CVE-2013-0796

CVE-2013-0796 is a WebGL/Mesa driver interaction flaw in Mozilla Firefox (and related Mozilla apps like Thunderbird and SeaMonkey) on Linux that could allow remote code execution or DoS. The issue arises from how WebGL interacts with Mesa drivers, enabling exploitation via unspecified vectors. Pu...

CVE-2017-5456

CVE-2017-5456 is a sandbox-escape vulnerability in Mozilla Firefox/Firefox ESR where the file system request constructor, via an IPC message, bypasses sandbox protections to gain read/write access to the local filesystem. Affected products include Firefox ESR versions before 52.1 and Firefox befo...

CVE-2018-5151

CVE-2018-5151 affects Mozilla Firefox prior to version 60, where memory safety bugs in Firefox 59 could potentially lead to memory corruption and arbitrary code execution. The issue is documented in multiple sources referencing memory safety bugs in Firefox 59 and the impact is limited to Firefox...

CVE-2019-11695

CVE-2019-11695 affects Mozilla Firefox prior to version 67.0 and is caused by a scripting-defined custom cursor that can position over the address bar, spoofing the real cursor outside the primary web content area. This enables potential user deception (e.g., clicking permission prompts or UI ele...

CVE-2021-23983

Summary: CVE-2021-23983 affects Mozilla Firefox prior to version 87. The issue arises when a transition on a parent node is caused by removing a CSS rule, allowing an invalid property for a marker to be applied, which can lead to memory corruption and a potentially exploitable crash. This vulnera...

CVE-2023-6863

CVE-2023-6863 concerns a potential undefined behavior in ShutdownObserver() due to reliance on a dynamic type without a virtual destructor. Affected products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox

CVE-2025-1938

CVE-2025-1938 affects Mozilla Firefox and Thunderbird on multiple release lines. The connected documents describe memory safety bugs in Firefox 135/Thunderbird 135 (and ESR 128.7), with some bugs showing memory corruption and the potential to exploit for arbitrary code execution if enough effort ...

CVE-2025-3030

CVE-2025-3030 : Memory safety bugs in Firefox 136/ESR 128.8 and Thunderbird 136/128.8 allow memory corruption; could enable arbitrary code execution if exploited. Affected products include Firefox < 137 and Thunderbird

CVE-2025-4091

CVE-2025-4091 involves memory-safety bugs in Mozilla Firefox and Thunderbird. The initial entry notes memory corruption evidence and indicates that attackers could potentially exploit some bugs to run arbitrary code, affecting Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and T...

CVE-2012-1976

CVE-2012-1976 refers to a Use-after-free in Mozilla Firefox’s nsHTMLSelectElement::SubmitNamesValues. Affected products include Firefox before 15.0, Firefox ESR before 10.0.7 (10.x), Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. Impact per the description is r...

CVE-2013-0800

CVE-2013-0800 : An integer signedness error in the pixman_fill_sse2 function (pixman-sse2.c) used by Cairo and shipped with Mozilla Firefox and related products allows a remote attacker to trigger an out-of-bounds write via crafted values (negative box boundary or negative box size). This affects...

CVE-2017-7774

CVE-2017-7774 is an out-of-bounds read in graphite2::Silf::readGraphite within the Graphite2 library used by Firefox prior to version 54. Affected component: graphite2 library; affected product is Firefox (pre-54). Root cause: out-of-bounds read in readGraphite. Impact per sources: memory disclos...

CVE-2017-7830

CVE-2017-7830 involves a cross-origin information disclosure through the Resource Timing API that could reveal navigations loaded in iframes, constituting a same-origin policy violation. Public documentation in Debian and CVE databases tie this to WebKit-related handling in Safari/WebKit componen...

CVE-2018-12398

CVE-2018-12398 affects Firefox versions earlier than 63.0 and allows CSP bypass via stylesheet injection using a reflected URL in certain resource URIs (e.g., chrome:). Affected products are Firefox

CVE-2018-12403

This CVE affects Mozilla Firefox before version 63. The issue arises when a site is loaded over HTTPS but a favicon is loaded over HTTP, causing the mixed-content warning not to display to users. Impact is the missing warning indicator (no direct exploit details provided here). Remediation: upgra...

CVE-2018-5173

CVE-2018-5173 : In Firefox, the filename shown in the Downloads panel can be spoofed by rendering certain Unicode characters differently, allowing a deception of the file name and potentially masking the extension of executable files. The dialog used to open the file still shows the true filename...

CVE-2021-23988

CVE-2021-23988 concerns memory safety bugs in Mozilla Firefox leading to potential memory corruption that could allow execution of arbitrary code. Affected products: Mozilla Firefox versions older than 87. Root cause: memory safety issues reported in Firefox 86 (and Firefox ESR 78.x per MFSA note...

CVE-2021-23996

CVE-2021-23996 affects Mozilla Firefox prior to 88.0, where a flaw in rendering with 3D CSS and JavaScript could cause content to appear outside the viewport, enabling spoofing potentially for phishing. Multiple connected advisories (Arch Linux ASA-202104-3, Alpine, CNVD/CNNVD entries, Kaspersky,...

CVE-2022-22736

CVE-2022-22736 concerns Mozilla Firefox prior to 96. It describes a potential local privilege escalation on Windows when Firefox is installed to a world-writable directory or when the install directory is non-default, due to Firefox searching the current directory for system libraries. Affected s...

CVE-2022-22758

CVE-2022-22758 affects Mozilla Firefox (Android) and arises from incorrect handling of tel: links where USSD codes placed after a * character could be included in the dialed number, potentially enabling actions on a user’s account. The issue impacts Firefox versions prior to 97 (and related ESR l...

CVE-2023-25738

Mozilla Firefox on Windows is affected by CVE-2023-25738, due to unvalidated DEVMODEW members in the printer driver path that could lead to out-of-bounds access. The issue affects Firefox versions earlier than 110 (Thunderbird <102.8, Firefox ESR

CVE-2023-29547

The CVE-2023-29547 issue affects Mozilla Firefox and Firefox-based products: when a secure cookie existed in the Firefox cookie jar, an insecure cookie for the same domain could be created instead of silently failing, causing desynchronization when reading the secure cookie. Affected versions inc...

CVE-2024-0749

CVE-2024-0749 is confirmed in the connected documents as a phishing dialog issue where an about: dialog could be repurposed to show phishing content with an incorrect origin in the address bar. Affected products are Mozilla Firefox and Thunderbird, with the vulnerability applying to Firefox versi...

CVE-2012-1972

CVE-2012-1972 is a use-after-free in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox, with remote code execution/denial of service via heap memory corruption. Affected products/versions include Firefox prior to 15.0, Firefox ESR 10.x prior to 10.0.7, and Thunderbird prior ...

CVE-2014-1531

CVE-2014-1531 is a use-after-free vulnerability in Mozilla Firefox’s image handling. The flaw occurs in nsGenericHTMLElement::GetWidthHeightForImage during an image-resize operation and can be triggered via an imgLoader object, allowing remote attackers to cause heap memory corruption and potenti...

CVE-2017-7772

CVE-2017-7772 describes a heap-based buffer overflow in the Graphite2 library, specifically in lz4::decompress, affecting Firefox prior to 54. The issue is triggered when processing crafted font data, potentially allowing a crash or arbitrary code execution in the context of an application using ...

CVE-2018-12402

CVE-2018-12402 affects Firefox up to version 62 and concerns the internal WebBrowserPersist code used when saving pages (“Save Page As…”). The vulnerability arises from not using the correct origin context for sub-resources, enabling access to resources that could reveal a visitor’s Windows usern...

CVE-2018-12407

CVE-2018-12407 describes a buffer overflow in the ANGLE graphics library used for WebGL content, triggered when drawing/validating elements in the VertexBuffer11 module. Affected software is Mozilla Firefox versions before 64; the vulnerability can lead to a crash and potentially exploitable cond...

CVE-2021-38494

CVE-2021-38494 maps to memory-safety bugs in Firefox 91 that could be triggered to run arbitrary code. Affected products: Mozilla Firefox earlier than 92. Root cause: memory corruption vulnerabilities disclosed by Mozilla; impact ranges to arbitrary code execution with potential for exploitation ...

CVE-2023-6861

The CVE-2023-6861 issue is a heap buffer overflow in nsWindow::PickerOpen(void) when Firefox/Thunderbird run in headless mode. Affected products: Firefox ESR <115.6, Thunderbird <115.6, and Firefox

CVE-2024-3862

The vulnerability CVE-2024-3862 affects Mozilla Firefox and is caused by the MarkStack assignment operator in the JavaScript engine, which could access uninitialized memory if used in a self‑assignment. Affected products are Firefox versions older than 125. The practical impact is memory access r...

CVE-2025-1933

CVE-2025-1933: On 64-bit CPUs, Firefox/Thunderbird JIT compilation of WASM i32 return values may read leftover memory and misclassify the value type. Affects Firefox (including ESR branches) and Thunderbird prior to 136/128.x. Remediation per sources: upgrade to Firefox 136 (and ESR 115.21 / 128....

CVE-2013-0744

CVE-2013-0744 is a use-after-free in the TableBackgroundPainter::TableBackgroundData::Destroy function of Mozilla Firefox prior to 18.0 (and Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2), Thunderbird prior to 17.0.2/ESR 10.x before 10.0.12/17.x before 17.0.2, and SeaMonkey prior to 2.15...

CVE-2013-0783

CVE-2013-0783 refers to multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (Firefox <19.0, ESR 17.x <17.0.3, Thunderbird <17.0.3, SeaMonkey

CVE-2014-1479

CVE-2014-1479 affects Mozilla Firefox (including ESR 24.x line), Thunderbird, and SeaMonkey before versions around 27.0/24.x 24.3/SeaMonkey 2.24. The flaw, in the System Only Wrapper (SOW) implementation, does not prevent certain cloning operations, allowing remote attackers to bypass restriction...

CVE-2016-5291

CVE-2016-5291 is a local-bypass vulnerability where a attacker could load arbitrary local content by abusing local shortcut files, bypassing same-origin policy in Mozilla Firefox and Thunderbird products. Public details in connected docs indicate affected versions include Thunderbird < 45.5, F...

CVE-2018-12388

Mozilla Firefox vulnerability CVE-2018-12388 arises from memory-safety bugs in Firefox 62 that could be triggered to cause memory corruption and, with sufficient effort, potentially execute arbitrary code. Affected products are Firefox versions before 63; remediation is to upgrade to Firefox 63 o...

CVE-2019-9803

CVE-2019-9803 affects Mozilla Firefox prior to 66.0. The Upgrade-Insecure-Requests (UIR) mechanism under CSP can fail to upgrade same-origin navigations to HTTPS, potentially enabling MITM on linked resources. Affected component: Firefox browser (versions

CVE-2021-29947

CVE-2021-29947 is a Firefox memory-safety issue reported in Firefox 87 and prior builds, with memory corruption that could potentially allow arbitrary code execution. Connected sources (e.g., Alpine Arch ASA-202104-3, Arch Linux ASA entries, CNVD/CNNVD summaries, and MFSA 2021-16) consistently de...

CVE-2023-34415

Affected software: Mozilla Firefox. Issue: a site-isolation bypass vulnerability where a document loaded from a data: URL that was the result of a redirect could be loaded in the same process as the redirecting site, bypassing Spectre-like protections. Root cause: bypass of site-isolation protect...

CVE-2024-0755

CVE-2024-0755 appears in multiple connected advisories as a memory-safety vulnerability affecting Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6, with memory corruption that could allow arbitrary code execution. Affected versions are Firefox < 122, Firefox ESR < 115.7, and Thunderbird

CVE-2025-1934

CVE-2025-1934 is a Firefox/Thunderbird memory-safety issue caused by interrupting the RegExp bailout, which could trigger garbage collection when not expected. Affected: Firefox before 136, Firefox ESR before 128.8, Thunderbird before 136, and Thunderbird before 128.8. Exploitation status is not ...

CVE-2013-0746

CVE-2013-0746 affects Mozilla products including Firefox (before 18.0), Firefox ESR (before 10.0.12 and 17.x before 17.0.2), Thunderbird (before 17.0.2, and ESR 10.x before 10.0.12 and 17.x before 17.0.2), and SeaMonkey (before 2.15). The issue is a quickstubs/jsval return-value handling flaw tha...

CVE-2014-1530

CVE-2014-1530 affects Mozilla Firefox family components (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The issue arises in the docshell loading logic: a crafted site performing history navigation can set a spoofed baseURI, enabling cross-site scriptin...

CVE-2018-5183

CVE-2018-5183 is a memory corruption vulnerability in Mozilla’s Skia library used by Firefox/Thunderbird ESR 52.x. The issue involves invalid reads/writes during graphic operations and was addressed by backporting changes to Skia, with fixed versions shipped as Thunderbird/Firefox ESR 52.8.0 (and...

CVE-2020-35114

CVE-2020-35114 affects Mozilla Firefox before 84.0. Mozilla reports memory safety bugs in Firefox 83 that could lead to memory corruption and potentially arbitrary code execution; exploitation would require convincing a user to visit a crafted page. Affected products in the provided documents con...

CVE-2023-25748

CVE-2023-25748 is a public vulnerability affecting Firefox for Android (not other OSes). The issue arises when a prompt with a long description is displayed, potentially hiding the fullscreen notification and enabling user confusion or spoofing. Connected sources confirm this CVE is fixed in Fire...

CVE-2023-6865

CVE-2023-6865 describes a vulnerability in Firefox’s EncryptingOutputStream that could expose uninitialized data, potentially allowing data to be written to local disk with implications for private browsing mode. Affected products noted in the provided documents include Firefox ESR versions prior...

CVE-2023-6870

CVE-2023-6870 affects Firefox on Android (Android Firefox/Focus) and is triggered by applications that spawn a Toast notification in a background thread, potentially obscuring the fullscreen notification used by Firefox. The issue is tied to Android UI prompts and could lead to spoofing of the br...

CVE-2012-3972

CVE-2012-3972 affects the XSLT format-number functionality in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to obtain sensitive information via unspecif...