CVE-2011-0064

The CVE-2011-0064 issue affects HarfBuzz’s hb_buffer_ensure() as used by Pango (notably in Pango 1.28.3) and other products, where memory reallocations are not verified, potentially causing a NULL pointer dereference leading to a crash or, via crafted OpenType data triggering an incorrect index, ...

CVE-2013-0772

CVE-2013-0772 is a memory-safety issue in Mozilla's image rendering: RasterImage::DrawFrameTo allows out-of-bounds reads in crafted GIFs, enabling possible information disclosure or denial of service. Affected products and versions per connected docs: Mozilla Firefox up to version 19.0 (prior to ...

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2017-5381

CVE-2017-5381 affects Firefox

CVE-2017-5403

CVE-2017-5403 affects Mozilla Firefox and Thunderbird prior to version 52.0 (Firefox <52, Thunderbird

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2018-5160

CVE-2018-5160 affects Firefox

CVE-2022-46883

CVE-2022-46883 : Mozilla Firefox contains memory-safety bugs in Firefox 106 that could allow arbitrary code execution. The fixes were included in Firefox 107, and the vulnerability affects Firefox versions earlier than 107 (no exploit details provided in the documents). Affected : Firefox

CVE-2025-6436

Mozilla Firefox and Thunderbird versions prior to 140 are affected by memory safety bugs that can cause memory corruption . A remote attacker could potentially exploit these flaws to achieve arbitrary code execution . These vulnerabilities have been addressed in Firefox 140 and Thunderbird 140 . ...

CVE-2026-12293

CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...

CVE-2026-16381

A Same-origin policy bypass exists in the Networking: DNS component of the Firefox and Thunderbird web browser and mail client. This vulnerability was resolved in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Exploitation details are not provided in the documents, ...

CVE-2026-84119

Mozilla Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by a use-after-free in the DOM: Navigation component . This security issue can lead to the execution of arbitrary code or privilege escalation. Remediation includes updating to Firefox 155 , Firefox ESR 115.40 ,...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2012-4201

CVE-2012-4201 is a concrete Firefox/XULRunner/Thunderbird/SeaMonkey vulnerability: the evalInSandbox path mishandles the context when processing JavaScript that sets location.href, enabling remote XSS or read access to arbitrary files via a sandboxed add-on. Affected software includes Mozilla Fir...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2018-5128

CVE-2018-5128 is a use-after-free vulnerability in Firefox that can occur when manipulating elements, events, and selection ranges during editor operations, leading to a potentially exploitable crash. Affected products include Firefox versions older than 59 across platforms (Windows, macOS, Linux...

CVE-2018-5133

CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...

CVE-2018-5140

CVE-2018-5140 involves a disclosure in Mozilla Firefox prior to 59 where the moz-icon: protocol used by moz-icons can be accessed by web content, allowing a malicious page to leak information about which MIME types are associated with which applications. Affected product: Firefox and Firefox ESR ...

CVE-2019-9802

Firefox up to version 66.0 is vulnerable (CVE-2019-9802). If a Sandbox content process is compromised, it can trigger an FTP download, have a child process render the data, and pass it to the Chrome process with an attacker-controlled length, bypassing sandbox protections and potentially reading ...

CVE-2019-9814

CVE-2019-9814 affects Mozilla Firefox before version 67.0. The issue comprises memory safety bugs that could allow memory corruption and, with enough effort, potentially arbitrary code execution. The vulnerability is documented as memory safety bugs in Firefox 66 that are fixed in Firefox 67.0. I...

CVE-2021-29944

CVE-2021-29944 details: Lack of escaping allowed HTML injection when a webpage was viewed in Reader View in Firefox for Android. HTML injection is possible despite a Content Security Policy preventing direct code execution. Affected product/versions: Firefox before 88 on Android. Other operating ...

CVE-2025-14321

The CVE-2025-14321 entry documents a Use-after-free in the WebRTC: Signaling component affecting Firefox before 146 and Firefox ESR before 140.6, and Thunderbird before 146/140.6. Public advisories (ALAS and Debian S/DLA notes) indicate memory-safety/allocations issues are part of the Firefox/Thu...

CVE-2025-8027

On 64-bit platforms, CVE-2025-8027 is caused by a discrepancy where IonMonkey-JIT only writes 32 bits of the 64-bit return value space onto the stack, while Baseline-JIT reads the full 64 bits. This unvalidated return value vulnerability can allow attackers to compromise the confidentiality, inte...

CVE-2025-8034

Mozilla Firefox and Thunderbird are affected by memory safety bugs that may lead to memory corruption. If successfully exploited, an attacker could execute arbitrary code or cause a denial of service (service failure) on the vulnerable system. Affected Versions include Firefox < 141, Firefox E...

CVE-2026-6754

A Use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox and the Thunderbird email client. This flaw allows an attacker to compromise the accessibility of protected information . The vulnerability has been addressed in Firefox 150 , Firefox ESR 115.35 , Firefox ...

CVE-2026-92005

A Use-after-free vulnerability exists in the Audio/Video: Web Codecs component of Mozilla Firefox and Thunderbird . This flaw was addressed in Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . Exploitation details are not provide...

CVE-2012-3959

CVE-2012-3959 describes a use-after-free in Mozilla Firefox’s nsRangeUpdater::SelAdjDeleteNode, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The vulnerability allows remote attackers to execu...

CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2016-9068

CVE-2016-9068 is a heap-use-after-free in nsRefreshDriver during web animations when using timelines, affecting Firefox versions earlier than 50. The vulnerability leads to a potentially exploitable crash. Several connected advisories (e.g., openSUSE-1334, Ubuntu USN-3124-1 blocks) explicitly nam...

CVE-2016-9896

CVE-2016-9896 is a use-after-free in WebVR affecting Mozilla Firefox versions before 50.1, specifically when manipulating the navigator object. The impact is denial of memory safety, with potential arbitrary code execution and memory corruption as described in the vulnerability notes. Firefox 50....

CVE-2017-5384

CVE-2017-5384 : Information disclosure via Proxy Auto-Config (PAC) in Firefox

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2017-7780

CVE-2017-7780 refers to memory safety bugs in Mozilla Firefox 54 that could be exploited to run arbitrary code. The advisory notes memory corruption and that Firefox versions before 55 are affected (i.e., Firefox 54 and ESR 52.2). The connected Nessus/NVD records enumerate additional related CVEs...

CVE-2017-7783

CVE-2017-7783 describes a denial-of-service vulnerability in Mozilla Firefox affecting versions earlier than 55. The issue occurs when a long username is used in a username:password@URL (for example http://UserName:[email protected]); the browser’s modal prompt can hang or crash, leading to a ...

CVE-2018-5135

CVE-2018-5135 affects Mozilla Firefox versions earlier than 59.0. The issue allows WebExtensions to bypass normal restrictions and use browser.tabs.executeScript to inject scripts into contexts where injection should not be allowed (e.g., other WebExtensions or unprivileged about: pages). This is...

CVE-2022-46885

CVE-2022-46885: Memory-safety bugs in Mozilla Firefox 105 allow the potential execution of arbitrary code in Firefox versions before 106. The affected product is Mozilla Firefox; root cause is memory corruption. The connected documents confirm the vulnerability but do not provide an explicit reme...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2026-74952

CVE-2026-74952 is a privilege escalation vulnerability affecting the Application Update component of Mozilla Thunderbird ESR and Mozilla Firefox . The flaw allows attackers to bypass security restrictions. Remediation is available in Thunderbird 153.2 , Firefox 154 , Firefox ESR 153.2 , and Thund...

CVE-2026-92018

A sandbox escape vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird . This flaw allows an attacker to bypass the sandbox environment, potentially leading to a significant impact on the host system. Affected versions include Firefox 156 , Firefox ESR 115.41 ,...

CVE-2016-7152

CVE-2016-7152 is described in IBM Security Bulletin as a HEIST-related vulnerability affecting the Firefox component of the IBM Synthetic Playback agent used with IBM Application Performance Management (APM) 8.1.3 and IBM Cloud Application Performance Management. The root cause is that the HTTPS ...

CVE-2017-5387

CVE-2017-5387 affects Mozilla Firefox (pre-51). Root cause: local-file existence can be inferred via double firing of onerror when a TRACK tag references a non-existent source loaded locally. Impact: disclosure of local file existence; no explicit exploitation details provided in the sources. Aff...

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2023-3482

The CVE-2023-3482 issue affects Mozilla Firefox prior to version 115, where blocking all cookies does not prevent data exfiltration via localStorage using an iframe with src='about:blank'. This allows a malicious site to store tracking data in the local storage without permission, representing an...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2014-1483

Technical details for CVE-2014-1483 are not publicly provided in the connected documents; sources reference the CVE but do not disclose affected products, versions, root cause, impact, or fixes. Monitor for updates.

CVE-2017-5413

CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...

CVE-2018-5143

CVE-2018-5143 is reported against Mozilla Firefox versions before 59.0. The issue arises when a javascript: URL containing a tab character bypasses protocol removal in the address bar, enabling an XSS-style impact where a user could be socially engineered to execute a script in their own browser....

CVE-2019-11700

Mozilla Firefox before version 67 is affected by CVE-2019-11700 due to improper handling of the res: protocol. A hyperlink using res: could cause local-file access at a known location in Internet Explorer when a user approves execution, with the issue confined to Windows. The vulnerability is roo...

CVE-2023-25740

CVE-2023-25740 affects Firefox for Windows (pre-110). After downloading a Windows .scf script from the local filesystem, an attacker could specify a remote path that triggers unexpected network requests by the OS and may leak NTLM credentials. Impact is limited to Firefox on Windows; other OSes a...