CVE-2023-6864

CVE-2023-6864 affects Mozilla Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. The issue is described as memory safety bugs with evidence of memory corruption; with sufficient effort these could be exploited to execute arbitrary code. Impact is high (CVE base score 8.8; confidentiality, int...

CVE-2024-4764

CVE-2024-4764 affects Mozilla Firefox: a use-after-free in WebRTC audio input handling caused by multiple WebRTC threads potentially claiming a newly connected audio input. The vulnerability impacts Firefox versions earlier than 126. The CVSS v3.1 base score is 9.8 (critical, network attack vecto...

CVE-2025-1936

CVE-2025-1936 is a Firefox/Thunderbird vulnerability where jar: URLs used to retrieve local ZIP contents could misclassify content due to a null-termination issue in the archive, potentially enabling disguised code in a web extension. Affected: Firefox before 136, Firefox ESR before 128.8, Thunde...

CVE-2013-0780

CVE-2013-0780 is a use-after-free vulnerability in Mozilla Firefox related to the nsOverflowContinuationTracker::Finish function. It affects Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. An attacker c...

CVE-2018-5177

CVE-2018-5177 is a vulnerability in Firefox’s XSLT number formatting that can allocate a negative buffer size, leading to a buffer overflow and crash. The issue is documented as affecting Firefox versions before 60, with multiple Nessus/ESA references tying the CVE to Firefox 60-era releases. The...

CVE-2023-29544

CVE-2023-29544 describes a memory corruption vulnerability in the Firefox garbage collector that can trigger a potentially exploitable crash when multiple resource-exhaustion instances occur at the wrong time. Affected products include Firefox for Android and Focus for Android, specifically versi...

CVE-2024-2615

Summary (CVE-2024-2615) : The incident centers on memory safety bugs in Mozilla Firefox 123 that may allow memory corruption and, with enough effort, arbitrary code execution. The vulnerability affects Firefox versions earlier than 124. The connected sources consistently describe the issue as mem...

CVE-2024-3856

Concretely, CVE-2024-3856 affects Mozilla Firefox

CVE-2024-4776

CVE-2024-4776 affects Firefox prior to 126, where a full-screen file dialog could leave the window disabled. Impact is limited to the UI state of the file picker, with no broader exploit details provided. According to the sources, Firefox versions 126 and later (including ESR) include the fix; up...

CVE-2025-5266

CVE-2025-5266: XS-Leaks via script elements loading cross-origin resources affecting Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird

CVE-2013-0768

Technical details for CVE-2013-0768 are not publicly available in the provided documents. Monitor for updates.

CVE-2017-5467

CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (

CVE-2019-9806

CVE-2019-9806 affects Mozilla Firefox before 66.0. The flaw occurs during FTP-auth prompt handling, where successive modal prompts cannot be dismissed, enabling a denial-of-service condition. Affected software: Firefox versions prior to 66.0. Impact: potential browser DOS; no confirmed remote cod...

CVE-2019-9808

CVE-2019-9808 affects Firefox before 66.0. When WebRTC permission is requested from documents using data: or blob: URLs, the permission notifications fail to show the originating domain, displaying Unknown origin instead. Documented impact is user confusion about which site requests permission. R...

CVE-2021-23965

CVE-2021-23965 affects Mozilla Firefox prior to version 85.0. The issue stems from memory safety bugs in Firefox 84 that can lead to memory corruption; Mozilla notes these could potentially be exploited to run arbitrary code. Reported as memory safety vulnerabilities with possible exploitation pa...

CVE-2021-43544

Summary : CVE-2021-43544 is a Firefox for Android vulnerability where, when a URL is received via SEND intent, Firefox would search for text and later use of the address bar could load the URL unintentionally, enabling Cross‑Site Scripting (XSS) and spoofing. Affected software/versions : Firefox ...

CVE-2023-25745

CVE-2023-25745 covers memory-safety bugs in Firefox 109 that affect Firefox versions prior to 110. The issue involves memory corruption vectors in Firefox’s code paths and could enable arbitrary code execution with user interaction, as described in multiple sources. Affected product: Mozilla Fire...

CVE-2023-25750

CVE-2023-25750 describes an information disclosure in Mozilla Firefox where, under certain conditions, a ServiceWorker offline cache could leak to the file system when private browsing is used. Affected product: Firefox versions older than 111. Root cause details in the connected docs point to le...

CVE-2025-1935

CVE-2025-1935 is described in connected advisories as a UI/protocol-handler spoof affecting Firefox and Thunderbird before versions 136 (Firefox) / 128.8 (Firefox ESR) and before 136 (Thunderbird) / 128.8 (Thunderbird). The issue allows a malicious web page to coax a user into setting that site a...

CVE-2017-5472

CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7777

CVE-2017-7777 concerns the Graphite2 font rendering library. Multiple connected sources confirm a defect in graphite2::GlyphCache::Loader::read_glyph due to use of uninitialized memory in the Graphite2 codebase, affecting Firefox before 54 and other products using graphite2. Exploitation could ca...

CVE-2017-7781

CVE-2017-7781 affects Firefox before 55 due to an error in the elliptic-curve point addition using mixed Jacobian–affine coordinates, which can yield a spuriously computed POINT_AT_INFINITY. This could let a man‑in‑the‑middle attacker interfere with a connection and cause the affected party to co...

CVE-2018-18497

CVE-2018-18497 : In Firefox, limitations on URIs allowed to WebExtensions via the browser.windows.create API can be bypassed by placing a pipe in the URL field, causing multiple pages to load as a single argument. This may allow a malicious WebExtension to open privileged locations such as about:...

CVE-2018-18499

CVE-2018-18499 is a same-origin policy vulnerability in Mozilla Firefox and Thunderbird where a page using a meta http-equiv="refresh" redirects to another site and allows theft of cross-origin URL entries via performance.getEntries(). Affected: Firefox < 62, Firefox ESR < 60.2, Thunderbird

CVE-2018-18504

CVE-2018-18504 affects Mozilla Firefox prior to 65.0. A memory corruption/out-of-bounds read occurs when the buffer of a texture client is freed while still in use during graphic operations, potentially causing a crash and allowing reading the memory of freed buffers. This is described for Firefox

CVE-2018-5165

CVE-2018-5165 affects Firefox versions older than 60, where the 32‑bit Firefox/Adobe Flash protected mode checkbox is inverted in the UI: it appears off when protected mode is enabled, potentially leading users to disable protections. The underlying issue is a mismatch between the displayed state...

CVE-2018-5167

The CVE-2018-5167 issue affects Mozilla Firefox prior to version 60, where the web console and JavaScript debugger fail to sanitize all hyperlink-output. This can cause chrome: and javascript: links to render as active hyperlinks, enabling potential user interaction with internal pages via malici...

CVE-2018-5186

CVE-2018-5186 : Memory safety bugs present in Firefox 60 that could allow memory corruption and potentially run arbitrary code; affects Firefox

CVE-2019-9809

CVE-2019-9809 affects Mozilla Firefox before 66.0. The issue arises when a page sources resources over FTP; invalid credentials or locations can trigger a series of modal alerts that cannot be dismissed, causing a denial of service. Affected product/version: Firefox

CVE-2020-15667

The CVE-2020-15667 issue affects Mozilla Firefox pre-80, caused by an invalid name length during MAR update file processing after signature validation, leading to a heap overflow and memory corruption with potential arbitrary code execution. Exploitation is limited to scenarios using the Mozilla-...

CVE-2021-23986

CVE-2021-23986 concerns a vulnerability in Firefox prior to 87 where a malicious extension with the 'search' permission could install a new search engine whose favicon referenced a cross-origin URL. The extension could read the cross-origin response, bypassing same-origin policy, though the reque...

CVE-2022-46879

CVE-2022-46879 affects Mozilla Firefox prior to 108. The connected sources describe memory safety bugs in Firefox 107 that could lead to memory corruption and, with enough effort, potentially arbitrary code execution. Exploitation status is not provided in the source documents; no specific exploi...

CVE-2013-0760

CVE-2013-0760 describes a buffer overflow in Mozilla Firefox’s CharDistributionAnalysis::HandleOneChar, allowing remote code execution via a crafted document. Affected products per the description: Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15. Root cause is a memory c...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2017-5388

CVE-2017-5388 affects Firefox versions prior to 51.0. It describes WebRTC can be used to generate a large amount of UDP traffic, enabling potential Distributed Denial of Service (DDoS) against e10s systems. Remediation in the connected documents shows Firefox 51.0.1 as the fixed release (openSUSE...

CVE-2018-5164

CVE-2018-5164 affects Firefox before 60, where the Content Security Policy (CSP) is not applied to all parts of multipart content using MIME type multipart/x-mixed-replace. This can permit script execution where CSP should block it, enabling an XSS-style issue. The vulnerability is documented acr...

CVE-2019-9805

CVE-2019-9805 is a memory-corruption vulnerability in the Prio library used by Mozilla Firefox before 66. The issue arises from reading data from uninitialized memory in certain functions, potentially enabling exploitation and memory corruption. Affected product: Firefox

CVE-2023-25733

CVE-2023-25733 affects Mozilla Firefox versions earlier than 110. The issue is that the return value of gfx::SourceSurfaceSkia::Map() was not verified, which could lead to a null pointer dereference and a potential crash. The vulnerability is associated with memory safety concerns and is document...

CVE-2012-4185

CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey

CVE-2013-0749

CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...

CVE-2017-5451

CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...

CVE-2017-7773

CVE-2017-7773 is a Graphite2 heap-based buffer overflow in the lz4::decompress implementation (src/Decompressor) that affects Firefox prior to 54. The issue can cause a crash and, per advisories, may allow arbitrary code execution under certain conditions. Affected products are those using Graphi...

CVE-2017-7789

CVE-2017-7789 affects Firefox versions earlier than 55.0. If a server sends two Strict-Transport-Security headers for a single connection, the headers are rejected as invalid, and HSTS is not enabled for that connection. Documented impact is limited to Firefox

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2018-5182

CVE-2018-5182 affects Mozilla Firefox before version 60, where dragging a text string that is a local filename into the address bar can cause that local file to be opened. This is a local-file access issue related to how file: URL-like strings are handled when dragged onto the address bar. Connec...

CVE-2019-9807

CVE-2019-9807 affects Firefox prior to 66.0. When arbitrary text is sent over an FTP connection and a page reload is initiated, Firefox could display a modal alert containing that text, enabling potential social engineering. Affected product: Firefox (pre-66). Root cause described in connected so...

CVE-2021-29963

Summary: CVE-2021-29963 affects Firefox for Android, where address bar search suggestions in private browsing mode reused session data from normal mode. The issue is limited to Android; other OSes are unaffected. Affected product: Firefox for Android prior to version 89. Root cause: private mode ...

CVE-2023-37207

The provided connected documents confirm CVE-2023-37207 affects Firefox and Thunderbird (Firefox < 115, ESR < 102.13, Thunderbird

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...