CVE-2021-23959

CVE-2021-23959 is an XSS vulnerability in Firefox for Android, arising from improper validation on internal error pages that could enable spoofing attacks (e.g., other error pages and address bar). Affected: Firefox for Android; conditionally affects other OSes not noted in this entry. Impact per...

CVE-2025-5266

CVE-2025-5266: XS-Leaks via script elements loading cross-origin resources affecting Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird

CVE-2013-5613

Mode C: Detailed vulnerability note for CVE-2013-5613. Affected product/variant: Mozilla Firefox components shipped in MiracleLinux 3 (firefox-24.4.0-1.0.1.AXS3) per AXSA:2014-233:01. Root cause: Use-after-free in PresShell::DispatchSynthMouseMove, linked to RestyleManager::GetHoverGeneration, en...

CVE-2013-5616

CVE-2013-5616 is a use-after-free in Mozilla Firefox before 26.0 (also affects ESR 24.x before 24.2, Thunderbird before 24.2, SeaMonkey before 2.23) triggered by nsEventListenerManager::HandleEventSubType. Exploitation could lead to remote code execution or a denial of service due to heap memory ...

CVE-2014-1487

CVE-2014-1487 affects Mozilla Firefox (Web workers) and related Mozilla suite components. The issue allows remote attackers to bypass Same Origin Policy and obtain sensitive authentication data via error-message handling in Web workers, affecting Firefox versions before 27.0 (and ESR 24.x before ...

CVE-2017-5388

CVE-2017-5388 affects Firefox versions prior to 51.0. It describes WebRTC can be used to generate a large amount of UDP traffic, enabling potential Distributed Denial of Service (DDoS) against e10s systems. Remediation in the connected documents shows Firefox 51.0.1 as the fixed release (openSUSE...

CVE-2017-5467

CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (

CVE-2017-7776

Graphite2 (graphite2) contains multiple vulnerabilities including CVE-2017-7776, a heap-based buffer overflow (read) in graphite2::Silf::getClassGlyph, potentially triggering crashes or code execution when processing malformed fonts. This family affects Firefox prior to 54 and various distributio...

CVE-2019-11741

CVE-2019-11741 affects Mozilla Firefox before version 69.0. a UXSS risk arises from a compromised sandboxed content process that can load content from sites like addons.mozilla.org and accounts.firefox.com in the same process, enabling potential manipulation of Firefox settings. The public docs c...

CVE-2019-9806

CVE-2019-9806 affects Mozilla Firefox before 66.0. The flaw occurs during FTP-auth prompt handling, where successive modal prompts cannot be dismissed, enabling a denial-of-service condition. Affected software: Firefox versions prior to 66.0. Impact: potential browser DOS; no confirmed remote cod...

CVE-2021-43544

Summary : CVE-2021-43544 is a Firefox for Android vulnerability where, when a URL is received via SEND intent, Firefox would search for text and later use of the address bar could load the URL unintentionally, enabling Cross‑Site Scripting (XSS) and spoofing. Affected software/versions : Firefox ...

CVE-2022-46879

CVE-2022-46879 affects Mozilla Firefox prior to 108. The connected sources describe memory safety bugs in Firefox 107 that could lead to memory corruption and, with enough effort, potentially arbitrary code execution. Exploitation status is not provided in the source documents; no specific exploi...

CVE-2023-6210

The CVE-2023-6210 issue affects Mozilla Firefox and is triggered when an https page creates a pop-up from a javascript: URL that is incorrectly allowed to load blockable content (e.g., iframes) from insecure http URLs. The vulnerability affects Firefox versions earlier than 120. Root cause per th...

CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2025-1935

CVE-2025-1935 is described in connected advisories as a UI/protocol-handler spoof affecting Firefox and Thunderbird before versions 136 (Firefox) / 128.8 (Firefox ESR) and before 136 (Thunderbird) / 128.8 (Thunderbird). The issue allows a malicious web page to coax a user into setting that site a...

CVE-2025-3608

CVE-2025-3608 involves a race condition in Mozilla Firefox’s nsHttpTransaction that can lead to memory corruption and an exploitable condition. Affected product: Firefox versions prior to 137.0.2. The root cause is a competing condition in nsHttpTransaction; impact is described as memory corrupti...

CVE-2013-0755

CVE-2013-0755 refers to a use-after-free in the mozVibrate implementation of the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. The vulnerability allows remote code execution...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2018-18504

CVE-2018-18504 affects Mozilla Firefox prior to 65.0. A memory corruption/out-of-bounds read occurs when the buffer of a texture client is freed while still in use during graphic operations, potentially causing a crash and allowing reading the memory of freed buffers. This is described for Firefox

CVE-2018-5165

CVE-2018-5165 affects Firefox versions older than 60, where the 32‑bit Firefox/Adobe Flash protected mode checkbox is inverted in the UI: it appears off when protected mode is enabled, potentially leading users to disable protections. The underlying issue is a mismatch between the displayed state...

CVE-2018-5182

CVE-2018-5182 affects Mozilla Firefox before version 60, where dragging a text string that is a local filename into the address bar can cause that local file to be opened. This is a local-file access issue related to how file: URL-like strings are handled when dragged onto the address bar. Connec...

CVE-2019-9808

CVE-2019-9808 affects Firefox before 66.0. When WebRTC permission is requested from documents using data: or blob: URLs, the permission notifications fail to show the originating domain, displaying Unknown origin instead. Documented impact is user confusion about which site requests permission. R...

CVE-2021-23965

CVE-2021-23965 affects Mozilla Firefox prior to version 85.0. The issue stems from memory safety bugs in Firefox 84 that can lead to memory corruption; Mozilla notes these could potentially be exploited to run arbitrary code. Reported as memory safety vulnerabilities with possible exploitation pa...

CVE-2024-4771

CVE-2024-4771 concerns Mozilla Firefox where a missing memory-allocation check could cause a use-after-free if allocation fails, leading to a crash or potential code execution. Affected lineage: Firefox before version 126. The issue is tied to Firefox use-after-free in memory handling (no exploit...

CVE-2024-4776

CVE-2024-4776 affects Firefox prior to 126, where a full-screen file dialog could leave the window disabled. Impact is limited to the UI state of the file picker, with no broader exploit details provided. According to the sources, Firefox versions 126 and later (including ESR) include the fix; up...

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2017-5451

CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...

CVE-2017-7773

CVE-2017-7773 is a Graphite2 heap-based buffer overflow in the lz4::decompress implementation (src/Decompressor) that affects Firefox prior to 54. The issue can cause a crash and, per advisories, may allow arbitrary code execution under certain conditions. Affected products are those using Graphi...

CVE-2018-5142

Technical details are not publicly provided in the provided documents. The vulnerability concerns Firefox before 59 and Media Capture and Streams API permission notifications, but no concrete exploit/vector/fix details are included here. Monitor for updates.

CVE-2018-5164

CVE-2018-5164 affects Firefox before 60, where the Content Security Policy (CSP) is not applied to all parts of multipart content using MIME type multipart/x-mixed-replace. This can permit script execution where CSP should block it, enabling an XSS-style issue. The vulnerability is documented acr...

CVE-2018-5174

CVE-2018-5174 involves Windows Defender SmartScreen honoring the SEE_MASK_FLAG_NO_UI flag, allowing downloaded files to run without UI prompts on Windows 10 April 2018 Update and later. The issue, as documented in NVD and reflected in the connected Nessus/SUSE advisories, notes that Firefox and T...

CVE-2018-5186

CVE-2018-5186 : Memory safety bugs present in Firefox 60 that could allow memory corruption and potentially run arbitrary code; affects Firefox

CVE-2019-9802

Firefox up to version 66.0 is vulnerable (CVE-2019-9802). If a Sandbox content process is compromised, it can trigger an FTP download, have a child process render the data, and pass it to the Chrome process with an attacker-controlled length, bypassing sandbox protections and potentially reading ...

CVE-2019-9805

CVE-2019-9805 is a memory-corruption vulnerability in the Prio library used by Mozilla Firefox before 66. The issue arises from reading data from uninitialized memory in certain functions, potentially enabling exploitation and memory corruption. Affected product: Firefox

CVE-2023-25733

CVE-2023-25733 affects Mozilla Firefox versions earlier than 110. The issue is that the return value of gfx::SourceSurfaceSkia::Map() was not verified, which could lead to a null pointer dereference and a potential crash. The vulnerability is associated with memory safety concerns and is document...

CVE-2023-25750

CVE-2023-25750 describes an information disclosure in Mozilla Firefox where, under certain conditions, a ServiceWorker offline cache could leak to the file system when private browsing is used. Affected product: Firefox versions older than 111. Root cause details in the connected docs point to le...

CVE-2023-29544

CVE-2023-29544 describes a memory corruption vulnerability in the Firefox garbage collector that can trigger a potentially exploitable crash when multiple resource-exhaustion instances occur at the wrong time. Affected products include Firefox for Android and Focus for Android, specifically versi...

CVE-2023-37207

The provided connected documents confirm CVE-2023-37207 affects Firefox and Thunderbird (Firefox < 115, ESR < 102.13, Thunderbird

CVE-2024-2615

Summary (CVE-2024-2615) : The incident centers on memory safety bugs in Mozilla Firefox 123 that may allow memory corruption and, with enough effort, arbitrary code execution. The vulnerability affects Firefox versions earlier than 124. The connected sources consistently describe the issue as mem...

CVE-2025-1936

CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...

CVE-2025-4093

CVE-2025-4093 involves a memory safety bug in Firefox ESR 128.9 and Thunderbird 128.9 that showed memory corruption with potential to enable arbitrary code execution. The vulnerability is fixed in Firefox ESR 128.10 and Thunderbird 128.10. The provided connected documents confirm affected product...

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2018-5135

CVE-2018-5135 affects Mozilla Firefox versions earlier than 59.0. The issue allows WebExtensions to bypass normal restrictions and use browser.tabs.executeScript to inject scripts into contexts where injection should not be allowed (e.g., other WebExtensions or unprivileged about: pages). This is...

CVE-2018-5163

This CVE refers to Firefox

CVE-2018-5166

CVE-2018-5166 affects Firefox

CVE-2019-9799

CVE-2019-9799 affects Mozilla Firefox before 66.0. The issue is caused by insufficient bounds checking of data during inter-process communication, which can allow a compromised content process to read memory from the parent process under certain conditions. Connected advisories/plugins corroborat...

CVE-2020-12408

CVE-2020-12408 affects Mozilla Firefox earlier than 77. The issue allows an attacker browsing a document hosted on an IP address to insert certain characters that flip domain and path information in the address bar (URL spoofing). The connected sources corroborate Firefox as the affected product ...

CVE-2021-23986

CVE-2021-23986 concerns a vulnerability in Firefox prior to 87 where a malicious extension with the 'search' permission could install a new search engine whose favicon referenced a cross-origin URL. The extension could read the cross-origin response, bypassing same-origin policy, though the reque...

CVE-2023-6867

CVE-2023-6867 describes a clickjacking-related issue where the timing between a button click and a popup’s disappearance matched the anti-clickjacking delay on permission prompts. Affected software includes Firefox ESR versions older than 115.6 and Firefox versions older than 121. Multiple connec...

CVE-2025-4087

Summary: CVE-2025-4087 is a Mozilla Thunderbird/Firefox memory-safety issue in XPath parsing caused by missing null checks during attribute access, leading to undefined behavior and potential out-of-bounds reads. Affected versions: Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, ...