CVE-2025-5263

The CVE-2025-5263 issue is a published vulnerability where error handling for script execution was not properly isolated from web content, enabling cross-origin leak attacks. Affected products include Firefox (versions earlier than 139, and ESR lines earlier than 115.24/128.11) and Thunderbird (e...

CVE-2014-1508

CVE-2014-1508 affects Mozilla Firefox family components (libxul) where libxul.so!gfxContext::Polygon can leak memory, cause out-of-bounds reads, or crash, with potential Same Origin Policy bypass via MathML polygon rendering. Affected: Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbir...

CVE-2016-5297

CVE-2016-5297 is an argument length checking error in JavaScript that can trigger integer overflows, affecting Mozilla Thunderbird <45.5, Firefox ESR <45.5, and Firefox

CVE-2018-12358

CVE-2018-12358 affects Mozilla Firefox prior to 61.0. The issue arises from how service workers can use redirection to avoid tainting of cross-origin resources, allowing a malicious site to read responses that should be opaque. Impact is read access to cross-origin responses; affected are Firefox...

CVE-2020-12411

CVE-2020-12411 concerns Mozilla Firefox memory-safety bugs (in Firefox 76) that the researchers cited as potentially exploitable to achieve arbitrary code execution. The provided documents consistently indicate the vulnerability affects Firefox versions earlier than 77. The root cause described a...

CVE-2021-29972

CVE-2021-29972 is a use-after-free vulnerability linked to an out-of-date Cairo library affecting Mozilla Firefox versions earlier than 90. The issue was identified via testing and updating Cairo (and/or Firefox to a newer Firefox 90+ version) was reported to resolve the vulnerability and may als...

CVE-2022-28284

CVE-2022-28284 affects Mozilla Firefox older than 99. The SVG element could load unexpected content and execute scripts, aligning Gecko with other browsers but diverging from spec-driven security expectations. Impact is high across confidentiality, integrity, and availability. Firefox 99 and lat...

CVE-2022-34476

CVE-2022-34476: Mozilla Firefox ASN.1 parsing flaw where an indefinite SEQUENCE inside an indefinite GROUP could cause malformed ASN.1 to be accepted. Affected: Firefox prior to 102.0. Reported impact includes potential arbitrary code execution, information disclosure, DoS, and security bypass. R...

CVE-2023-6207

CVE-2023-6207: Ownership mismanagement leads to a use-after-free in ReadableByteStreams. Affected products include Firefox < 120 and Thunderbird

CVE-2012-1970

CVE-2012-1970 affects Mozilla Firefox before 15.0, Thunderbird before 15.0, ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue stems from multiple unspecified vulnerabilities in the browser engine that can allow remote attackers to cause memory corruption and application crashes or pote...

CVE-2014-1518

CVE-2014-1518 affects Mozilla Firefox and related browsers (Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). Reported impact per the connected advisories: remote memory corruption and application crash, with potential arbitrary code execution via...

CVE-2017-5400

The CVE-2017-5400 entry describes a exploit scenario arising from a JIT-spray targeting asm.js combined with a heap spray that bypasses ASLR and DEP, potentially causing memory corruption. Connected IBM advisories confirm affected product: IBM Storwize V7000 Unified (codes 1.5.1.0–1.5.2.5) with F...

CVE-2019-11734

CVE-2019-11734 refers to memory safety bugs in Firefox 68 that may allow arbitrary code execution and affect Firefox versions older than 69. The issue is described as memory corruption with potential exploitation but no exploit details are provided in the initial description beyond that. The vuln...

CVE-2020-15684

The CVE-2020-15684 entry concerns Mozilla Firefox memory-safety bugs in Firefox 81 that Mozilla described as allowing memory corruption with enough effort to potentially execute arbitrary code. Affected software is Firefox versions prior to 82.0. The documented impact is remote code execution ris...

CVE-2021-29975

CVE-2021-29975 affects Mozilla Firefox earlier than 90. Through DOM manipulations, an attacker could overlay a message (text only) on top of another domain while the address bar showed the new domain, potentially leading to user confusion or spoofing. The issue is tied to content spoofing in Fire...

CVE-2022-22752

The CVE-2022-22752 entry corresponds to memory‑safety bugs in Mozilla Firefox 95 that could be exploited to run arbitrary code. Affected software is Firefox prior to version 96; the root cause is memory corruption in certain code paths described across multiple advisories. Impact is memory corrup...

CVE-2022-22757

CVE-2022-22757 concerns Mozilla Firefox and involves the Remote Agent used in WebDriver not validating the Host or Origin headers. This could allow a website to connect back locally to the user's browser to take control, specifically when WebDriver is enabled (not the default). Affected products ...

CVE-2023-25734

CVE-2023-25734 affects Mozilla Firefox on Windows. It arises when a user opens a local Windows .url shortcut, allowing an attacker to supply a remote path that can trigger unexpected network requests and potentially leak NTLM credentials. Affected versions: Firefox before 110, Thunderbird before ...

CVE-2024-0747

CVE-2024-0747 describes a CSP bypass: when a parent page loads a child in an iframe with unsafe-inline, the parent CSP could override the child CSP. Affected: Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Practical impact: potential bypass of content security policie...

CVE-2014-1493

CVE-2014-1493 is a Mozilla Firefox/Thunderbird/SeaMonkey browser-engine vulnerability reported in multiple advisories. IBM Storwize V7000 Unified and IBM SONAS bulletins note these issues affect shipped Firefox and advise upgrading to version 1.4.3.3 (Storwize Unified) or 1.4.3.3 (SONAS) to apply...

CVE-2014-1514

CVE-2014-1514 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue arises from not validating the length of the destination array before a copy operation in TypedArrayObject, allowing remote attackers to execute arbitrary...

CVE-2018-12370

CVE-2018-12370 : In Firefox Reader View, SameSite cookie protections are not checked on exit, allowing a payload to trigger when Reader View is left if loaded from a malicious site while Reader mode is active, bypassing CSRF protections. Affected products are Firefox versions earlier than 61.0. C...

CVE-2019-11765

Summary: CVE-2019-11765 affects Firefox versions before 70.0. A compromised content process could send a message to the parent process to show the Click to Play permission prompt. Due to insufficient validation by the parent, if the user accepted the prompt an attacker‑controlled permission could...

CVE-2020-26979

Affected software: Mozilla Firefox (versions before 84). Root cause: when a user types a URL in the address/search bar and quickly presses Enter, a website could capture the event and redirect before navigation, enabling spoofing of the entered address.Impact: spoofing of the address bar; potenti...

CVE-2021-23963

CVE-2021-23963 affects Mozilla Firefox and relates to the WebRTC geolocation sharing flow. The issue occurs when sharing geolocation during an active WebRTC share, where the UI could reset the WebRTC sharing state, causing loss of control over the currently granted permission. Affected products/v...

CVE-2022-45419

CVE-2022-45419 describes a Firefox trust-management vulnerability where, if a user added a security exception for an invalid TLS certificate, kept an ongoing TLS connection, and then deleted the exception, Firefox could keep the connection alive and continue to treat the certificate as trusted. A...

CVE-2023-23606

Mozilla Firefox has memory-safety bugs reported in Firefox 108, with all issues affecting Firefox versions earlier than 109. The documentation indicates some of these bugs could be exploited to run arbitrary code, implying a potential high-impact risk if unpatched. Affected scope is Firefox

CVE-2014-1512

The provided connected documents confirm multiple Firefox-related CVEs (e.g., CVE-2014-1512 among others) affecting Mozilla Firefox before 28.0, ESR 24.x before 24.4, and related Mozilla products. The primary issue is memory-safety/use-after-free vulnerabilities in the browser engine (notably in ...

CVE-2014-1532

CVE-2014-1532 is a use-after-free in Mozilla Firefox’s host-resolution path. Affected products include Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, where the vulnerability resides in libxul.so's nsHostResolver::ConditionallyRefreshRecord. ...

CVE-2019-17014

CVE-2019-17014 : A cross-origin information leak in Firefox occurs when an image fails to load correctly (e.g., non-image), enabling cross-domain drag-and-drop. Affected: Firefox versions earlier than 71. Root cause: drag-and-drop cross-domain exposure, leading to a partial confidentiality impact...

CVE-2013-0775

CVE-2013-0775 is a use-after-free vulnerability in Firefox’s image handling. Specifically, it concerns nsImageLoadingContent::OnStopContainer and affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. ...

CVE-2018-12399

CVE-2018-12399 affects Firefox prior to 63.0. When a new protocol handler is registered, the API accepts a title argument that can mislead the user about which domain is registering the handler, potentially causing the user to approve a protocol handler they otherwise wouldn’t. The vulnerability ...

CVE-2019-11696

CVE-2019-11696 affects Mozilla Firefox before 67.0. Files with the .JNLP extension used for Java Web Start are not treated as executable content during download prompts, yet they can be executed if Java is present, enabling a user to inadvertently launch a local executable. Impact details in conn...

CVE-2020-26962

CVE-2020-26962 affects Mozilla Firefox up to version 82 (Firefox

CVE-2022-40960

CVE-2022-40960: Concurrent use of the URL parser with non-UTF-8 data is not thread-safe, causing a use-after-free and potentially exploitable crash. Affected products include Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2023-28177

CVE-2023-28177 corresponds to memory safety bugs in Firefox 110, with the issue affecting Firefox versions before 111. The supplied documents indicate memory corruption evidence and a theoretical path to arbitrary code execution, though no exploit details are provided. Affected component scope is...

CVE-2023-6205

The connected sources corroborate CVE-2023-6205: a use-after-free involving MessagePort Entangled leads to an exploitable crash in Firefox and Thunderbird. Affected products include Firefox versions prior to 120 and Thunderbird prior to 115.5.0 (and ESR 115.5.0 lineage). The root cause is use-aft...

CVE-2013-0748

CVE-2013-0748 affects Mozilla Firefox (before 18.0 and ESR 10.x before 10.0.12, and 17.x before 17.0.2), Thunderbird (before 17.0.2, ESR 10.x before 10.0.12 and 17.x before 17.0.2), and SeaMonkey (before 2.15). The flaw is in XBL.proto .toString, where calling toString on an XBL object can leak a...

CVE-2014-1486

CVE-2014-1486 is a use-after-free in Mozilla Firefox’s imgRequestProxy function (affecting Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24). The vulnerability enables remote code execution via image data with unspecified Content-Type values. Mirac...

CVE-2017-5454

CVE-2017-5454 describes a sandbox escape in Mozilla products where the file picker can be abused via relative paths to read local files. Affected are Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox

CVE-2017-7778

CVE-2017-7778 relates to multiple vulnerabilities in Graphite2 (upstream 1.3.10). The issues include out-of-bounds reads, buffer overflow reads/writes, and use of uninitialized memory in Graphite2, and are addressed by upgrading to Graphite2 1.3.10. Publicly affected products in the CVE record in...

CVE-2019-11754

The CVE-2019-11754 entry concerns Firefox where pointer lock activated via requestPointerLock() can occur without user notification. Affected product/version: Firefox versions prior to 69.0.1. Impact stated: potential for a malicious site to hijack or confuse users by hijacking mouse pointer beha...

CVE-2019-9789

CVE-2019-9789 affects Mozilla Firefox before 66.0. The issue stems from memory-safety bugs that can lead to memory corruption, with Mozilla stating these could be exploited to run arbitrary code. The consequence is remote code execution or a browser crash, depending on the specific bug. Mitigatio...

CVE-2022-36315

CVE-2022-36315 affects Mozilla Firefox older than 103. An attacker with injection capability could trigger reuse of cached scripts loaded with Subresource Integrity, causing mismatched integrity metadata to be applied to previously cached entries. This is a browser-side issue in the SRI handling ...

CVE-2022-40958

CVE-2022-40958 : The vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox

CVE-2024-0746

CVE-2024-0746 describes a crash triggered when a Linux user opens the print preview dialog in Mozilla components. Affected products include Firefox (versions before 122) and Firefox ESR (before 115.7) as well as Thunderbird (before 115.7). The issue is reported as a crash scenario in the print-pr...

CVE-2024-0751

CVE-2024-0751 : A malicious devtools extension could have been used to escalate privileges. Affected: Firefox < 122, Firefox ESR < 115.7, Thunderbird

CVE-2024-3853

CVE-2024-3853 concerns Mozilla Firefox and is triggered by a use-after-free when a JavaScript realm is initializing while a garbage collection starts. Affected software: Firefox prior to version 125. Root cause: memory mismanagement during realm init and GC. Impact (as described in connected sour...

CVE-2025-3029

CVE-2025-3029 describes a URL spoofing vulnerability caused by crafted URLs with specific Unicode characters that can mask the true origin of a page. The advisory text in connected sources confirms affected products include Firefox (versions before 137 and ESR before 128.9) and Thunderbird (versi...

CVE-2012-3990

CVE-2012-3990 is a use-after-free vulnerability in the IME State Manager implementation of Mozilla Firefox and related Mozilla products. Affected versions include Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before...