CVE-2026-84123

CVE-2026-84123 identifies a privilege escalation vulnerability caused by a use-after-free flaw in the Graphics: WebGPU component. This issue affects Mozilla Firefox , Mozilla Thunderbird , and associated packages. Remediation is available in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and...

CVE-2016-9069

CVE-2016-9069 describes a use-after-free in Mozilla Firefox during DOM operations, specifically in nsINode::ReplaceOrInsertBefore, which could lead to exploitable crashes. Affected product: Mozilla Firefox (desktop) versions before 50. Root cause (as stated): heap-use-after-free in ReplaceOrInser...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

CVE-2017-7750

CVE-2017-7750 describes a use-after-free in video control operations when a element holds a reference to an older window that has been replaced in the DOM, leading to a potentially exploitable crash. Affected products and versions from the connected records include Mozilla Firefox < 54, Firef...

CVE-2017-7799

CVE-2017-7799 - Firefox before 55 : A cross-site scripting risk exists due to JavaScript on the about:webrtc page being assigned to innerHTML without proper sanitization. The data on this page is supplied by WebRTC usage and not user-controlled, making exploitation possible under certain conditio...

CVE-2018-12381

Concretely, CVE-2018-12381 affects Mozilla Firefox ESR < 60.2 and Firefox

CVE-2023-37203

CVE-2023-37203 concerns Mozilla Firefox. The issue is insufficient validation in the Drag and Drop API combined with social engineering, which could trick users into creating a shortcut to local system files and potentially execute arbitrary code. Affected software is Firefox earlier than 115. Im...

CVE-2025-8035

Mozilla Firefox and Thunderbird products are affected by CVE-2025-8035 , which involves multiple memory safety bugs . These vulnerabilities can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service (service failure) on a vulnerable syst...

CVE-2026-16384

CVE-2026-16384 is an information disclosure vulnerability caused by uninitialized memory within the Graphics: WebGPU component. The issue affects Firefox and Thunderbird , with a fix provided in version 153 of both products. No specific exploit details or in-the-wild exploitation have been docume...

CVE-2026-74947

A privilege escalation vulnerability exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird due to an invalid pointer . This flaw affects various versions, including Firefox prior to 154 and Thunderbird prior to 153.1. The issue has been remediated in Firefox 154, Firefox ESR...

CVE-2012-3988

CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...

CVE-2012-5830

CVE-2012-5830 is a use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X that allows remote attackers to execute arbitrary code via an HTML document. The con...

CVE-2012-5841

CVE-2012-5841 affects Mozilla Firefox (before 17.0), Firefox ESR (10.x before 10.0.11), Thunderbird (before 17.0), Thunderbird ESR (before 10.0.11) and SeaMonkey (before 2.14). The issue arises from cross-origin wrappers with a filtering behavior that fails to restrict write actions, enabling rem...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...

CVE-2014-1502

CVE-2014-1502 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The vulnerability arises in WebGL functions WebGL.compressedTexImage2D and WebGL.compressedTexSubImage2D, enabling remote attackers to bypass Same Origin Policy and render content from a different domain via unspecified ve...

CVE-2014-1525

CVE-2014-1525 affects Mozilla Firefox before 29.0 and SeaMonkey before 2.26, due to improper garbage collection in mozilla::dom::TextTrack::AddCue, enabling remote attackers to trigger a use-after-free and heap memory corruption via a crafted HTML5 Video element. Consequences include possible rem...

CVE-2016-5292

CVE-2016-5292 : In Firefox

CVE-2016-9073

CVE-2016-9073 : In Firefox, the WebExtensions API window.create schema did not specify format: 'relativeUrl', enabling a WebExtension to load privileged URLs and potentially escape the WebExtension sandbox. Affected: Firefox before 50.0. Impact is sandbox escape and elevation of privilege for ext...

CVE-2016-9894

CVE-2016-9894 : A buffer overflow in SkiaGL occurs when a GrGLBuffer is truncated during allocation, leading to overflow by later writers. Affects Mozilla Firefox <= 50.0.x (reported for Firefox

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2024-4765

This vulnerability affects Firefox for Android versions prior to 126 . The root cause is the use of an insecure MD5 hash to store web application manifests, which enables a hash collision attack. This allows an attacker to overwrite another application's manifest, potentially leading to the execu...

CVE-2026-12292

The Web Audio component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw affects the following versions: Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The vulnerability was addressed in the aforementioned releases. No specific e...

CVE-2026-2797

CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...

CVE-2026-74985

CVE-2026-74985 describes a privilege escalation vulnerability in the Enterprise Policies component of Mozilla products. The issue affects Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Remediation is available in the aforementioned versions. Exploitation details are n...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2014-1485

CVE-2014-1485 affects Mozilla Firefox (prior to 27.0) and SeaMonkey (prior to 2.24). The CSP implementation in these browsers evaluates style-src directives for XSLT processing rather than script-src, potentially allowing remote attackers to execute arbitrary XSLT code through insufficient style-...

CVE-2016-5294

CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox

CVE-2017-5374

CVE-2017-5374 corresponds to memory safety bugs in Firefox 50.1 that could lead to memory corruption and possibly arbitrary code execution. The vulnerability affects Firefox versions older than 51.0. Remediation in public advisories shows Firefox 51.0.1 and later as fixes for related memory-safet...

CVE-2017-7754

CVE-2017-7754 is an out-of-bounds read in WebGL when processing a malicious ImageInfo object during WebGL operations. Affected products/versions per connected docs: Firefox versions prior to 54 and Firefox ESR prior to 52.2, and Thunderbird prior to 52.2. The vulnerability stems from an improper ...

CVE-2018-12400

CVE-2018-12400 : In private browsing mode on Firefox for Android, favicons are cached in cache/icons like in non-private mode, allowing leakage of sites visited during private sessions. Affected: Firefox for Android versions before 63 (Desktop Firefox unaffected). Root cause: favicon caching beha...

CVE-2025-6425

The WebCompat extension in Mozilla Firefox and Mozilla Thunderbird is vulnerable to an information disclosure flaw. An attacker who enumerates resources from the extension can obtain a persistent UUID that identifies the browser. This UUID persists between containers and normal/private browsing m...

CVE-2025-6426

Mozilla Firefox on macOS fails to display an executable file warning before opening files with the terminal extension. This vulnerability allows attackers to potentially bypass security restrictions to compromise the confidentiality, integrity, and accessibility of protected information due to in...

CVE-2026-16412

Mozilla Firefox and Thunderbird are affected by CVE-2026-16412 , which involves memory safety bugs that may lead to memory corruption. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues are present in Firefox ESR 140.12 , Firefox 152 , and Thunderbi...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...

CVE-2026-6773

The Graphics: WebGPU component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to a Denial-of-service (DoS) attack caused by an integer overflow . This numerical overflow condition can be exploited remotely by an attacker to induce service interruptions. The vulnerability has been addres...

CVE-2026-74954

A side-channel vulnerability exists in the Storage: Cache API component of Firefox and Thunderbird . This flaw allows for information disclosure . The issue is addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific exploit details or in-the-wild explo...

CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of the Mozilla Firefox and Mozilla Thunderbird browsers. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and...

CVE-2012-1938

CVE-2012-1938 affects Mozilla's browser engine and is described in the MiracleLinux AXSA:2012-857 advisory as multiple vulnerabilities in Firefox (and related components) that could allow memory corruption and remote code execution. Specifically, it impacts Mozilla Firefox before 13.0, Thunderbir...

CVE-2013-0762

CVE-2013-0762 is a use-after-free in imgRequest::OnStopFrame affecting Mozilla Firefox prior to 18.0 (and ESR 10.x before 10.0.12, ESR 17.x before 17.0.1), Thunderbird prior to 17.0.2, and SeaMonkey prior to 2.15. It can allow remote code execution or a denial of service via heap memory corruptio...

CVE-2017-5414

CVE-2017-5414 affects Mozilla Firefox (and Thunderbird) prior to version 52. The file picker dialog can instantiate and display the wrong local default directory, potentially disclosing OS or local account name. Remediation from connected docs: upgrade to Firefox 52.0+ (and Thunderbird 52.0+ as a...

CVE-2017-7788

CVE-2017-7788 affects Firefox

CVE-2017-7808

CVE-2017-7808 affects Mozilla Firefox prior to 55.0. A CSP policy using a frame-ancestors directive with origins that include paths allows a cross-origin leak by comparing against the path instead of the origin. The vulnerability is described for Firefox

CVE-2018-5134

CVE-2018-5134 affects Mozilla Firefox versions older than 59.0. WebExtensions could use view-source: URLs to access local file: URLs and content in about:cache, bypassing content restrictions. This is described as a WebExtensions content-exposure issue. The numbered references indicate the adviso...

CVE-2025-4092

Memory safety bugs in Mozilla Firefox and Thunderbird (versions prior to 138 ) can lead to memory corruption . A remote attacker could potentially exploit these vulnerabilities to execute arbitrary code . This issue was addressed and fixed in Firefox 138 and Thunderbird 138 . No specific exploit ...

CVE-2025-6430

Mozilla Firefox , Firefox ESR , and Thunderbird are vulnerable to a cross-site scripting (XSS) attack due to the HTTP Header Handler component incorrectly ignoring the Content-Disposition header when a file is included via an embed or object tag. This flaw allows a remote attacker to perform ...

CVE-2026-16363

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . While the vulnerability is documented as having a CRITICAL sever...

CVE-2026-84134

This vulnerability affects the Profile Backup component in Mozilla Firefox and Mozilla Thunderbird . The root cause is described as an other issue within that specific component. Impact details are not explicitly provided in the documents, but the severity is rated as CRITICAL (CVSS 3.1 score of ...

CVE-2026-84138

A Denial-of-Service (DoS) vulnerability exists in the PDF Viewer component of Firefox and Thunderbird . The vulnerability has been addressed in Firefox 155 and Thunderbird 155 . While specific root cause details are not provided in the documents, the impact is a high availability loss as indicate...