CVE-2026-7320

CVE-2026-7320 involves an information disclosure in the Firefox Audio/Video component caused by incorrect boundary conditions. Affected products are Firefox desktop browser (and ESR branches). The vulnerability allows information disclosure with high confidentiality impact (per CVSS: AV:N/AC:L/PR...

CVE-2017-7844

CVE-2017-7844 【Firefox】 is caused by a combination of an external SVG image on a page and coloring of links within that image, enabling a malicious site to infer which pages a user has visited in history. Affected: Firefox 57; earlier releases are not affected. The issue is mitigated by upgrading...

CVE-2023-6213

CVE-2023-6213 refers to memory-safety bugs in Mozilla Firefox reported for Firefox 119 and earlier, with the impact described as potential arbitrary code execution on a vulnerable system. All connected sources indicate the affected product is Firefox and that the flaw exists in versions older tha...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2014-1526

Summary : CVE-2014-1526 affects Mozilla Firefox up to 29.0 (and SeaMonkey up to 2.26). The XrayWrapper implementation could be abused by a user via a crafted site visited in a debugger to bypass access restrictions, causing unwrapping operations and calls to DOM methods on unwrapped objects. This...

CVE-2016-9076

CVE-2016-9076 is a Firefox UI spoofing vulnerability where a dropdown can cover the address bar content when e10s is enabled. Affected: Firefox

CVE-2017-5427

The CVE-2017-5427 entry covers a Mozilla Firefox/Firefox ESR startup vulnerability where a non-existent chrome.manifest file loaded from the primary installation directory can be exploited by a local attacker who places chrome.manifest and referenced files there. If exploited, startup-loaded code...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2019-17018

CVE-2019-17018 affects Mozilla Firefox versions before 72 on Windows 10, where in Private Browsing Mode the Windows keyboard may retain word suggestions to improve keyboard accuracy. This is the asserted vulnerability detail; no additional remediation or exploit information is provided in the con...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2016-9075

CVE-2016-9075 : Firefox WebExtensions can misuse mozAddonManager API to elevate privileges because privileged pages are allowed in the permissions list, enabling a malicious extension to install additional extensions without explicit user permission. Affected: Firefox versions before 50. Root cau...

CVE-2021-29971

CVE-2021-29971 is a Mozilla Firefox vulnerability affecting Firefox for Android. The issue arises when a user grants a webpage permission and saves it; any webpage on the same host (regardless of scheme or port) could gain that permission. The advisory details that this affects Firefox versions o...

CVE-2016-5293

CVE-2016-5293 describes a local vulnerability in the Mozilla Updater on Windows: when the Updater log file in the working directory points to a hardlink, an attacker with local access can cause data to be appended to an arbitrary local file. Affected products include Firefox ESR older than 45.5 a...

CVE-2016-5295

CVE-2016-5295 is a Windows-only privilege-escalation in Mozilla Maintenance Service that can let an attacker run malicious local files via the Mozilla Updater. Affected: Firefox before 50 on Windows. Impact: SYSTEM-level privilege elevation (confidentiality/integrity/availability at risk) as desc...

CVE-2017-5420

CVE-2017-5420 affects Mozilla Firefox prior to version 52.0 (and Firefox ESR up to 45.x); a javascript: URL loaded by a malicious page can obfuscate the address bar, enabling spoofing of an existing page while the malicious page’s address is not shown. The issue is documented as a content spoofin...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2023-37206

CVE-2023-37206 affects Mozilla Firefox: uploading files that contain symlinks could trick users into submitting data to a malicious site. The issue targets Firefox versions earlier than 115 and stems from insufficient validation of symbolic links in the file-system API. Public advisories and vend...

CVE-2026-2447

CVE-2026-2447 describes a heap buffer overflow in libvpx that affects components used by Firefox and Thunderbird. The Initial Description notes fixes in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Connected documents corroborate the sa...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2023-37203

CVE-2023-37203 concerns Mozilla Firefox. The issue is insufficient validation in the Drag and Drop API combined with social engineering, which could trick users into creating a shortcut to local system files and potentially execute arbitrary code. Affected software is Firefox earlier than 115. Im...

CVE-2024-4766

Firefox for Android is affected by CVE-2024-4766, which describes techniques used to obscure the fullscreen notification, potentially leading to user confusion and spoofing. The issue affects Firefox

CVE-2014-1511

CVE-2014-1511 affects Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25. The issue is described as a remote bypass of the popup blocker via unspecified vectors. Public security advisories in 2014 consolidate Firefox/Thunderbird/SeaMonkey...

CVE-2016-5287

CVE-2016-5287 affects Mozilla Firefox up to 49.0.2. The issue is a use-after-free crash during actor destruction with service workers, caused by a fault in nsTArray_base::SwapArrayElements. The vulnerability leads to a potentially exploitable crash (no exploit details provided in the supplied doc...

CVE-2017-7756

CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7806

CVE-2017-7806 is a use-after-free vulnerability in Firefox

CVE-2017-7811

CVE-2017-7811 : Firefox 55 contains memory safety bugs that could allow memory corruption and potentially arbitrary code execution; affected products are Firefox versions older than 56. Remediation: upgrade to Firefox 56 or later (as referenced in mfsa2017-21). The connected Nessus entries also r...

CVE-2018-5138

CVE-2018-5138 is a domain-spoofing vulnerability limited to Firefox for Android before version 59 when opened through an Android Custom Tab with an extremely long domain name. The issue could allow an attacker to spoof which page is loaded, due to how the browser panel (Custom Tab) advertises the...

CVE-2019-17019

The CVE-2019-17019 entry concerns Mozilla Firefox on Windows prior to version 72, where serving a Python-encoded text/plain file could cause Python to execute the file instead of opening it as text. The issue is Windows-only and relates to how Python interaction with downloaded content could lead...

CVE-2021-29968

The CVE-2021-29968 vulnerability affects Mozilla Firefox on Windows (Firefox

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2014-1522

Technical details for CVE-2014-1522 are not publicly provided in the connected documents. No specifics on affected products, versions, root cause, impact, or fixes are available; monitor for updates.

CVE-2017-5395

CVE-2017-5395 affects Firefox for Android and describes a location-bar spoofing issue: malicious sites can cause a spoofed address bar on a subsequent page if navigations between pages are timed so the prior page’s bar scrolls out of view. The vulnerability exists in Firefox

CVE-2023-6866

Summary: CVE-2023-6866 affects Mozilla Firefox prior to version 121. The issue arises from how TypedArrays can be fallible due to insufficient exception handling, which can enable abuse in other APIs that rely on TypedArrays to succeed. Technical details found in connected documents: Firefox

CVE-2024-4765

CVE-2024-4765 affects Mozilla Firefox for Android. The issue arises from storing web application manifests using an insecure MD5 hash, which enables a hash collision to overwrite another application's manifest and could allow code execution within another app’s context. The vulnerability is limit...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2017-5415

CVE-2017-5415 is a blob URL address-bar spoofing vulnerability in Mozilla Firefox (affecting Firefox < 52). The issue enables spoofing the address bar through a blob: URL, potentially confusing users and enabling follow-on spoofing. IBM SONAS bulletin confirms CVE-2017-5415 alongside other Fir...

CVE-2021-29973

Firefox for Android was vulnerable to password autofill being triggered on insecure websites without user interaction. The issue, affecting Firefox versions earlier than 90, was fixed by requiring user interaction before autofill occurs; the mitigation is upgrading to Firefox 90 or newer. The vul...

CVE-2017-5468

The CVE-2017-5468 issue affects Mozilla Firefox before version 53, related to an incorrect ownership model of privateBrowsing information exposed via developer tools. The underlying problem is in how privateBrowsing ownership is tracked in the developer tools, which can trigger a non-exploitable ...

CVE-2018-18496

CVE-2018-18496 is a clickjacking vulnerability in Mozilla Firefox’s feed preview page about:feeds. When the RSS Feed preview is framed in another page, scripted content can coerce a user into downloading and executing an executable from a temporary directory. It affects Firefox versions earlier t...

CVE-2025-8032

CVE-2025-8032 involves an XSLT loading flaw where the source document was not propagated, allowing a CSP bypass in Mozilla components. Affected products/versions (per provided sources): Firefox and Thunderbird lines including Firefox < 141, Firefox ESR < 128.13 and < 140.1, Thunderbird &...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...