CVE-2024-3860

CVE-2024-3860 concerns Mozilla Firefox: an out-of-memory condition during object initialization can yield an empty shape list, and if the JIT traces that object, a crash can occur. Affected: Firefox

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2019-9798

CVE-2019-9798 affects Firefox on Android, where a world-writable APITRACE_LIB location can be loaded by the browser. An untrusted or compromised application could write malicious code to this library and trigger a man-in-the-middle scenario when the library is loaded, enabling data interception o...

CVE-2022-46884

CVE-2022-46884 corresponds to a use-after-free in Firefox SVG Images when the Refresh Driver is destroyed at an inopportune moment, leading to memory corruption or a potentially exploitable crash. Affected product: Firefox (desktop). Impact as described: memory safety issue with SVG Images; prior...

CVE-2023-25745

CVE-2023-25745 covers memory-safety bugs in Firefox 109 that affect Firefox versions prior to 110. The issue involves memory corruption vectors in Firefox’s code paths and could enable arbitrary code execution with user interaction, as described in multiple sources. Affected product: Mozilla Fire...

CVE-2023-29545

CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...

CVE-2025-2817

The CVE-2025-2817 issue describes a vulnerability in Thunderbird’s update mechanism where a medium-integrity user process could interfere with the SYSTEM updater by manipulating file-locking, enabling privilege escalation via code injection into a user-privileged process. Affected products includ...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2013-0764

CVE-2013-0764 affects Mozilla Firefox (before 18.0), Firefox ESR (before 17.0.2), Thunderbird (before 17.0.2 and ESR 17.x before 17.0.2), and SeaMonkey (before 2.15). The vulnerability is a thread-safety issue in nsSOCKSSocketInfo::ConnectToProxy that can allow remote code execution through craft...

CVE-2013-5612

CVE-2013-5612 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 due to the absence of a charset parameter in the Content-Type header. Connected advisories confirm Firefox/SeaMonkey fixes in 2013–2014 releases (e.g., openSUSE SU-2013:1917, Mirac...

CVE-2014-1488

CVE-2014-1488 affects Mozilla Firefox < 27.0 and SeaMonkey

CVE-2017-5384

CVE-2017-5384 : Information disclosure via Proxy Auto-Config (PAC) in Firefox

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-5133

CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...

CVE-2018-5140

CVE-2018-5140 involves a disclosure in Mozilla Firefox prior to 59 where the moz-icon: protocol used by moz-icons can be accessed by web content, allowing a malicious page to leak information about which MIME types are associated with which applications. Affected product: Firefox and Firefox ESR ...

CVE-2018-5169

CVE-2018-5169 affects Mozilla Firefox versions before 60. A drag-and-drop of hyperlinked text containing a chrome: URL onto the home button can reset the homepage to include chrome pages. This is documented in Mozilla’s MFSA2018-11 advisory (CVE-2018-5169). Remediation observed in downstream advi...

CVE-2018-5179

Affected software: Chromium/Google Chrome (browser). Issue: CVE-2018-5179, within the ServiceWorker implementation, where the update() path could run indefinitely due to insufficient limits. Cause: described as an error in the ServiceWorker component; multiple vendor advisories map this CVE to pr...

CVE-2021-29944

CVE-2021-29944 details: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View in Firefox for Android. HTML injection is possible despite a Content Security Policy preventing direct code execution. Affected product/versions: Firefox before 88 on Android. Other operating ...

CVE-2023-23604

A vulnerability (CVE-2023-23604) affects Mozilla Firefox older than 109. A duplicate SystemPrincipal object could be created when parsing a non-system HTML document via DOMParser::ParseFromSafeString, potentially bypassing web security checks. The issue is documented across multiple sources (nota...

CVE-2023-37208

CVE-2023-37208 affects Firefox (<115), Firefox ESR (<102.13), and Thunderbird (

CVE-2025-5269

CVE-2025-5269 is a memory-safety bug reported in Firefox ESR 128.10 and Thunderbird 128.10 that shows memory corruption and could potentially be exploited to run arbitrary code. Affected products: Firefox ESR < 128.11 and Thunderbird

CVE-2008-3837

CVE-2008-3837 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2) and SeaMonkey (before 1.1.12). A crafted onmousedown action that calls window.moveBy can allow a user‑assisted remote attacker to move a window during a mouse click, potentially triggering a drag‑and‑drop–related action ...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2012-4214

CVE-2012-4214 is a use-after-free in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox before 17.0 and ESR 10.x before 10.0.11, Thunderbird before 17.0/ESR 10.x before 10.0.11, and SeaMonkey before 2.14. The vulnerability can allow remote attackers to execute arbitrary code or...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2017-7783

CVE-2017-7783 describes a denial-of-service vulnerability in Mozilla Firefox affecting versions earlier than 55. The issue occurs when a long username is used in a username:password@URL (for example http://UserName:[email protected]); the browser’s modal prompt can hang or crash, leading to a ...

CVE-2018-5141

CVE-2018-5141 is a vulnerability in the Firefox Push API where notifications can be triggered by web content via service workers without direct user interaction, potentially allowing opening new tabs or displaying content from arbitrary URLs. The connected documents confirm this affects Firefox v...

CVE-2022-45413

CVE-2022-45413 affects Firefox for Android, where the S.browser_fallback_url parameter can redirect a user and cause SameSite=Strict cookies to be sent. The issue is limited to Firefox on Android; other OSes are unaffected. The vulnerability targets the browser’s handling of SameSite cookies, pot...

CVE-2022-45417

The CVE-2022-45417 entry corresponds to Mozilla Firefox prior to version 107, where Service Workers failed to detect Private Browsing Mode in all cases. This could cause Service Workers to be written to disk for sites visited in Private Browsing Mode, potentially leaking Private Browsing details ...

CVE-2023-25741

The CVE-2023-25741 entry concerns Firefox (

CVE-2023-29543

CVE-2023-29543 affects Mozilla Firefox and Focus for Android prior to version 112, caused by a memory-corruption/use-after-free in a global object’s debugger vector. Affected products include Firefox for Android <112, Firefox <112, and Focus for Android

CVE-2024-3858

CVE-2024-3858 concerns Mozilla Firefox: a vulnerability that allows mutating a JavaScript object such that the JIT could crash while tracing it, affecting Firefox versions older than 125. The issue is documented in multiple feeds (including Mozilla MFSA advisory) and is tracked across several sec...

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2016-9077

The CVE-2016-9077 issue affects Mozilla Firefox

CVE-2016-9080

CVE-2016-9080 is a memory-safety issue in Firefox prior to 50.1. The vulnerability family includes memory corruption that, with enough effort, could be exploited to execute arbitrary code. The CVE affects Firefox versions

CVE-2017-5413

CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2019-11700

Mozilla Firefox before version 67 is affected by CVE-2019-11700 due to improper handling of the res: protocol. A hyperlink using res: could cause local-file access at a known location in Internet Explorer when a user approves execution, with the issue confined to Windows. The vulnerability is roo...

CVE-2012-3967

CVE-2012-3967 is a Firefox/WebGL vulnerability on Linux where the WebGL implementation fails to interact correctly with Mesa drivers when a large number of sampler uniforms are used. This can let remote attackers execute arbitrary code or cause a denial of service (stack memory corruption) via a ...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2017-5387

CVE-2017-5387 affects Mozilla Firefox (pre-51). Root cause: local-file existence can be inferred via double firing of onerror when a TRACK tag references a non-existent source loaded locally. Impact: disclosure of local file existence; no explicit exploitation details provided in the sources. Aff...

CVE-2017-7780

CVE-2017-7780 refers to memory safety bugs in Mozilla Firefox 54 that could be exploited to run arbitrary code. The advisory notes memory corruption and that Firefox versions before 55 are affected (i.e., Firefox 54 and ESR 52.2). The connected Nessus/NVD records enumerate additional related CVEs...

CVE-2017-7796

CVE-2017-7796 is a Windows-specific vulnerability in Mozilla Firefox prior to version 55 where the updater’s logger deletes update.log before writing a new log. The updater’s command-line argument specifies the log path, which could be abused with a local exploit to cause the deletion of a differ...

CVE-2018-5137

CVE-2018-5137 affects Firefox for pre-59 releases. A legacy extension’s non-contentaccessible, defined resources can be loaded by an arbitrary web page using a maliciously crafted path string. The vulnerability does not affect WebExtensions. Root cause: loading defined resources from legacy exten...

CVE-2020-26977

CVE-2020-26977 affects Firefox for Android; the flaw allowed an attacker to control the content of a tab by connecting to a website through an unresponsive port, while the URL bar showed the original domain. The issue is limited to Firefox for Android and Firefox

CVE-2021-29962

CVE-2021-29962 affects Firefox for Android; the issue causes instability when a website opens too many popups and only impacts Firefox on Android, with affected versions being Firefox