CVE-2018-5126

CVE-2018-5126 affects Firefox versions before 59.0. The issue is memory-safety bugs in Firefox 58 that can cause memory corruption and potentially allow arbitrary code execution. Affected product: Firefox < 59. Remediation: update to Firefox 59.0 or newer. The connected documents corroborate t...

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2018-5166

CVE-2018-5166 affects Firefox

CVE-2018-5176

The CVE-2018-5176 entry describes a JSON Viewer script-injection vulnerability in Mozilla Firefox where the JSON Viewer linkifies strings that parse as URLs, including javascript: links. This could allow a user to click a malicious link and potentially expose cookies or authorization tokens withi...

CVE-2019-9799

CVE-2019-9799 affects Mozilla Firefox before 66.0. The issue is caused by insufficient bounds checking of data during inter-process communication, which can allow a compromised content process to read memory from the parent process under certain conditions. Connected advisories/plugins corroborat...

CVE-2019-9809

CVE-2019-9809 affects Mozilla Firefox before 66.0. The issue arises when a page sources resources over FTP; invalid credentials or locations can trigger a series of modal alerts that cannot be dismissed, causing a denial of service. Affected product/version: Firefox

CVE-2020-26975

CVE-2020-26975 concerns Mozilla Firefox for Android. A malicious app that broadcasts an Intent to Firefox for Android could specify arbitrary headers, enabling attacks such as ambient authority abuse or session fixation. The issue is limited to Firefox for Android; other OSes are unaffected, and ...

CVE-2023-23600

CVE-2023-23600 affects Firefox for Android (Firefox

CVE-2024-3856

Concretely, CVE-2024-3856 affects Mozilla Firefox

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2012-3982

CVE-2012-3982 affects Mozilla Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, Thunderbird ESR before 10.0.8, and SeaMonkey before 2.13. The description notes multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashe...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2014-1529

CVE-2014-1529 affects Mozilla Firefox and related Mozilla products (Firefox before 29.0, ESR 24.x before 24.5, Thunderbird before 24.5, SeaMonkey before 2.26). The Web Notification API vulnerability allows remote attackers to bypass source-component restrictions and run arbitrary JavaScript in a ...

CVE-2016-9064

CVE-2016-9064 affects Mozilla Firefox and Firefox ESR due to inadequate verification in the addon update mechanism: the add-on ID in the signed package could mismatch the target add-on, enabling a MITM attacker to substitute a malicious signed update. Documents indicate this affects Firefox ESR &...

CVE-2017-5377

Concrete details found: CVE-2017-5377 is a memory–corruption vulnerability in Skia triggered when using transforms to create gradients, affecting Firefox versions earlier than 51.0.1. The underlying issue is a memory-safety defect in Skia that can cause a crash and potentially enable exploitation...

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-7781

CVE-2017-7781 affects Firefox before 55 due to an error in the elliptic-curve point addition using mixed Jacobian–affine coordinates, which can yield a spuriously computed POINT_AT_INFINITY. This could let a man‑in‑the‑middle attacker interfere with a connection and cause the affected party to co...

CVE-2018-5128

CVE-2018-5128 is a use-after-free vulnerability in Firefox that can occur when manipulating elements, events, and selection ranges during editor operations, leading to a potentially exploitable crash. Affected products include Firefox versions older than 59 across platforms (Windows, macOS, Linux...

CVE-2018-5145

CVE-2018-5145 concerns memory safety bugs in Mozilla Firefox ESR 52.6 that could lead to memory corruption and potential arbitrary code execution. The vulnerability affects Firefox ESR versions before 52.7 and Thunderbird versions before 52.7. Several distributions document fixes in Thunderbird a...

CVE-2018-5160

CVE-2018-5160 affects Firefox

CVE-2018-5175

CVE-2018-5175 describes a universal CSP bypass on sites using strict-dynamic. An HTML injection flaw could reference Firefox DevTools’ require.js to bypass CSP and execute injected scripts. Affected product: Mozilla Firefox

CVE-2019-9807

CVE-2019-9807 affects Firefox prior to 66.0. When arbitrary text is sent over an FTP connection and a page reload is initiated, Firefox could display a modal alert containing that text, enabling potential social engineering. Affected product: Firefox (pre-66). Root cause described in connected so...

CVE-2019-9814

CVE-2019-9814 affects Mozilla Firefox before version 67.0. The issue comprises memory safety bugs that could allow memory corruption and, with enough effort, potentially arbitrary code execution. The vulnerability is documented as memory safety bugs in Firefox 66 that are fixed in Firefox 67.0. I...

CVE-2020-15667

The CVE-2020-15667 issue affects Mozilla Firefox pre-80, caused by an invalid name length during MAR update file processing after signature validation, leading to a heap overflow and memory corruption with potential arbitrary code execution. Exploitation is limited to scenarios using the Mozilla-...

CVE-2020-15682

CVE-2020-15682 affects Firefox before 82. An attacker could trigger an external protocol prompt to be spoofed by associating it with a controlled origin, enabling spoofing. Mozilla fixed this by making external protocol prompts tab-modal and binding them to the correct origin; impact is spoofing ...

CVE-2024-3855

CVE-2024-3855 is a Firefox vulnerability where the JIT optimizer incorrectly handled MSubstr, causing out-of-bounds reads in affected builds. The issue affects Firefox versions older than 125. The cited sources (Mozilla bug 1885828 and MFSA advisory MFSA2024-18) describe the root cause in JIT str...

CVE-2024-4772

CVE-2024-4772 affects Mozilla Firefox earlier than 126. Root cause: HTTP digest authentication nonce generated with rand(), making nonces potentially predictable. Public sources confirm Firefox 126 and newer fix the issue; affected product is Firefox (desktop/mobile variants in MFSA reference). R...

CVE-2024-4774

CVE-2024-4774 affects Mozilla Firefox earlier than 126.0. The issue is in ShmemCharMapHashEntry(), where move semantics for one data member can bypass proper move, causing potentially undefined behavior. Documents corroborate Firefox

CVE-2011-3659

CVE-2011-3659 is a use-after-free in Mozilla Firefox (before 3.6.26 and 4.x through 9.0), Thunderbird (before 3.1.18 and 5.0 through 9.0), and SeaMonkey (before 2.7). The root cause is premature notification of AttributeChildRemoved that affects access to removed nsDOMAttribute child nodes, enabl...

CVE-2012-3991

CVE-2012-3991 affects Mozilla Firefox and related Mozilla products: Firefox and Firefox ESR before the 16.0 line, Thunderbird before 16.0, and SeaMonkey before 2.13 did not properly restrict JSAPI GetProperty access, bypassing the Same Origin Policy. This vulnerability could allow remote attacker...

CVE-2013-0749

CVE-2013-0749 describes multiple unspecified vulnerabilities in the Mozilla Firefox browser engine (before 18.0) and related products (Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2 and ESR 17.x before 17.0.1, SeaMonkey before 2.15). The description states that remote attackers could c...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2017-5419

CVE-2017-5419 is a denial-of-service vulnerability affecting Mozilla Firefox and Thunderbird prior to version 52. The issue arises when a malicious page repeatedly triggers a modal authentication prompt, causing the browser UI to become unresponsive. Public references describe this as a DOS condi...

CVE-2018-5153

CVE-2018-5153 affects Mozilla Firefox before 60.0. When websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted, causing an out-of-bounds read and the read memory being sent back to the origin server. The issue is fixed in Firefox 60.0; upgrade to 6...

CVE-2018-5172

CVE-2018-5172 : The Live Bookmarks page and PDF viewer in Firefox allow execution of injected script when a user pastes script content from the clipboard while viewing RSS feeds or PDF files. This could enable social engineering to run code in the page context, but does not grant privilege escala...

CVE-2021-29963

Summary: CVE-2021-29963 affects Firefox for Android, where address bar search suggestions in private browsing mode reused session data from normal mode. The issue is limited to Android; other OSes are unaffected. Affected product: Firefox for Android prior to version 89. Root cause: private mode ...

CVE-2024-4764

CVE-2024-4764 affects Mozilla Firefox: a use-after-free in WebRTC audio input handling caused by multiple WebRTC threads potentially claiming a newly connected audio input. The vulnerability impacts Firefox versions earlier than 126. The CVSS v3.1 base score is 9.8 (critical, network attack vecto...

CVE-2025-5267

CVE-2025-5267 is a clickjacking vulnerability affecting Firefox (versions <139 and ESR <128.11) and Thunderbird (versions <139 and

CVE-2012-4185

CVE-2012-4185 describes a buffer overflow in Mozilla Firefox’s nsCharTraits::length function that could allow remote code execution or a heap memory corruption in Firefox <16.0, ESR 10.x <10.0.8, Thunderbird <16.0/ESR 10.x <10.0.8, and SeaMonkey

CVE-2016-9896

CVE-2016-9896 is a use-after-free in WebVR affecting Mozilla Firefox versions before 50.1, specifically when manipulating the navigator object. The impact is denial of memory safety, with potential arbitrary code execution and memory corruption as described in the vulnerability notes. Firefox 50....

CVE-2017-5381

CVE-2017-5381 affects Firefox

CVE-2017-5389

CVE-2017-5389 affects Firefox versions older than 51.0. The issue arises when a WebExtension uses the mozAddonManager API to modify CSP headers and redirect script loads via host requests, enabling an attacker to install additional extensions without user permission. The connected Nessus advisori...

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2017-5455

CVE-2017-5455 describes a sandbox-escape vulnerability in Firefox ESR < 52.1 and Firefox

CVE-2017-5472

CVE-2017-5472 is a use-after-free in Mozilla's frameloader during CSS layout regeneration, leading to potential crash. Concrete details in connected docs show impact on Firefox versions <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7789

CVE-2017-7789 affects Firefox versions earlier than 55.0. If a server sends two Strict-Transport-Security headers for a single connection, the headers are rejected as invalid, and HSTS is not enabled for that connection. Documented impact is limited to Firefox

CVE-2018-5136

CVE-2018-5136 describes a policy bypass in Mozilla Firefox where a shared worker created from a "data:" URL in one tab can be shared with another tab from a different origin, bypassing the same-origin policy. This affects Firefox versions earlier than 59. The bug is that a data URL-based shared w...

CVE-2018-5143

CVE-2018-5143 is reported against Mozilla Firefox versions before 59.0. The issue arises when a javascript: URL containing a tab character bypasses protocol removal in the address bar, enabling an XSS-style impact where a user could be socially engineered to execute a script in their own browser....

CVE-2023-29549

CVE-2023-29549 : The issue arises when a call to bind may end up in the wrong realm, creating a vulnerability for JavaScript-based sandboxes such as SES in Firefox-based browsers. Affected products include Firefox for Android <112, Firefox <112, and Focus for Android