CVE-2023-29543

CVE-2023-29543 affects Mozilla Firefox and Focus for Android prior to version 112, caused by a memory-corruption/use-after-free in a global object’s debugger vector. Affected products include Firefox for Android <112, Firefox <112, and Focus for Android

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2012-4214

CVE-2012-4214 is a use-after-free in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox before 17.0 and ESR 10.x before 10.0.11, Thunderbird before 17.0/ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The vulnerability can allow remote attackers to execute arbitrary code or...

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2017-5381

CVE-2017-5381 affects Firefox

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-7780

CVE-2017-7780 refers to memory safety bugs in Mozilla Firefox 54 that could be exploited to run arbitrary code. The advisory notes memory corruption and that Firefox versions before 55 are affected (i.e., Firefox 54 and ESR 52.2). The connected Nessus/NVD records enumerate additional related CVEs...

CVE-2018-5153

CVE-2018-5153 affects Mozilla Firefox before 60.0. When websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted, causing an out-of-bounds read and the read memory being sent back to the origin server. The issue is fixed in Firefox 60.0; upgrade to 6...

CVE-2018-5172

CVE-2018-5172 : The Live Bookmarks page and PDF viewer in Firefox allow execution of injected script when a user pastes script content from the clipboard while viewing RSS feeds or PDF files. This could enable social engineering to run code in the page context, but does not grant privilege escala...

CVE-2018-5179

Affected software: Chromium/Google Chrome (browser). Issue: CVE-2018-5179, within the ServiceWorker implementation, where the update() path could run indefinitely due to insufficient limits. Cause: described as an error in the ServiceWorker component; multiple vendor advisories map this CVE to pr...

CVE-2022-46873

CVE-2022-46873 affects Mozilla Firefox, with the vulnerability arising because Firefox did not implement the unsafe-hashes CSP directive. An attacker who can inject markup into a page protected by a CSP could execute script, constrained by the document’s CSP. Affected: Firefox versions earlier th...

CVE-2023-29549

CVE-2023-29549 : The issue arises when a call to bind may end up in the wrong realm, creating a vulnerability for JavaScript-based sandboxes such as SES in Firefox-based browsers. Affected products include Firefox for Android <112, Firefox <112, and Focus for Android

CVE-2023-6872

CVE-2023-6872 concerns Mozilla Firefox earlier than 121, where GNOME leaked browser tab titles to system logs, potentially exposing user browsing habits in private tabs. Affected product: Firefox

CVE-2024-0745

The CVE-2024-0745 issue is a concrete Firefox vulnerability: a stack buffer overflow in the WebAudio OscillatorNode that could cause a crash. It affects Firefox versions older than 122. The root cause is in the WebAudio OscillatorNode code; the impact is a potentially exploitable crash with a hig...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-5612

CVE-2013-5612 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 due to the absence of a charset parameter in the Content-Type header. Connected advisories confirm Firefox/SeaMonkey fixes in 2013–2014 releases (e.g., openSUSE SU-2013:1917, Mirac...

CVE-2014-1488

CVE-2014-1488 affects Mozilla Firefox < 27.0 and SeaMonkey

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2018-5143

CVE-2018-5143 is reported against Mozilla Firefox versions before 59.0. The issue arises when a javascript: URL containing a tab character bypasses protocol removal in the address bar, enabling an XSS-style impact where a user could be socially engineered to execute a script in their own browser....

CVE-2019-9798

CVE-2019-9798 affects Firefox on Android, where a world-writable APITRACE_LIB location can be loaded by the browser. An untrusted or compromised application could write malicious code to this library and trigger a man-in-the-middle scenario when the library is loaded, enabling data interception o...

CVE-2021-29944

CVE-2021-29944 details: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View in Firefox for Android. HTML injection is possible despite a Content Security Policy preventing direct code execution. Affected product/versions: Firefox before 88 on Android. Other operating ...

CVE-2023-23604

A vulnerability (CVE-2023-23604) affects Mozilla Firefox older than 109. A duplicate SystemPrincipal object could be created when parsing a non-system HTML document via DOMParser::ParseFromSafeString, potentially bypassing web security checks. The issue is documented across multiple sources (nota...

CVE-2024-0754

CVE-2024-0754 concerns Mozilla Firefox versions older than 122, where certain WASM source files loaded in devtools could cause a crash. The AMD (root cause) is not fully detailed in the provided documents, but the consequence is a crash potentially affecting availability. Public references in the...

CVE-2024-3858

CVE-2024-3858 concerns Mozilla Firefox: a vulnerability that allows mutating a JavaScript object such that the JIT could crash while tracing it, affecting Firefox versions older than 125. The issue is documented in multiple feeds (including Mozilla MFSA advisory) and is tracked across several sec...

CVE-2024-3860

CVE-2024-3860 concerns Mozilla Firefox: an out-of-memory condition during object initialization can yield an empty shape list, and if the JIT traces that object, a crash can occur. Affected: Firefox

CVE-2008-3837

CVE-2008-3837 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2) and SeaMonkey (before 1.1.12). A crafted onmousedown action that calls window.moveBy can allow a user‑assisted remote attacker to move a window during a mouse click, potentially triggering a drag‑and‑drop–related action ...

CVE-2017-5387

CVE-2017-5387 affects Mozilla Firefox (pre-51). Root cause: local-file existence can be inferred via double firing of onerror when a TRACK tag references a non-existent source loaded locally. Impact: disclosure of local file existence; no explicit exploitation details provided in the sources. Aff...

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2021-29962

CVE-2021-29962 affects Firefox for Android; the issue causes instability when a website opens too many popups and only impacts Firefox on Android, with affected versions being Firefox

CVE-2022-45413

CVE-2022-45413 affects Firefox for Android, where the S.browser_fallback_url parameter can redirect a user and cause SameSite=Strict cookies to be sent. The issue is limited to Firefox on Android; other OSes are unaffected. The vulnerability targets the browser’s handling of SameSite cookies, pot...

CVE-2023-25741

The CVE-2023-25741 entry concerns Firefox (

CVE-2024-0744

Vulnerability CVE-2024-0744 affects Mozilla Firefox. A JIT-compiled code path could dereference a wild pointer, potentially causing an exploitable crash in Firefox versions older than 122. Affected products/versions include Firefox

CVE-2026-8090

CVE-2026-8090 describes a use-after-free in Firefox’s DOM: Networking component. The issue is fixed in Firefox 150.0.2, Firefox ESR 140.10.2, and Firefox ESR 115.35.2. The connected sources confirm the vulnerability class and the exact patched versions. The description does not specify affected c...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2017-7783

CVE-2017-7783 describes a denial-of-service vulnerability in Mozilla Firefox affecting versions earlier than 55. The issue occurs when a long username is used in a username:password@URL (for example http://UserName:[email protected]); the browser’s modal prompt can hang or crash, leading to a ...

CVE-2018-5140

CVE-2018-5140 involves a disclosure in Mozilla Firefox prior to 59 where the moz-icon: protocol used by moz-icons can be accessed by web content, allowing a malicious page to leak information about which MIME types are associated with which applications. Affected product: Firefox and Firefox ESR ...

CVE-2018-5169

CVE-2018-5169 affects Mozilla Firefox versions before 60. A drag-and-drop of hyperlinked text containing a chrome: URL onto the home button can reset the homepage to include chrome pages. This is documented in Mozilla’s MFSA2018-11 advisory (CVE-2018-5169). Remediation observed in downstream advi...

CVE-2023-25736

This CVE concerns Mozilla Firefox. Affected component: browser/HTML handling where an invalid downcast from nsHTMLDocument to nsIContent could trigger undefined behavior. Impact: high/critical in CVSS terms, with potential for disruption or data exposure as described by multiple sources; affected...

CVE-2024-0748

CVE-2024-0748 concerns Mozilla Firefox where a compromised content process could update the document URI, enabling an attacker to set an arbitrary URI in the address bar or history. The issue affects Firefox versions earlier than 122 and is addressed by Mozilla in MFSA2024-01, which notes fixes i...

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2019-11700

Mozilla Firefox before version 67 is affected by CVE-2019-11700 due to improper handling of the res: protocol. A hyperlink using res: could cause local-file access at a known location in Internet Explorer when a user approves execution, with the issue confined to Windows. The vulnerability is roo...

CVE-2023-28159

The CVE-2023-28159 entry concerns Firefox for Android only. It describes a vulnerability where the fullscreen notification could be hidden by using download popups, potentially confusing users or enabling spoofing. Root cause details are not further specified in the provided documents. Impact is ...

CVE-2023-32209

CVE-2023-32209 : A maliciously crafted favicon could lead to an out-of-memory crash in Mozilla Firefox. Affected product/version: Firefox prior to 113. Impact: potential crash due to memory exhaustion when processing a favicon. Root cause details are limited in the provided documents beyond favic...