CVE-2022-46873

CVE-2022-46873 affects Mozilla Firefox, with the vulnerability arising because Firefox did not implement the unsafe-hashes CSP directive. An attacker who can inject markup into a page protected by a CSP could execute script, constrained by the document’s CSP. Affected: Firefox versions earlier th...

CVE-2023-25736

This CVE concerns Mozilla Firefox. Affected component: browser/HTML handling where an invalid downcast from nsHTMLDocument to nsIContent could trigger undefined behavior. Impact: high/critical in CVSS terms, with potential for disruption or data exposure as described by multiple sources; affected...

CVE-2023-6872

CVE-2023-6872 concerns Mozilla Firefox earlier than 121, where GNOME leaked browser tab titles to system logs, potentially exposing user browsing habits in private tabs. Affected product: Firefox

CVE-2013-0747

Technical details for CVE-2013-0747 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2016-9894

CVE-2016-9894 : A buffer overflow in SkiaGL occurs when a GrGLBuffer is truncated during allocation, leading to overflow by later writers. Affects Mozilla Firefox <= 50.0.x (reported for Firefox

CVE-2017-5453

CVE-2017-5453 affects Mozilla Firefox

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2018-12381

Concretely, CVE-2018-12381 affects Mozilla Firefox ESR < 60.2 and Firefox

CVE-2021-29965

CVE-2021-29965 affects Mozilla Firefox for Android (pre-89). A malicious website that spawns an HTTP Authentication dialog could cause the built-in password manager to suggest passwords for the currently active site instead of the triggering site. Root cause described in connected advisories invo...

CVE-2024-0754

CVE-2024-0754 concerns Mozilla Firefox versions older than 122, where certain WASM source files loaded in devtools could cause a crash. The AMD (root cause) is not fully detailed in the provided documents, but the consequence is a crash potentially affecting availability. Public references in the...

CVE-2026-10702

CVE-2026-10702 relates to a JIT miscompilation in the JavaScript Engine (JIT component) of Firefox. It is fixed in Firefox 151.0.3. The connected documents confirm the affected product as Firefox and the root cause as a JIT miscompilation, with remediation being upgrade to 151.0.3. No exploitatio...

CVE-2011-0064

The CVE-2011-0064 issue affects HarfBuzz’s hb_buffer_ensure() as used by Pango (notably in Pango 1.28.3) and other products, where memory reallocations are not verified, potentially causing a NULL pointer dereference leading to a crash or, via crafted OpenType data triggering an incorrect index, ...

CVE-2012-3992

CVE-2012-3992 affects Mozilla Firefox (and related Firefox-based apps) where history data is not properly handled. The flaw lets remote attackers perform cross-site scripting (XSS) or obtain sensitive POST content via a location.hash write operation combined with history navigation that loads a U...

CVE-2016-9067

CVE-2016-9067 refers to two heap-use-after-free vulnerabilities in Firefox’s DOM operations, specifically nsINode::ReplaceOrInsertBefore, potentially allowing crashes exploitable through crafted content in Firefox versions before 50. The related advisories confirm the issue as a memory-safety bug...

CVE-2017-5406

CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...

CVE-2017-7797

CVE-2017-7797 affects Firefox versions prior to 55.0. The issue arises from how response header names are interned: header names are stored in a global registry and are not protected by same-origin policies, allowing stored header names to be exposed across origins. Public documentation in the co...

CVE-2023-25740

CVE-2023-25740 affects Firefox for Windows (pre-110). After downloading a Windows .scf script from the local filesystem, an attacker could specify a remote path that triggers unexpected network requests by the OS and may leak NTLM credentials. Impact is limited to Firefox on Windows; other OSes a...

CVE-2023-37212

CVE-2023-37212 corresponds to memory-safety bugs in Mozilla Firefox affecting versions older than 115. The connected advisories confirm Firefox 114-era memory-corruption issues that could potentially be exploited to run arbitrary code, with the impact limited to the affected browser versions. The...

CVE-2024-0745

The CVE-2024-0745 issue is a concrete Firefox vulnerability: a stack buffer overflow in the WebAudio OscillatorNode that could cause a crash. It affects Firefox versions older than 122. The root cause is in the WebAudio OscillatorNode code; the impact is a potentially exploitable crash with a hig...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2016-9071

CVE-2016-9071 describes a vulnerability in Mozilla Firefox prior to 50 where Content Security Policy combined with HTTP-to-HTTPS redirection could allow a malicious server to determine if a site is present in a user’s browsing history. Impact: history verification via CSP/HSTS/redirect. Affected ...

CVE-2017-5393

CVE-2017-5393: The mozAddonManager allows installation of extensions from addons.mozilla.org CDN. In combination with an XSS on Mozilla AMO sites, a malicious extension could install additional extensions. Affected product: Firefox

CVE-2017-5418

CVE-2017-5418 is an out-of-bounds read error in parsing HTTP digest authorization responses, leading to information leakage. Affected products are Mozilla Firefox and Thunderbird prior to version 52.0. The issue is fixed in Firefox 52.0+ (and related Thunderbird updates per advisories), with reme...

CVE-2017-7752

CVE-2017-7752 is a use-after-free vulnerability triggered by specific user interactions with the input method editor (IME) in certain languages. The flaw is reported to affect Mozilla Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The impacted component is tied ...

CVE-2018-5132

CVE-2018-5132 : The Find API for WebExtensions in Firefox can search privileged pages (for example, about:debugging) when those pages are open in a tab, potentially exposing protected data. Affected products/versions: Firefox

CVE-2018-5134

CVE-2018-5134 affects Mozilla Firefox versions older than 59.0. WebExtensions could use view-source: URLs to access local file: URLs and content in about:cache, bypassing content restrictions. This is described as a WebExtensions content-exposure issue. The numbered references indicate the adviso...

CVE-2024-4778

CVE-2024-4778 maps to memory-safety bugs in Firefox 125 that affect Firefox versions earlier than 126. The connected security bulletins note memory-corruption evidence and the potential for arbitrary code execution, with affected products including Firefox 125 (and Firefox ESR 115.10) prior to up...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2016-5289

CVE-2016-5289 refers to memory safety bugs reported in Firefox 49 that showed evidence of memory corruption and could enable arbitrary code execution. The vulnerability affects Firefox versions older than 50, and multiple connected advisories indicate fixes were deployed in Firefox 50 (MFSA 2016-...

CVE-2016-5292

CVE-2016-5292 : In Firefox

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

CVE-2017-7751

CVE-2017-7751 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird associated with content viewer listeners, affecting Firefox versions before 54, ESR before 52.2, and Thunderbird before 52.2. The underlying issue is a memory safety flaw that can lead to a potentially exploitable ...

CVE-2017-7808

CVE-2017-7808 affects Mozilla Firefox prior to 55.0. A CSP policy using a frame-ancestors directive with origins that include paths allows a cross-origin leak by comparing against the path instead of the origin. The vulnerability is described for Firefox

CVE-2023-28159

The CVE-2023-28159 entry concerns Firefox for Android only. It describes a vulnerability where the fullscreen notification could be hidden by using download popups, potentially confusing users or enabling spoofing. Root cause details are not further specified in the provided documents. Impact is ...

CVE-2023-32209

CVE-2023-32209 : A maliciously crafted favicon could lead to an out-of-memory crash in Mozilla Firefox. Affected product/version: Firefox prior to 113. Impact: potential crash due to memory exhaustion when processing a favicon. Root cause details are limited in the provided documents beyond favic...

CVE-2024-0748

CVE-2024-0748 concerns Mozilla Firefox where a compromised content process could update the document URI, enabling an attacker to set an arbitrary URI in the address bar or history. The issue affects Firefox versions earlier than 122 and is addressed by Mozilla in MFSA2024-01, which notes fixes i...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2017-7799

CVE-2017-7799 - Firefox before 55 : A cross-site scripting risk exists due to JavaScript on the about:webrtc page being assigned to innerHTML without proper sanitization. The data on this page is supplied by WebRTC usage and not user-controlled, making exploitation possible under certain conditio...

CVE-2022-46883

CVE-2022-46883 : Mozilla Firefox contains memory-safety bugs in Firefox 106 that could allow arbitrary code execution. The fixes were included in Firefox 107, and the vulnerability affects Firefox versions earlier than 107 (no exploit details provided in the documents). Affected : Firefox

CVE-2023-29546

CVE-2023-29546 affects Firefox for Android (and Focus for Android) with

CVE-2023-3482

The CVE-2023-3482 issue affects Mozilla Firefox prior to version 115, where blocking all cookies does not prevent data exfiltration via localStorage using an iframe with src='about:blank'. This allows a malicious site to store tracking data in the local storage without permission, representing an...

CVE-2023-6873

CVE-2023-6873 is a memory-safety vulnerability reported in Mozilla Firefox affecting versions older than 121. The issue involves memory corruption in Firefox 120-era code paths that could potentially be exploited to execute arbitrary code. Connected advisories (e.g., MFSA2023-56) corroborate wide...

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...