CVE-2018-12388

Mozilla Firefox vulnerability CVE-2018-12388 arises from memory-safety bugs in Firefox 62 that could be triggered to cause memory corruption and, with sufficient effort, potentially execute arbitrary code. Affected products are Firefox versions before 63; remediation is to upgrade to Firefox 63 o...

CVE-2018-12398

CVE-2018-12398 affects Firefox versions earlier than 63.0 and allows CSP bypass via stylesheet injection using a reflected URL in certain resource URIs (e.g., chrome:). Affected products are Firefox

CVE-2020-15681

CVE-2020-15681 affects Firefox before 82.0. The issue is a memory-corruption flaw in WebAssembly (WASM) where, when multiple WASM threads reference a module and look up exported functions, one thread could overwrite another’s entry in a shared stub table, potentially causing a crash that could be...

CVE-2024-3862

The vulnerability CVE-2024-3862 affects Mozilla Firefox and is caused by the MarkStack assignment operator in the JavaScript engine, which could access uninitialized memory if used in a self‑assignment. Affected products are Firefox versions older than 125. The practical impact is memory access r...

CVE-2025-5269

CVE-2025-5269 is a memory-safety bug reported in Firefox ESR 128.10 and Thunderbird 128.10 that shows memory corruption and could potentially be exploited to run arbitrary code. Affected products: Firefox ESR < 128.11 and Thunderbird

CVE-2013-0744

CVE-2013-0744 is a use-after-free in the TableBackgroundPainter::TableBackgroundData::Destroy function of Mozilla Firefox prior to 18.0 (and Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2), Thunderbird prior to 17.0.2/ESR 10.x before 10.0.12/17.x before 17.0.2, and SeaMonkey prior to 2.15...

CVE-2014-1481

CVE-2014-1481 affects Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24. It enables remote attackers to bypass restrictions on window objects by exploiting inconsistencies in native JavaScript engine getter methods. Impact per sources is...

CVE-2016-5291

CVE-2016-5291 is a local-bypass vulnerability where a attacker could load arbitrary local content by abusing local shortcut files, bypassing same-origin policy in Mozilla Firefox and Thunderbird products. Public details in connected docs indicate affected versions include Thunderbird < 45.5, F...

CVE-2019-17013

No technical details about CVE-2019-17013 are provided in the connected documents. The materials reference Firefox memory-safety issues generally but do not specify affected versions, root cause, exploitability, or fixes for this CVE within the supplied material. Monitor for updates.

CVE-2024-8900

CVE-2024-8900 describes a vulnerability where an attacker could write data to the user’s clipboard, bypassing the user prompt, during a specific sequence of navigational events. Affected products and versions per the provided data are Mozilla Firefox before version 129, Firefox ESR before 128.3, ...

CVE-2025-1931

CVE-2025-1931 describes a use-after-free in the content process side of a WebTransport connection, causing a potentially exploitable crash. Affected products/versions from the provided docs: Firefox < 136, Firefox ESR < 115.21 and < 128.8, Thunderbird < 136, and Thunderbird

CVE-2012-4194

The CVE-2012-4194 issue affects Mozilla Firefox and related Mozilla components where the valueOf shadowing of the location object (window.location) enables cross-site scripting via plugin vectors. Affected software and versions (stated in the provided sources) include: Mozilla Firefox before 16.0...

CVE-2017-7771

CVE-2017-7771 is an out-of-bounds read in the Graphite2 font-rendering library, specifically in graphite2::Pass::readPass, reported for Firefox prior to 54. Public advisories and vendor notes confirm Graphite2 vulnerabilities that can lead to crashes or memory disclosure when processing malformed...

CVE-2018-18502

CVE-2018-18502 affects Mozilla Firefox

CVE-2021-23959

CVE-2021-23959 is an XSS vulnerability in Firefox for Android, arising from improper validation on internal error pages that could enable spoofing attacks (e.g., other error pages and address bar). Affected: Firefox for Android; conditionally affects other OSes not noted in this entry. Impact per...

CVE-2025-4087

Summary: CVE-2025-4087 is a Mozilla Thunderbird/Firefox memory-safety issue in XPath parsing caused by missing null checks during attribute access, leading to undefined behavior and potential out-of-bounds reads. Affected versions: Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, ...

CVE-2025-4093

CVE-2025-4093 involves a memory safety bug in Firefox ESR 128.9 and Thunderbird 128.9 that showed memory corruption with potential to enable arbitrary code execution. The vulnerability is fixed in Firefox ESR 128.10 and Thunderbird 128.10. The provided connected documents confirm affected product...

CVE-2014-1523

CVE-2014-1523 is a heap-based buffer overflow in the read_u32 function of Mozilla Firefox that can be triggered by a crafted JPEG image. Affected software per the description includes Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26, with remot...

CVE-2014-1524

CVE-2014-1524 is reported in several Nessus entries tied to Mozilla Firefox components. Affected: Mozilla Firefox (before 29.0), Firefox ESR 24.x (before 24.5), Thunderbird (before 24.5), and SeaMonkey (before 2.26). Root cause: nsXBLProtoImpl::InstallImplementation does not reliably verify that ...

CVE-2016-9066

CVE-2016-9066 is a Mozilla Firefox-related issue. IBM notes it as a buffer/ memory-safety problem in Firefox shipped with IBM SONAS; root cause described as a buffer overflow due to an integer overflow in nsScriptLoadHandler. Affected products include Thunderbird <45.5, Firefox ESR <45.5, a...

CVE-2018-18503

CVE-2018-18503 affects Firefox prior to 65.0. The issue is a memory corruption/crash in the Audio Buffer component when JavaScript creates/manipulates an audio buffer, caused by a compartment mismatch. The vulnerability is documented across multiple advisories; the impact is a potentially exploit...

CVE-2018-5181

CVE-2018-5181 affects Firefox versions prior to 60. Dragging a URL with the file: protocol onto an open tab running in a different child process can cause the tab to display the local file, contrary to policy. A mitigation mentioned in the description is to open the target tab with the noopener k...

CVE-2020-12409

Summary: CVE-2020-12409 affects Mozilla Firefox prior to 77. The root cause is a URL rendering issue where certain blank characters are shown as spaces instead of a properly encoded URL. Impact (as stated): URL forgery/defacement risk in the address bar. Affected versions: Firefox

CVE-2023-25749

CVE-2023-25749 affects Firefox for Android. An Android feature allows a browser to launch external applications via Intents, and this vulnerability arises when unpatched Android apps can be started this way, potentially exposing users to insecure behavior. The description notes this issue is limi...

CVE-2023-29551

CVE-2023-29551 corresponds to memory safety bugs in Mozilla Firefox 111 that affected Firefox for Android < 112, Firefox < 112, and Focus for Android

CVE-2023-32208

CVE-2023-32208 describes a vulnerability in Mozilla Firefox prior to 113 where service workers could reveal the script base URL due to dynamic import(). The issue is limited to Firefox versions earlier than 113, with a CVSS v3.1 base score of 5.3 (Medium), affecting the confidentiality impact onl...

CVE-2024-3865

CVE-2024-3865 : Mozilla Firefox memory-safety vulnerabilities affecting Firefox versions older than 125. The connected documents confirm memory-safety bugs (in Firefox 124) with evidence of memory corruption and potential to run arbitrary code. Affected product/component: Mozilla Firefox; root ca...

CVE-2017-5430

CVE-2017-5430 refers to memory-safety bugs reported in Firefox 52/52 ESR and Thunderbird 52 that could, with enough effort, be exploited to run arbitrary code. Affected products include Firefox (versions < 53), Firefox ESR (< 52.1), and Thunderbird (

CVE-2017-5470

CVE-2017-5470 involves memory safety bugs reported in Firefox 53 and Firefox ESR 52.1, with memory corruption evidence that could enable arbitrary code execution. The entry covers affected versions Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-12391

CVE-2018-12391 affects Firefox for Android: during HTTP Live Stream playback, audio data can be accessed across origins due to a flaw in the underlying Android service. The vulnerability is addressed by treating all HLS streams as cross-origin and opaque. Affected products/versions include Firefo...

CVE-2018-5178

CVE-2018-5178: A buffer overflow during UTF-8 to Unicode string conversion in JavaScript can occur when a vulnerable legacy extension is used. Affected products include Thunderbird ESR and Firefox ESR up to version 52.8 (ESR branches); Thunderbrid/Firefox ESR

CVE-2019-11737

CVE-2019-11737 affects Firefox prior to version 69. If a wildcard '*' is used for the host in Content Security Policy directives, any port or path restriction of the directive is ignored, causing CSP directives not to be properly enforced on content. The issue is a CSP host wildcard handling flaw...

CVE-2020-12407

CVE-2020-12407 affects Mozilla Firefox before 77. When using WebRender, under certain conditions Firefox could leak arbitrary GPU memory to the visible screen, exposing memory contents to the user (not to web content). Impact aligns with partial confidentiality; exploit details are not provided b...

CVE-2021-23979

CVE-2021-23979 concerns memory-safety bugs in Mozilla Firefox 85 and earlier, with evidence of memory corruption and a risk of arbitrary code execution. Affected: Firefox

CVE-2023-32210

CVE-2023-32210 : Mozilla Firefox is affected by a vulnerability where documents could be loaded with a higher-privileged principal than intended due to an incorrect assumption about the ordering of principal objects. This could lead to privilege escalation or leakage under certain circumstances. ...

CVE-2023-6210

The CVE-2023-6210 issue affects Mozilla Firefox and is triggered when an https page creates a pop-up from a javascript: URL that is incorrectly allowed to load blockable content (e.g., iframes) from insecure http URLs. The vulnerability affects Firefox versions earlier than 120. Root cause per th...

CVE-2023-6211

CVE-2023-6211 affects Mozilla Firefox earlier than 120. The initial description states that an attacker could exploit when a user is prompted to load an insecure http: page and has HTTPS-only mode enabled, by tricking the user into clicking to grant an HTTPS-only exception through a clicking game...

CVE-2023-6859

CVE-2023-6859 is a memory-safety vulnerability described as a use-after-free affecting TLS socket creation under memory pressure. Affected products include Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox

CVE-2024-4771

CVE-2024-4771 concerns Mozilla Firefox where a missing memory-allocation check could cause a use-after-free if allocation fails, leading to a crash or potential code execution. Affected lineage: Firefox before version 126. The issue is tied to Firefox use-after-free in memory handling (no exploit...

CVE-2012-0442

CVE-2012-0442 covers multiple memory-safety vulnerabilities in the Mozilla browser engine affecting Firefox before 3.6.26 and 4.x–9.0, Thunderbird before 3.1.18 and 5.0–9.0, and SeaMonkey before 2.7. The issues can cause memory corruption, application crashes, or potentially remote code execution...

CVE-2013-0755

CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...

CVE-2013-5616

CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...

CVE-2014-1487

CVE-2014-1487 affects Mozilla Firefox (Web workers) and related Mozilla suite components. The issue allows remote attackers to bypass Same Origin Policy and obtain sensitive authentication data via error-message handling in Web workers, affecting Firefox versions before 27.0 (and ESR 24.x before ...

CVE-2018-12401

CVE-2018-12401 affects Mozilla Firefox prior to 63.0. The vulnerability is triggered by loading certain special resource URIs with optional parameters after a ‘?’, causing a non-exploitable crash and potential denial of service. No exploitation details are provided in the documents beyond this cr...

CVE-2018-18495

CVE-2018-18495 affects Mozilla Firefox prior to 64. WebExtension content scripts can be loaded into about: pages in certain circumstances, bypassing granted extension permissions and potentially letting an extension interfere with loading/usage of those pages. Implications include access to restr...

CVE-2019-11741

CVE-2019-11741 affects Mozilla Firefox before version 69.0. a UXSS risk arises from a compromised sandboxed content process that can load content from sites like addons.mozilla.org and accounts.firefox.com in the same process, enabling potential manipulation of Firefox settings. The public docs c...

CVE-2023-28160

CVE-2023-28160 affects Mozilla Firefox prior to version 111. When a redirect points to a publicly accessible web extension file, the URL may be translated to the actual local path, potentially leaking sensitive information. Affected product: Firefox; impact described as exposure of local path inf...

CVE-2012-3960

CVE-2012-3960 is a use-after-free in mozSpellChecker::SetCurrentDictionary that affects Mozilla Firefox <15.0, Firefox ESR <10.0.7, Thunderbird <15.0 / ESR, and SeaMonkey

CVE-2012-3986

CVE-2012-3986 affects Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8), Thunderbird prior to 16.0, and SeaMonkey before 2.13. The root cause is that certain DOMWindowUtils (nsDOMWindowUtils) methods were not protected by security checks, allowing remote JavaScript to bypass in...

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...