117, Firefox ESR < 115.2, and Thunderbird

CVE-2023-5168

CVE-2023-5168 refers to a vulnerability in Firefox on Windows where a compromised content process could supply malicious data to FilterNodeD2D1, causing an out-of-bounds write and potentially crashing a privileged process. The entry notes a high/critical risk with a base score of 9.8 (CVSSv3.1) a...

CVE-2013-0753

CVE-2013-0753 is a Use‑after‑free vulnerability in Mozilla Firefox’s XMLSerializer.serializeToStream, affecting Firefox before 18.0 (and ESR/Thunderbird/SeaMonkey variants) and allowing remote code execution via crafted content. The issue is exploitable as part of Firefox 17.x lineage; Metasploit...

CVE-2020-12415

CVE-2020-12415 describes AppCache manifest poisoning in Firefox when a URL contains a %2F, which could allow serving a manifest from a subdirectory and potentially cause the appcache to service top-level directory requests. Public references confirm this vulnerability affects Firefox versions ear...

CVE-2019-11725

CVE-2019-11725 affects Mozilla Firefox prior to version 68. The issue is that when a user navigates to a site flagged as unsafe by Safebrowsing, Firefox displays a warning and interrupts navigation, but resources loaded from the same site via websockets are not blocked, allowing unsafe resources ...

CVE-2019-11728

CVE-2019-11728 affects Mozilla Firefox prior to 68. The issue arises from the Alt-Svc (HTTP Alt-Svc) header which a malicious site can leverage to scan all TCP ports of hosts reachable by a user when web content is loaded. Impact is limited to information exposure via port discovery; no explicit ...

CVE-2020-15677

CVE-2020-15677 is an Open Redirect vulnerability affecting Firefox < 81, Thunderbird < 78.3, and Firefox ESR

CVE-2023-29536

The CVE-2023-29536 entry applies to Mozilla products (Firefox, Focus, Thunderbird, Firefox ESR, and Firefox for Android) with memory-management weakness in freeing a pointer to attacker-controlled memory. Impacted versions include Firefox <112, Focus for Android <112, Firefox ESR <102.10...

CVE-2023-4583

CVE-2023-4583 concerns a logic issue in the HTTP/Browsing Context handling within Mozilla Firefox/Thunderbird. The flaw occurs when HttpBaseChannel checks whether a Browsing Context has been discarded; if the load group is unavailable, it may assume discard even for private channels after a priva...

CVE-2023-5172

CVE-2023-5172 affects Mozilla Firefox versions earlier than 118. The vulnerability arises from a hashtable in the Ion Engine being mutated while a live interior reference exists, causing a use-after-free and a potentially exploitable crash. The issue is described as impacting Firefox

CVE-2024-0743

CVE-2024-0743 describes an unchecked return value in TLS handshake code that could cause a potentially exploitable crash. Affected products per the provided documents are Mozilla Firefox (including ESR) and Thunderbird prior to the patched versions: Firefox < 122, Firefox ESR < 115.9, and T...

CVE-2023-4051

CVE-2023-4051: The vulnerability relates to the full screen notification being obscured by the file Open dialog, potentially enabling user confusion and spoofing. Public details across connected documents identify the issue in Mozilla products including Firefox and Thunderbird before certain vers...

CVE-2019-11710

CVE-2019-11710 concerns Mozilla Firefox memory-safety bugs in the browser engine present before Firefox 68. The cited issues allow a remote attacker to potentially execute arbitrary code (and cause DoS) by convincing a user to visit a crafted site. The IBM advisory consolidates multiple CVEs incl...

CVE-2020-15676

CVE-2020-15676 affects Firefox (and related Mozilla products) where the onload handler for SVG elements could run after the DOM sanitizer removed content, enabling JavaScript execution when pasting attacker-controlled data into a contenteditable area. Affected versions: Firefox < 81, Thunderbi...

CVE-2026-10702

Mozilla Firefox is affected by a JIT miscompilation vulnerability in the JavaScript Engine: JIT component . The root cause is attributed to type mixing errors during JIT compilation, which can be exploited by a remote attacker to achieve arbitrary code execution . The vulnerability was addressed ...

CVE-2013-0758

CVE-2013-0758 affects Mozilla Firefox (pre-18.0), Firefox ESR (pre-10.0.12 and pre-17.0.2), Thunderbird (pre-17.0.2, including ESR 10.x pre-10.0.12 and pre-17.0.2), and SeaMonkey (pre-2.15). It allows remote attackers to execute arbitrary JavaScript with chrome privileges due to improper interact...

CVE-2023-4577

CVE-2023-4577 is a memory-corruption issue in the Firefox/Thunderbird code path where UpdateRegExpStatics could access initialStringHeap after it had been garbage collected, potentially causing an exploitable crash. Connected advisories corroborate that affected products include Firefox versions ...

CVE-2017-5460

CVE-2017-5460 is a use-after-free in Firefox/Thunderbird frame selection. Public docs confirm it affects Firefox/Firefox ESR (before 53) and Thunderbird (older branches) with a potentially exploitable crash and, in some advisories, possible arbitrary code execution. Root cause: use-after-free dur...

CVE-2020-12416

CVE-2020-12416 describes a use-after-free in the WebRTC path where VideoStreamEncoder may be freed in a race with VideoBroadcaster::AddOrUpdateSink, causing memory corruption and a potentially exploitable crash. The vulnerability affects Mozilla Firefox releases before 78. The issue is mitigated ...

CVE-2021-38497

CVE-2021-38497 describes a UI spoofing issue caused by using reportValidity() together with window.open(), which could overlay a plain-text validation message on another origin. Affected software versions are Firefox < 93, Thunderbird < 91.2, and Firefox ESR

CVE-2020-12424

Vulnerability CVE-2020-12424 affects Firefox earlier than 78, where a WebRTC permission prompt could be bypassed if a URI from the content process was untrusted and potentially the origin that had been previously granted permission. Connected advisories and vendor updates indicate this issue was ...

CVE-2023-29539

Concrete details found: CVE-2023-29539 (Content-Disposition filename truncation on NULL) affects Firefox family and Thunderbird; root cause is NULL character in filename causing truncation and potential Reflected File Download. Connected documents (Astra Linux bulletin, Debian/CentOS advisories) ...

CVE-2025-4918

The Firefox and Thunderbird web browsers are vulnerable to an out-of-bounds read or write on a JavaScript Promise object. This memory safety issue is present in Firefox versions prior to 138.0.4, Firefox ESR versions prior to 128.10.1 and 115.23.1, and Thunderbird versions prior to 128.10.2. The ...

CVE-2020-12422

CVE-2020-12422 affects Mozilla Firefox (non-standard configurations). The root cause is an integer overflow in nsJPEGEncoder::emptyOutputBuffer when handling a JPEG image created by JavaScript, leading to an out-of-bounds write and memory corruption that could cause a crash. The vulnerability is ...

CVE-2023-4575

CVE-2023-4575 describes a memory safety risk in Mozilla components where IPC FilePickerShownCallback could suffer a use-after-free due to multiple identical callbacks being created and destroyed concurrently during File Picker window invocation. Affected products include Firefox (all listed varia...

CVE-2023-5174

The CVE-2023-5174 entry describes a Windows-specific issue in the Firefox sandbox handling: if a process fails to duplicate a handle during process creation, the sandbox code may double-free a pointer, causing a use-after-free and potentially an exploitable crash. Affected products are Firefox be...

CVE-2019-11749

CVE-2019-11749 describes an information-disclosure vulnerability in WebRTC: malicious content can probe the getUserMedia constraints to reveal camera device properties without user prompt, enabling potential user fingerprinting. Affected products are Firefox prior to 69 and Firefox ESR prior to 6...

CVE-2019-9801

CVE-2019-9801 affects Mozilla Firefox and Thunderbird on Windows. The issue allows Firefox/Thunderbird to treat any registered Program ID as an external protocol handler and offer to launch a local application when a matching URL is opened, even if the program is not intended as a URL handler. Ro...

CVE-2019-9818

CVE-2019-9818 is a use-after-free in the crash generation server used by Mozilla Firefox/Thunderbird on Windows. The issue, described as a race condition in the crash reporter server, can lead to a potentially exploitable crash and sandbox escape. Public references indicate the vulnerability affe...

CVE-2020-12426

CVE-2020-12426 references memory-safety bugs in Firefox 77 that could potentially allow arbitrary code execution and affect Firefox versions earlier than 78. The connected advisories consistently indicate that fixes were implemented in Firefox 78 (and Thunderbird-related components) and that this...

CVE-2023-4053

The CVE-2023-4053 issue describes a UI spoofing risk where a website could obscure a full-screen notification by using a URL scheme handled by an external program (e.g., mailto). Affected products: Mozilla Firefox (non-ESR) and Thunderbird prior to certain versions; specifically Firefox <116, ...

CVE-2023-5170

In Firefox, CVE-2023-5170 covers a memory leak in the canvas rendering path where a compromised content process could cause a surface to change unexpectedly, leaking privileged-process memory and potentially enabling a sandbox escape. Affected software: Mozilla Firefox versions prior to 118. Root...

CVE-2023-6135

CVE-2023-6135 corresponds to a Minerva side-channel vulnerability affecting NSS and Firefox, potentially enabling private-key recovery. The primary affected component is NSS NIST curves; Firefox versions before 121 are listed as affected. Public documents indicate remediation through updated NSS ...

CVE-2019-11724

CVE-2019-11724 affects Mozilla Firefox prior to version 68. The issue is an access restriction bypass caused by application permissions that granted an unnecessary remote troubleshooting permission to input.mozilla.org, which has since retired and redirects elsewhere. Impact described across conn...

CVE-2019-11735

CVE-2019-11735 is a memory-safety bug in Firefox/Firefox ESR before version 69.0 and 68.1 respectively, with Mozilla noting memory corruption and potentially arbitrary code execution. Public sources (Arch Linux ASA-201909-2, FreeBSD Vuxml, Debian/IBM OS bulletins) confirm it as a Firefox vulnerab...

CVE-2021-29981

CVE-2021-29981 affects Firefox < 91 and Thunderbird

CVE-2019-11723

CVE-2019-11723 affects Mozilla Firefox prior to version 68, where during add-on installation the initial fetch ignored origin attributes of the browsing context, potentially leaking cookies in private browsing or across Firefox Multi-Account Containers. The issue is documented in multiple sources...

CVE-2019-9815

CVE-2019-9815 describes a timing-attack similar to Spectre when hyperthreading is not disabled. Affected: macOS content threads (macOS 10.14.5 introduces a sysctl option to disable hyperthreading for untrusted code on the main or worker JavaScript threads), and affected Firefox/Thunderbird versio...

CVE-2020-12425

CVE-2020-12425 affects Firefox: a one-byte out-of-bounds read in Date.parse() due to hyphen processing could disclose information. Affected product line is Firefox before version 78. Several connected advisories confirm this issue alongside other CVEs and show that fixes were included in subseque...

CVE-2023-5724

The connected Astra Linux bulletin confirms CVE-2023-5724: Drivers are not always robust to extremely large draw calls, potentially causing crashes in Firefox before 119, Firefox ESR before 115.4, and Thunderbird before 115.4.1. Affected versions are Firefox <119, Firefox ESR <115.4, Thunde...