CVE-2025-8034

CVE-2025-8034 involves memory safety bugs in Mozilla Firefox/Thunderbird across multiple releases (Firefox ESR 115.25, 128.12; Firefox/Thunderbird 140.x; ESR 115.26, 128.13, 140.1). Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected products list i...

CVE-2026-16349

CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...

CVE-2026-6772

CVE-2026-6772 affects the NSS Libraries component, specifically an incorrect boundary condition in NSS Libraries. The vulnerability is exploitable via network access with no user interaction and no privileges required, with a CVSS v3.1 base score of 7.5 (High). Affected products/contexts include ...

CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2025-3033

CVE-2025-3033 affects Firefox on Windows (Thunderbird also affected per the entry), with exploitation involving selecting a malicious Windows .url shortcut from the local file system to upload an unexpected file. Affected versions are Firefox < 137 and Thunderbird

CVE-2025-3034

CVE-2025-3034 corresponds to memory-safety bugs in Firefox 136 and Thunderbird 136. Some flaws show memory corruption and could be exploitable with enough effort to run arbitrary code. Affected products are Firefox < 137 and Thunderbird

CVE-2025-6427

CVE-2025-6427 affects Firefox and Thunderbird prior to version 140. The issue is a bypass of the CSP connect-src directive via manipulation of subdocuments, which could also conceal network connections from DevTools Network tab. Affected products: Firefox < 140 and Thunderbird

CVE-2026-6767

CVE-2026-6767 is a vulnerability in the NSS Libraries component described as “Other issue in the Libraries component in NSS.” It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 5.3 (attack vector: network, attac...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...

CVE-2016-9062

CVE-2016-9062 affects Firefox for Android. Private browsing mode leaves metadata (URLs) in browser.db and browser.db-wal within the Firefox profile after exit. Impact is limited to Firefox versions earlier than 50 on Android; other platforms are unaffected. The remediation is to update to Firefox...

CVE-2025-8035

CVE-2025-8035 affects Mozilla Firefox and Thunderbird desktop clients (Firefox/Firefox ESR and Thunderbird up to versions around 140.x/141.x). The connected sources describe memory-safety bugs in Firefox ESR 128.12, 140.0, and Firefox/Thunderbird 140, plus similar issues in Thunderbird ESR lines,...

CVE-2026-6749

CVE-2026-6749 is an information disclosure vulnerability in the Graphics: Canvas2D component, caused by uninitialized memory. It affects Firefox and Thunderbird products; Mozilla advisories state fixes in Firefox 150, Firefox ESR 115.35 and 140.10, and Thunderbird 150 and 140.10. Amazon Linux 2 a...

CVE-2026-8091

CVE-2026-8091 affects Mozilla Audio/Video: Playback with an incorrect boundary condition in the component. It is fixed by updating to Firefox 150, Thunderbird 150, and Firefox ESR 140.10.1 (and 140.10.2 per ESR updates) as well as Firefox ESR 115.35.2. Connected disclosures corroborate this is a ...

CVE-2016-9061

CVE-2016-9061 affects Firefox for Android, where a previously installed malicious Android app can exploit a signature-level permission to access API keys meant for Firefox. The issue is limited to Firefox for Android; other platforms are unaffected and Firefox versions prior to 50 are affected. T...

CVE-2024-31393

This CVE (CVE-2024-31393) affects Mozilla Firefox for iOS prior to version 124. The issue stems from insufficient input validation when dragging Javascript URLs into the address bar, which could cause the URL to load and bypass certain security protections. Affected component is the address bar h...

CVE-2025-1939

CVE-2025-1939 is an Android/Firefox-related issue where the Custom Tabs transition animation could be leveraged to mislead users into granting sensitive permissions by obscuring what they click. The vulnerability explicitly affects Mozilla Firefox versions older than 136.0. Impact concerns includ...

CVE-2025-9180

CVE-2025-9180 describes a same-origin policy bypass in the Graphics: Canvas2D component affecting Firefox and Thunderbird. Affected versions include Firefox and Thunderbird before 142, and ESR channels before 115.27, 128.14, or 140.2. Several connected advisories confirm the same issue and provid...

CVE-2026-6785

CVE-2026-6785 affects memory-safety bugs in Mozilla Firefox/Thunderbird components across Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The issues potentially allow memory corruption and could enable arbitrary code execution; Mozilla fixed these bugs in F...

CVE-2009-2466

The CVE-2009-2466 issue affects Mozilla Firefox (and Thunderbird) up to version prior to 3.0.12, where the JavaScript engine can be abused to cause memory corruption, a crash, or potentially arbitrary code execution. The described vectors involve the engine internals in nsDOMClassInfo.cpp, JS_Has...

CVE-2017-7762

Summary: CVE-2017-7762 is a vulnerability in Firefox where, when entering a URL directly, Reader Mode did not strip the username and password portion of the address bar, enabling domain spoofing. The issue affects Firefox versions earlier than 54. The available connected documents confirm the roo...

CVE-2018-18510

The CVE-2018-18510 entry affects Mozilla Firefox prior to version 64. The issue arises when web content can trigger the internal about:crashcontent and about:crashparent pages, enabling a non-persistent denial-of-service (DoS) against the loaded page or the browser. Affected component: Firefox re...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2003-1492

CVE-2003-1492 affects Netscape Navigator 7.0.2 and Mozilla, where an HTTP request to a domain with a trailing dot can cause cross-domain cookie access. The connected ROSA advisory lists this CVE as Fixed and notes remediation as updating Firefox (DNF command reference: sudo dnf update firefox). T...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2024-10941

CVE-2024-10941 affects Firefox versions prior to 126. The issue is triggered by a malicious website embedding an iframe with a malformed URI, resulting in a browser crash that is described as non-exploitable. Public details consistently reference Firefox

CVE-2025-1942

The CVE-2025-1942 vulnerability affects Mozilla Firefox (<136) and Mozilla Thunderbird (

CVE-2025-6434

CVE-2025-6434 corresponds to the HTTPS-Only exception page lacking an anti-clickjacking delay, enabling potential user trickery to grant an exception and load an HTTP page. Public sources in the provided documents indicate affected products are Mozilla Firefox and Mozilla Thunderbird, specificall...

CVE-2025-8029

CVE-2025-8029: Thunderbird and Firefox products are affected by a vulnerability where javascript: URLs are executed when used inside object and embed tags. The impact list states affected versions include Firefox < 141 and Thunderbird < 141 (and ESR branches

CVE-2025-8033

The CVE-2025-8033 issue is a memory-safety bug in Mozilla’s JavaScript engine where closing generators could be resumed, causing a null pointer dereference. Affected products include Firefox and Thunderbird forks across multiple release lines (Firefox < 141, ESR tracks <115.26, <128.13, ...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2019-25136

CVE-2019-25136 describes a vulnerability in Mozilla Firefox where a compromised child process could inject XBL Bindings into privileged CSS rules, allowing arbitrary code execution and a sandbox escape. Affected software is Firefox versions before 70; the root cause is manipulation of XBL binding...

CVE-2025-1940

The CVE-2025-1940 issue concerns Mozilla Firefox for Android, where a select option could partially obscure the confirmation prompt shown before launching external apps. Root cause: UI/UX could mislead users into unknowingly launching an external app. Affected: Firefox on Android, versions earlie...

CVE-2025-4082

CVE-2025-4082 affects Thunderbird for macOS. It describes memory corruption in WebGL shader attributes that can trigger an out-of-bounds read, with potential for privilege escalation when combined with other issues. The vulnerability applies to Thunderbird versions before 138 and 128.10 (and to F...

CVE-2025-4084

CVE-2025-4084 concerns Firefox products. The issue arises from insufficient escaping of special characters in the copy as cURL feature, which could mislead users into running a crafted command and potentially enable local code execution on Windows. Affected software includes Firefox for Windows, ...

CVE-2026-6786

CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...

CVE-2009-2472

Affected software: Mozilla Firefox before 3.0.12 (as per CVE-2009-2472). Issue: during object construction, Firefox did not always use XPCCrossOriginWrapper, allowing bypass of the Same Origin Policy and enabling cross-site scripting (XSS) via a crafted document. Impact: potential XSS vulnerabili...

CVE-2013-5610

CVE-2013-5610 is a memory-corruption vulnerability in the Mozilla Firefox browser engine (pre-26.0) and SeaMonkey (pre-2.23) with potential remote code execution via unknown vectors and denial of service. Public advisories (e.g., openSUSE/MFSA entries) indicate fixes are available by upgrading Fi...

CVE-2019-11702

Summary of the vulnerability (CVE-2019-11702) : Mozilla Firefox versions prior to 67.0.2 on Windows are affected. A hyperlink using protocols associated with Internet Explorer (e.g., IE.HTTP:) can be used to open local files at a known location in Firefox if the user approves execution when promp...

CVE-2021-29953

Mode C: Affected software is Mozilla Firefox and Firefox for Android prior to 88.0.1/88.1.3. The root cause is insecure handling of multiple prompts involving javascript: URLs that can force attacker-controlled JavaScript to run in the context of another domain, yielding a Universal Cross‑Site Sc...

CVE-2021-43532

Summary: CVE-2021-43532 affects Firefox prior to 94 and relates to the Copy Image Link context menu. The bug allowed copying the final image URL after redirects, enabling token theft if a user pasted the URL back into a page and the URL leaked authentication tokens. The underlying issue involved ...

CVE-2025-6429

CVE-2025-6429 is active in Firefox/Thunderbird . The issue arises from an incorrect URL parse in an embed tag, which could rewrite a URL to youtube.com and bypass domain-embedding security checks. Affected products include Firefox and Thunderbird; versions affected are Firefox < 140 and Firefo...