CVE-2017-7792

The CVE-2017-7792 issue affects Thunderbird (< 52.3), Firefox ESR (< 52.3), and Firefox (

CVE-2017-7800

CVE-2017-7800 is a use-after-free in WebSockets that can trigger a crash when the connection object is freed before disconnection finishes. Affected: Thunderbird < 52.3, Firefox ESR < 52.3, Firefox

CVE-2022-40957

In Firefox on ARM64, CVE-2022-40957 is caused by inconsistent data in the instruction and data caches while building WebAssembly code, leading to a potentially exploitable crash. Affected products include Firefox on ARM64 and Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2022-45411

CVE-2022-45411: Cross-Site Tracing vulnerability in Firefox/Thunderbird due to servers echoing Trace requests and exposure of authorization headers/cookies; mitigations have been implemented via browser fetch/XHR limits and non-standard headers like X-Http-Method-Override. The issue is acknowledg...

CVE-2016-9901

CVE-2016-9901 affects Mozilla Firefox and Firefox ESR. Un-sanitized HTML from the Pocket server could execute JavaScript in the unprivileged about:pocket-saved context, gaining access to Pocket’s messaging API via HTML injection. Impact stated as high/critical by CVSS. Remediation: update to Fire...

CVE-2017-7791

CVE-2017-7791: A data: protocol-based modal alert spoofing vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2017-7826

CVE-2017-7826 ties to memory-safety bugs in Firefox 56/ESR 52.4 and Thunderbird prior to 52.5. Affected versions: Firefox < 57, Firefox ESR < 52.5, Thunderbird

CVE-2021-38491

Mozilla Firefox before version 92 is affected by CVE-2021-38491: mixed-content checks fail to analyze opaque origins, allowing some mixed content to load. The issue is documented across multiple sources (e.g., Mozilla MFSA advisory and distro advisories) and is fixed/upstream mitigated by upgradi...

CVE-2022-40956

CVE-2022-40956 describes a CSP bypass in which injecting an HTML element causes requests to ignore the CSP base-uri setting and use the injected base instead. Affected products include Firefox ESR before 102.3, Thunderbird before 102.3, and Firefox before 105. The vulnerability’s root cause is t...

CVE-2022-46875

CVE-2022-46875 concerns Mozilla Firefox/Thunderbird on Mac OS where the executable warning was not shown when downloading .atloc/.ftploc files, enabling potential command execution. Affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird

CVE-2023-25729

CVE-2023-25729 involves a permissions prompt issue for external schemes that was only shown for ContentPrincipals, allowing extensions using ExpandedPrincipals to open them without user interaction. This could enable actions like downloading files or interacting with installed software. Affected:...

CVE-2023-29535

CVE-2023-29535: The vulnerability arises from a garbage collector compaction issue in Firefox/related products where a weak map could be accessed before proper tracing, leading to memory corruption and a potentially exploitable crash. Affected software per documents includes Firefox (and derivati...

CVE-2014-1505

CVE-2014-1505 affects Mozilla Firefox (and related Mozilla components) where SVG filter operations in feDisplacementMap could leak displacement-correlation data and potentially bypass Same Origin Policy via a timing attack, enabling partial information disclosure from a different domain. Affected...

CVE-2016-9898

CVE-2016-9898 is a use-after-free vulnerability in Mozilla Firefox/Thunderbird affecting Firefox <50.1, Firefox ESR <45.6, and Thunderbird

CVE-2017-5407

CVE-2017-5407 describes a information-disclosure flaw in SVG filters due to floating-point timing side channels that can leak pixel data and history across origins. Affected products include Mozilla Firefox and Thunderbird versions older than 52 (Firefox ESR older than 45.8; Thunderbird older tha...

CVE-2017-5432

CVE-2017-5432 is a use-after-free in Firefox < 53 that can trigger a potentially exploitable crash during certain text-input selection. The vulnerability also affects related Mozilla products in older ESR/thunderbird branches (e.g., Thunderbird < 52.1; ESR

CVE-2017-7807

CVE-2017-7807 describes a domain URL hijack via AppCache fallback, resolved by requiring fallback files to be inside the manifest directory. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2018-5129

The CVE-2018-5129 entry relates to a memory-safety/IPC validation issue where a lack of parameter validation on IPC messages can cause an out-of-bounds write, potentially enabling sandbox escape. Affected products include Mozilla Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2019-11701

CVE-2019-11701 affects Mozilla Firefox prior to 67.0. The issue is caused by the default webcal: protocol handler loading a vulnerable site, enabling cross-site scripting (XSS) attacks. Impact per sources includes potential script execution within the browser context and possible credential theft...

CVE-2021-29983

CVE-2021-29983 affects Firefox for Android (reported as affecting Firefox

CVE-2022-34471

CVE-2022-34471 affects Mozilla Firefox prior to version 102, where the updater failed to verify that the downloaded addon update version matched the manifest, creating a risk that a tampered server manifest could cause a downgrade to an older addon. The issue is documented across multiple connect...

CVE-2023-32212

The CVE-2023-32212 issue is a UI spoofing vulnerability in Mozilla Firefox and Thunderbird where an attacker could position a datalist element to obscure the address bar. Affected products include Firefox versions before 113, Firefox ESR before 102.11, and Thunderbird before 102.11. The connected...

CVE-2024-0750

CVE-2024-0750 affects Firefox (versions prior to 122) and Thunderbird (prior to 115.7), with the issue described as a bug in popup notifications delay calculation that could allow a user to be tricked into granting permissions. Connected advisories confirm the vulnerability and link it to Mozilla...

CVE-2017-5404

CVE-2017-5404 is a use-after-free in Firefox/Thunderbird when manipulating ranges in selections with one node inside a native anonymous tree and one node outside it, leading to a potentially exploitable crash. Affected: Firefox versions before 52 and Firefox ESR before 45.8; Thunderbird versions ...

CVE-2022-29910

CVE-2022-29910 affects Firefox for Android. When the app is closed or sent to the background, HSTS settings were not properly recorded/persisted, potentially weakening TLS protections. Affected: Firefox for Android, versions before 100; other OSs are unaffected. Mitigation: update to the latest F...

CVE-2022-36316

CVE-2022-36316 affects Mozilla Firefox

CVE-2023-32211

CVE-2023-32211 describes a type checking bug in Mozilla Firefox and Thunderbird that could lead to invalid code being compiled. The connected documents confirm the flaw affects Firefox versions prior to 113, Firefox ESR prior to 102.11, and Thunderbird prior to 102.11. Multiple security advisorie...

CVE-2023-37201

CVE-2023-37201 is a WebRTC-related use-after-free in Firefox/Thunderbird: an attacker could trigger memory corruption during HTTPS WebRTC setup. Affected: Firefox <115, Firefox ESR <102.13, Thunderbird

CVE-2012-4186

CVE-2012-4186 : Heap-based buffer overflow in Mozilla Firefox’s nsWaveReader::DecodeAudioData. Affected products include Firefox before 16.0 (and Firefox ESR 10.x before 10.0.8), Thunderbird before 16.0, and SeaMonkey before 2.13. Vectors are unspecified in the provided docs, but exploitation wou...

CVE-2017-7819

CVE-2017-7819 is a use-after-free in the design mode image resizing path that can crash the process if referenced objects have been freed. The vulnerability affects Thunderbird < 52.4 and, per the cited records, Firefox < 56 and Firefox ESR

CVE-2017-7843

Summary (CVE-2017-7843) : In Firefox, Private Browsing mode could be exploited by a web worker to persist data in IndexedDB, enabling cross-session fingerprinting. Affected are Firefox ESR versions older than 52.5.2 and Firefox versions older than 57.0.1. The root cause is that IndexedDB remains ...

CVE-2019-17020

CVE-2019-17020 affects Firefox before 72.0. The issue is a Content Security Policy bypass where an XML file served with CSP includes an XSL stylesheet, and the CSP is not applied to the XSL contents (e.g., JavaScript), bypassing restrictions on the XML document. Impact is CSP bypass via XSL in XM...

CVE-2023-25731

CVE-2023-25731 affects Mozilla Firefox prior to 110, where URL previews in the network panel’s developer tools could allow query parameters to overwrite global objects in privileged code. The issue is confirmed by multiple sources stating Firefox

CVE-2023-25742

CVE-2023-25742 : When importing a SPKI RSA public key as ECDSA P-256, the key is handled incorrectly, causing the tab to crash. Affected products per provided docs: Firefox < 110, Thunderbird < 102.8, and Firefox ESR

CVE-2017-5408

CVE-2017-5408: Cross-origin reading of video captions in Mozilla products due to missing CORS header checks. Affected: Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, Thunderbird

CVE-2017-5428

CVE-2017-5428 is an integer overflow in Mozilla Firefox’s createImageBitmap() that was disclosed via Pwn2Own. Affected products include Firefox (and ESR) versions older than 52.0.1; the issue arises from oversized image offset/length/layout arguments to createImageBitmap, which could enable remot...

CVE-2017-7810

CVE-2017-7810 refers to memory-safety bugs reported in Firefox 55 and Firefox ESR 52.3, with potential to exploit memory corruption to run arbitrary code. Connected documents confirm that Thunderbird

CVE-2021-23955

CVE-2021-23955 affects Mozilla Firefox (pre-85) where a pointer-lock state could be transferred between tabs, enabling clickjacking. Technical details in the CVE description and multiple advisories confirm the underlying issue is a state transfer between tabs related to requestPointerLock. Impact...

CVE-2021-23976

The CVE-2021-23976 entry concerns Firefox for Android where accepting a malicious intent from other installed apps allowed manifests from arbitrary file paths and permitting declaring webapp manifests for other origins. This underlies potential fullscreen UI spoofing and cross-origin attacks on t...

CVE-2021-23985

CVE-2021-23985 affects Mozilla Firefox prior to version 87. The issue involves the ability to alter certain about:config values (e.g., via malware on the user’s machine) that could enable Devtools remote debugging in a way that is unobtrusive to the user, allowing a remote attacker with direct ne...

CVE-2023-25752

CVE-2023-25752 affects Firefox and Thunderbird due to an out-of-bounds risk when accessing throttled streams. The bug stems from not validating the count of available bytes in the caller, allowing potential memory safety issues. Affected versions include Firefox <111, Firefox ESR <102.9, an...

CVE-2023-5722

CVE-2023-5722 describes an information-disclosure vulnerability in Mozilla Firefox prior to 119, where an attacker using iterative requests can learn the size of an opaque response and contents of a server-supplied Vary header. Vendor advisories (Firefox fixes in 119 and ESR 115.4.1/115.4.x as ci...

CVE-2017-5433

CVE-2017-5433 is a use-after-free in SMIL animation functions. Affected software includes Mozilla Firefox builds before 53 and Thunderbird before 52.1 ESR; the underlying issue arises when pointers to animation elements in an array are dropped from the animation controller while still in use, lea...

CVE-2018-5157

CVE-2018-5157 affects Mozilla Firefox prior to 60.0 (including ESR

CVE-2020-26967

The CVE-2020-26967 entry concerns Mozilla Firefox prior to version 83, where a MutationObserver-based page-change listener could cause Firefox Screenshots to interact with injected elements, triggering internal errors and unexpected behavior in the Screenshots code. The description is corroborate...

CVE-2021-29974

CVE-2021-29974 affects Mozilla Firefox before 90. When network partitioning is enabled (e.g., via Enhanced Tracking Protection), a TLS error page could allow overriding an error on an HSTS domain, violating intended error handling. The issue does not affect network connections, which still upgrad...

CVE-2022-45406

CVE-2022-45406 describes a memory-safety flaw in JavaScript: when an out-of-memory condition occurs during creation of a global, a JavaScript realm can be deleted while references linger in a BaseShape, leading to a use-after-free and potentially exploitable crash. Affected products include Firef...

CVE-2023-4058

CVE-2023-4058 involves memory-safety bugs in Mozilla Firefox. The connected docs consistently indicate these flaws are in Firefox 115 and earlier, with the impact described as potential memory corruption that could be exploited to run arbitrary code, i.e., a high-severity, remote-style risk if ex...

CVE-2016-9897

CVE-2016-9897 affects Mozilla Firefox (versions < 50.1) and Firefox ESR (< 45.6) and Thunderbird (

CVE-2016-9902

The CVE-2016-9902 entry concerns Mozilla Firefox/Firefox ESR where the Pocket toolbar button incorrectly accepts events from any origin without verifying the event source. The vulnerability arises from the button listening for events fired from its own pages but not validating the origin, enablin...