CVE-2023-29548

CVE-2023-29548 concerns a wrong lowering instruction in the ARM64 Ion compiler that yields an incorrect optimization result. The vulnerability affects Firefox (<112), Focus for Android (<112), Firefox ESR (<102.10), Firefox for Android (<112), and Thunderbird (

CVE-2023-6860

CVE-2023-6860: The VideoBridge channel allowed a content process to access textures from remote decoders, creating a potential sandbox escape in Firefox ESR <115.6, Thunderbird <115.6, and Firefox

CVE-2017-5440

CVE-2017-5440 is a use-after-free in XSLT processing caused by failure to propagate error conditions during matching while evaluating context, leading to use of freed objects and potentially a crash. Affected products include Mozilla Firefox (Firefox < 53) and Firefox ESR, and Mozilla Thunderb...

CVE-2018-12406

CVE-2018-12406 concerns memory-safety bugs in Mozilla Firefox 63 that could be exploited to run arbitrary code; Firefox versions prior to 64 are affected. The issue is described as memory corruption with potential remote code execution, supported by NVD metrics (CVSSv3 base score 8.8, HIGH) and r...

CVE-2020-15680

CVE-2020-15680 affects Firefox ≤ 82.0 where referencing a valid external protocol handler in an image tag lets an attacker probe if a protocol handler is registered by distinguishing broken image sizes. The underlying issue is an information disclosure vulnerability related to image tag handling ...

CVE-2020-26963

CVE-2020-26963 affects Firefox versions earlier than 83. The issue arises from repeated calls to the history and location interfaces, which could be exploited to hang the browser. Mozilla addressed this by introducing rate-limiting on those API calls. The CVSS score in the record is 4.3 (Medium) ...

CVE-2020-26967

The CVE-2020-26967 entry concerns Mozilla Firefox prior to version 83, where a MutationObserver-based page-change listener could cause Firefox Screenshots to interact with injected elements, triggering internal errors and unexpected behavior in the Screenshots code. The description is corroborate...

CVE-2023-28164

CWE- style note: CVE-2023-28164 affects Firefox <111, Firefox ESR <102.9, and Thunderbird

CVE-2017-5433

CVE-2017-5433 is a use-after-free in SMIL animation functions. Affected software includes Mozilla Firefox builds before 53 and Thunderbird before 52.1 ESR; the underlying issue arises when pointers to animation elements in an array are dropped from the animation controller while still in use, lea...

CVE-2017-5459

CVE-2017-5459 is a buffer overflow in the WebGL component triggerable by web content. Affected products include Mozilla Firefox (non-ESR) <53 and Thunderbird/Firefox ESR variants listed in the description (Thunderbird <52.1, Firefox ESR <45.9, Firefox ESR <52.1, Firefox

CVE-2018-5131

CVE-2018-5131 affects Mozilla Firefox (ESR < 52.7 and Firefox

CVE-2022-45406

CVE-2022-45406 describes a memory-safety flaw in JavaScript: when an out-of-memory condition occurs during creation of a global, a JavaScript realm can be deleted while references linger in a BaseShape, leading to a use-after-free and potentially exploitable crash. Affected products include Firef...

CVE-2024-0742

The CVE-2024-0742 entry is confirmed with concrete details in connected docs: an incorrect timestamp used to prevent input after page load can cause browser prompts and dialogs to be activated or dismissed unintentionally. Affected products are Firefox < 122, Firefox ESR < 115.7, and Thunde...

CVE-2016-9897

CVE-2016-9897 affects Mozilla Firefox (versions < 50.1) and Firefox ESR (< 45.6) and Thunderbird (

CVE-2017-7753

CVE-2017-7753 is an out-of-bounds read in the rendering path when applying style rules to pseudo-elements (e.g., ::first-line) using cached style data. Affected products/versions include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2021-23974

CVE-2021-23974 affects Mozilla Firefox earlier than version 86. The root cause is improper handling of elements by the DOMParser API, enabling a mXSS vector that could bypass HTML sanitizers. Affected/related advisories (e.g., MFSA2021-07) confirm the DOMParser issue among Firefox vulnerabilitie...

CVE-2021-24001

CVE-2021-24001 affects Mozilla Firefox prior to 88. A compromised content process could perform session history manipulations due to testing infrastructure not restricted to testing-only configurations, constituting a sandbox-escape scenario. Multiple connected sources confirm Firefox

CVE-2023-29533

CVE-2023-29533 affects Firefox (pre-112, ESR pre-102.10, Android-focused builds pre-112) and Thunderbird (

CVE-2023-32216

CVE-2023-32216 describes memory-safety bugs in Mozilla Firefox 112 that could be exploited to run arbitrary code; the vulnerability affects Firefox versions older than 113. Root cause is memory corruption in multiple memory-safety bugs reported by Mozilla’s fuzzing team. Impact is high (likely ar...

CVE-2024-0753

CVE-2024-0753: Affects Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. In certain HSTS configurations, a subdomain could bypass the upper-domain HSTS policy. Public documents from Astra Linux, Debian LTS, and Red Hat/ALAS advisories confirm this as a subdomain HSTS byp...

CVE-2017-7779

CVE-2017-7779 is a set of memory-safety issues reported in Mozilla Thunderbird and Mozilla Firefox components prior to Firefox 55 and Thunderbird 52.3. The Arch Linux ASA-201708-18 and related advisories describe multiple flaws (memory corruption, use-after-free, out-of-bounds reads, and other me...

CVE-2022-22757

CVE-2022-22757 concerns Mozilla Firefox and involves the Remote Agent used in WebDriver not validating the Host or Origin headers. This could allow a website to connect back locally to the user's browser to take control, specifically when WebDriver is enabled (not the default). Affected products ...

CVE-2023-28163

CVE-2023-28163 is a Windows-specific Firefox/Thunderbird vulnerability where the Save As dialog incorrectly resolves environment variables in suggested filenames, causing context exposure to the current user. Affected products are Firefox on Windows (Firefox < 111 and ESR < 102.9) and Thund...

CVE-2013-0754

CVE-2013-0754 is a use-after-free in the ListenerManager of Mozilla Firefox (and related Firefox ESR, Thunderbird, SeaMonkey). According to the description, triggering garbage collection after memory allocation for listener objects can allow a remote attacker to execute arbitrary code. Affected p...

CVE-2019-17000

CVE-2019-17000 affects Firefox versions older than 70. A CSP bypass exists where an object tag with a data: URI did not inherit the parent document’s Content Security Policy in cross-origin frames, potentially allowing inline-script execution in protected documents. Root cause: CSP not correctly ...

CVE-2020-15668

CVE-2020-15668 affects Firefox < 80 and Firefox for Android

CVE-2020-26969

CVE-2020-26969 involves memory safety bugs in Mozilla Firefox 82 that may lead to memory corruption and potential arbitrary code execution. Affected product: Firefox; vulnerable component: memory handling in Firefox prior to 83. Root cause as described: memory safety issues; impact: potential for...

CVE-2023-25730

CVE-2023-25730 describes a browser vulnerability where a background script calling document.documentElement.requestFullscreen and then blocking the main thread can force fullscreen mode indefinitely, potentially causing user confusion or spoofing. The connected documents confirm affected products...

CVE-2023-32214

CVE-2023-32214 affects Mozilla Firefox and Thunderbird on Windows. The vulnerability involves protocol handlers ms-cxh and ms-cxh-full that could be leveraged to trigger a denial of service. Affected versions are Firefox < 113, Firefox ESR < 102.11, and Thunderbird

CVE-2024-7652

CVE-2024-7652 involves a type confusion in the ECMA-262 Async Generators path that could lead to memory corruption and an exploitable crash. Affected products include Firefox and Thunderbird releases prior to 128 (Firefox <128, ESR <115.13; Thunderbird <115.13 and

CVE-2025-5263

The CVE-2025-5263 issue is a published vulnerability where error handling for script execution was not properly isolated from web content, enabling cross-origin leak attacks. Affected products include Firefox (versions earlier than 139, and ESR lines earlier than 115.24/128.11) and Thunderbird (e...

CVE-2013-5609

CVE-2013-5609 is a set of memory-corruption/denial-of-service vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox (including ESR 24.x) and related products prior to versions around 26.0 (per the referenced MiracleLinux AXSA advisories). The issues could allow remote attackers...

CVE-2017-5429

CVE-2017-5429 involves memory safety bugs in Mozilla Firefox (52 and ESR 45.8/52) and Thunderbird 52. Some bugs show memory corruption and could be exploited to run arbitrary code. Affected: Thunderbird < 52.1; Firefox ESR < 45.9, < 52.1; Firefox

CVE-2017-5435

CVE-2017-5435 is a use-after-free in Firefox/Thunderbird during editor design-mode transaction processing, causing a potentially exploitable crash. Public details place affected products as Firefox/Firefox ESR and Thunderbird prior to certain fixed versions (e.g., Thunderbird < 52.1, Firefox E...

CVE-2021-23975

The CVE describes a memory-safety flaw in Firefox affecting versions older than 86, caused by the about:memory Measure function invoking sizeof instead of the API that validates pointers. This could contribute to memory safety issues; Mozilla’s advisories indicate broader memory-safety bugs were ...

CVE-2022-22750

CVE-2022-22750 affects Mozilla Firefox on Windows and macOS (Firefox

CVE-2022-38473

Concrete details for CVE-2022-38473: A cross-origin iframe referencing an XSLT document could inherit the parent domain’s permissions (e.g., microphone or camera) in Thunderbird and Firefox products. Affected: Thunderbird versions earlier than 102.2 and 91.13, Firefox ESR earlier than 91.13 and 1...

CVE-2017-5446

Technical details about CVE-2017-5446 are not publicly available in the provided connected documents. Monitor for updates from vendors and security advisories to confirm affected products, impact, and fixes.

CVE-2017-5449

CVE-2017-5449 affects Mozilla Firefox (and Thunderbird) components where a crash can be triggered during layout/manipulation of bidirectional Unicode text in concert with CSS animations. Public records in connected advisories indicate affected versions: Thunderbird < 52.1, Firefox ESR < 52....

CVE-2018-5187

CVE-2018-5187 corresponds to memory safety bugs reported in Firefox 60/Firefox ESR 60 and affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox

CVE-2020-26952

Mozilla Firefox vulnerability (CVE-2020-26952) involves incorrect bookkeeping of inlined functions during JIT compilation, causing memory corruption and potentially exploitable crashes when handling out-of-memory conditions. Affected: Firefox versions earlier than 83. Root cause: mismanagement in...

CVE-2022-45409

CVE-2022-45409 describes a use-after-free in the garbage collector: GCRuntime::finishCollection could be bypassed, allowing an abort of GC in multiple states/zones and potentially causing a crash that could be exploitable. Affected software includes Firefox ESR < 102.5, Thunderbird < 102.5,...

CVE-2023-6206

CVE-2023-6206 is described across connected sources as a clickjacking-related issue tied to the fullscreen transition in Mozilla Firefox and Thunderbird. The vulnerability affects Firefox versions older than 120, Firefox ESR older than 115.5.0, and Thunderbird older than 115.5.0. The issue is dis...

CVE-2016-10196

CVE-2016-10196 : A stack-based buffer overflow in libevent’s evutil_parse_sockaddr_port (evutil.c) before 2.1.6-beta allows a crafted long string in ip_as_string to cause a denial-of-service (segmentation fault). Affected software is libevent prior to 2.1.6-beta; the description notes the fix in ...

CVE-2017-7823

The CVE-2017-7823 entry describes a CSP sandbox issue where the sandbox did not create a unique origin, causing documents to behave as if allow-same-origin were always specified and enabling potential XSS. Affected products are Mozilla Thunderbird < 52.4, Firefox < 56, and Firefox ESR

CVE-2018-12369

Summary (CVE-2018-12369) WebExtensions bundled with embedded experiments could bypass authorization checks, allowing a malicious WebExtension to gain full browser permissions. Affected products: Mozilla Firefox (non-ESR) versions before 61 and Firefox ESR before 60.1. Root cause: improper authori...

CVE-2020-15674

CVE-2020-15674 is a Firefox memory-safety bug before 81. Mozilla reports memory corruption with enough effort potentially enabling arbitrary code execution. Affected product: Mozilla Firefox (prior to 81); root cause: memory-safety issues leading to memory corruption. Impact: possible remote code...

CVE-2020-26972

CVE-2020-26972 describes a use-after-free in Firefox’s WebGL component caused by a missing check for dead IPC actors, allowing potentially exploitable crashes. Affected product: Firefox (before version 84). Root cause: lifecycle mismanagement of IPC Actors in WebGL; use-after-free when managed ac...

CVE-2022-34474

CVE-2022-34474 affects Mozilla Firefox versions earlier than 102. The issue occurs when an iframe is sandboxed with allow-top-navigation-by-user-activation; if the frame receives a redirect header to an external protocol, the browser processes the redirect and prompts the user. Impact per the ent...

CVE-2022-36317

The CVE-2022-36317 entry concerns Firefox for Android, where visiting a website with an overly long URL can cause the UI to hang due to session restore, potentially leading to a permanent Denial of Service. The incident is documented across multiple sources, including ALAS2FIREFOX-2024-026 (Amazo...