CVE-2023-37212

CVE-2023-37212 corresponds to memory-safety bugs in Mozilla Firefox affecting versions older than 115. The connected advisories confirm Firefox 114-era memory-corruption issues that could potentially be exploited to run arbitrary code, with the impact limited to the affected browser versions. The...

CVE-2024-4778

CVE-2024-4778 maps to memory-safety bugs in Firefox 125 that affect Firefox versions earlier than 126. The connected security bulletins note memory-corruption evidence and the potential for arbitrary code execution, with affected products including Firefox 125 (and Firefox ESR 115.10) prior to up...

CVE-2011-0064

The CVE-2011-0064 issue affects HarfBuzz’s hb_buffer_ensure() as used by Pango (notably in Pango 1.28.3) and other products, where memory reallocations are not verified, potentially causing a NULL pointer dereference leading to a crash or, via crafted OpenType data triggering an incorrect index, ...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2017-5413

CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...

CVE-2017-5453

CVE-2017-5453 affects Mozilla Firefox

CVE-2017-7796

CVE-2017-7796 is a Windows-specific vulnerability in Mozilla Firefox prior to version 55 where the updater’s logger deletes update.log before writing a new log. The updater’s command-line argument specifies the log path, which could be abused with a local exploit to cause the deletion of a differ...

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2018-5141

CVE-2018-5141 is a vulnerability in the Firefox Push API where notifications can be triggered by web content via service workers without direct user interaction, potentially allowing opening new tabs or displaying content from arbitrary URLs. The connected documents confirm this affects Firefox v...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2016-9077

The CVE-2016-9077 issue affects Mozilla Firefox

CVE-2016-9894

CVE-2016-9894 : A buffer overflow in SkiaGL occurs when a GrGLBuffer is truncated during allocation, leading to overflow by later writers. Affects Mozilla Firefox <= 50.0.x (reported for Firefox

CVE-2023-6873

CVE-2023-6873 is a memory-safety vulnerability reported in Mozilla Firefox affecting versions older than 121. The issue involves memory corruption in Firefox 120-era code paths that could potentially be exploited to execute arbitrary code. Connected advisories (e.g., MFSA2023-56) corroborate wide...

CVE-2025-6424

CVE-2025-6424: Use-after-free in FontFaceSet causing potentially exploitable crash in Firefox (affected: Firefox <140, ESR <115.25, ESR

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2016-5289

CVE-2016-5289 refers to memory safety bugs reported in Firefox 49 that showed evidence of memory corruption and could enable arbitrary code execution. The vulnerability affects Firefox versions older than 50, and multiple connected advisories indicate fixes were deployed in Firefox 50 (MFSA 2016-...

CVE-2016-9067

CVE-2016-9067 refers to two heap-use-after-free vulnerabilities in Firefox’s DOM operations, specifically nsINode::ReplaceOrInsertBefore, potentially allowing crashes exploitable through crafted content in Firefox versions before 50. The related advisories confirm the issue as a memory-safety bug...

CVE-2017-5418

CVE-2017-5418 is an out-of-bounds read error in parsing HTTP digest authorization responses, leading to information leakage. Affected products are Mozilla Firefox and Thunderbird prior to version 52.0. The issue is fixed in Firefox 52.0+ (and related Thunderbird updates per advisories), with reme...

CVE-2017-7797

CVE-2017-7797 affects Firefox versions prior to 55.0. The issue arises from how response header names are interned: header names are stored in a global registry and are not protected by same-origin policies, allowing stored header names to be exposed across origins. Public documentation in the co...

CVE-2018-12381

Concretely, CVE-2018-12381 affects Mozilla Firefox ESR < 60.2 and Firefox

CVE-2018-5137

CVE-2018-5137 affects Firefox for pre-59 releases. A legacy extension’s non-contentaccessible, defined resources can be loaded by an arbitrary web page using a maliciously crafted path string. The vulnerability does not affect WebExtensions. Root cause: loading defined resources from legacy exten...

CVE-2022-46885

CVE-2022-46885: Memory-safety bugs in Mozilla Firefox 105 allow the potential execution of arbitrary code in Firefox versions before 106. The affected product is Mozilla Firefox; root cause is memory corruption. The connected documents confirm the vulnerability but do not provide an explicit reme...

CVE-2023-25740

CVE-2023-25740 affects Firefox for Windows (pre-110). After downloading a Windows .scf script from the local filesystem, an attacker could specify a remote path that triggers unexpected network requests by the OS and may leak NTLM credentials. Impact is limited to Firefox on Windows; other OSes a...

CVE-2023-29538

CVE-2023-29538 affects Firefox (and Focus) on Android: under specific WebExtension load circumstances a jar:file:/// URI could be exposed instead of moz-extension:///, leaking local directory paths. Affected: Firefox for Android <112, Firefox <112, and Focus for Android

CVE-2023-6869

CVE-2023-6869 affects Mozilla Firefox older than 121. The issue arises when a element could be manipulated to render content outside a sandboxed iframe, allowing untrusted content to masquerade as trusted content. Impact per sources is user-facing trust bypass with potential to display misleadin...

CVE-2012-5841

CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2013-5614

Affected software: Mozilla Firefox <= 25.x/26.0 and SeaMonkey

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2016-5292

CVE-2016-5292 : In Firefox

CVE-2016-5294

CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox

CVE-2016-7152

CVE-2016-7152 is described in IBM Security Bulletin as a HEIST-related vulnerability affecting the Firefox component of the IBM Synthetic Playback agent used with IBM Application Performance Management (APM) 8.1.3 and IBM Cloud Application Performance Management. The root cause is that the HTTPS ...

CVE-2016-9071

CVE-2016-9071 describes a vulnerability in Mozilla Firefox prior to 50 where Content Security Policy combined with HTTP-to-HTTPS redirection could allow a malicious server to determine if a site is present in a user’s browsing history. Impact: history verification via CSP/HSTS/redirect. Affected ...

CVE-2017-5406

CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...

CVE-2017-7752

CVE-2017-7752 is a use-after-free vulnerability triggered by specific user interactions with the input method editor (IME) in certain languages. The flaw is reported to affect Mozilla Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The impacted component is tied ...

CVE-2017-7788

CVE-2017-7788 affects Firefox

CVE-2018-5132

CVE-2018-5132 : The Find API for WebExtensions in Firefox can search privileged pages (for example, about:debugging) when those pages are open in a tab, potentially exposing protected data. Affected products/versions: Firefox

CVE-2026-7323

Memory safety bugs were reported in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0, and Thunderbird 150.0.0, with evidence of memory corruption and the possibility that exploiting these could have permitted arbitrary code execution. These issues have been fixed in Firefox 150.0.1...

CVE-2013-6672

CVE-2013-6672: Firefox (Linux) and SeaMonkey are affected by a Linux clipboard information disclosure via middle-click paste. The initial entry specifies Firefox < 26.0 and SeaMonkey

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2017-5393

CVE-2017-5393: The mozAddonManager allows installation of extensions from addons.mozilla.org CDN. In combination with an XSS on Mozilla AMO sites, a malicious extension could install additional extensions. Affected product: Firefox

CVE-2017-7799

CVE-2017-7799 - Firefox before 55 : A cross-site scripting risk exists due to JavaScript on the about:webrtc page being assigned to innerHTML without proper sanitization. The data on this page is supplied by WebRTC usage and not user-controlled, making exploitation possible under certain conditio...

CVE-2026-8389

CVE-2026-8389 is a JIT miscompilation vulnerability in the Firefox JavaScript Engine (JIT component). Multiple connected sources (NVD, EUVD, CIRCL sighting, Debian/MD advisories, and Mozilla MFSA advisory) confirm the issue affects Firefox and was addressed in version 150.0.3. The underlying issu...

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...

CVE-2013-5619

CVE-2013-5619 describes a vulnerability in Mozilla’s SpiderMonkey JavaScript engine where the binary-search implementation could overflow, potentially enabling a remote attacker to cause a denial of service via crafted JavaScript. The initial Mozilla/OpenSUSE/IBM advisories confirm this is a Java...

CVE-2016-9072

CVE-2016-9072 - Firefox 64-bit NPAPI sandbox not enabled by default Affecting: Mozilla Firefox on 64-bit Windows (Firefox versions older than 50). Root cause: when a new profile is created on 64-bit Windows, the sandbox for 64-bit NPAPI plugins is not enabled by default, leaving the plugin sandbo...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

CVE-2017-7808

CVE-2017-7808 affects Mozilla Firefox prior to 55.0. A CSP policy using a frame-ancestors directive with origins that include paths allows a cross-origin leak by comparing against the path instead of the origin. The vulnerability is described for Firefox