CVE-2026-84143

CVE-2026-84143 covers internally found bugs in Thunderbird 154 , Thunderbird ESR 153.1 , and Thunderbird ESR 140.14 , some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with enough effort, but no confirmed in-the-wild exp...

CVE-2026-92036

The Networking: HTTP component in Mozilla Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This security flaw has been addressed in Firefox 156 and Thunderbird 156 . While the vulnerability has been reported in the wild as of September 17, 2026, specific exploitation detai...

CVE-2012-3995

CVE-2012-3995 affects Mozilla Firefox and related Mozilla applications. The vulnerability arises from the IsCSSWordSpacingSpace function in Firefox (and Firefox ESR 10.x, Thunderbird, SeaMonkey as listed) where an out-of-bounds read could be exploited to run arbitrary code or trigger a denial-of-...

CVE-2013-0774

CVE-2013-0774 affects Mozilla Firefox

CVE-2014-1480

Technical details about CVE-2014-1480 are not publicly provided in the connected documents. The available description notes a clickjacking/ unintended file launch issue in Firefox/SeaMonkey, but specifics (affected versions, root cause, exploitability, and fixes) are not included.

CVE-2014-1526

Summary : CVE-2014-1526 affects Mozilla Firefox up to 29.0 (and SeaMonkey up to 2.26). The XrayWrapper implementation could be abused by a user via a crafted site visited in a debugger to bypass access restrictions, causing unwrapping operations and calls to DOM methods on unwrapped objects. This...

CVE-2016-9070

CVE-2016-9070 concerns Firefox prior to 50 where a page loaded into the browser sidebar via a bookmark can reference a privileged chrome window, enabling limited JavaScript that bypasses cross-origin protections. Public details across multiple OSS/distribution advisories (e.g., Ubuntu USN-3124-1,...

CVE-2016-9072

CVE-2016-9072 - Firefox 64-bit NPAPI sandbox not enabled by default Affecting: Mozilla Firefox on 64-bit Windows (Firefox versions older than 50). Root cause: when a new profile is created on 64-bit Windows, the sandbox for 64-bit NPAPI plugins is not enabled by default, leaving the plugin sandbo...

CVE-2017-5391

The CVE-2017-5391 entry affects Firefox < 51, where content-injection in about: pages can cause privileged about: pages to load in an iframe, potentially leading to privilege escalation. The issue is described in Mozilla mfsa2017-01 and is referenced in multiple advisories (e.g., openSUSE open...

CVE-2017-5393

CVE-2017-5393: The mozAddonManager allows installation of extensions from addons.mozilla.org CDN. In combination with an XSS on Mozilla AMO sites, a malicious extension could install additional extensions. Affected product: Firefox

CVE-2017-5394

CVE-2017-5394 describes a location bar spoofing vulnerability affecting Firefox for Android, where a loaded page’s location bar could be shown over content from another tab due to a sequence of JavaScript events combined with fullscreen mode. It explicitly states that the issue affects Firefox ve...

CVE-2023-37206

CVE-2023-37206 affects Mozilla Firefox: uploading files that contain symlinks could trick users into submitting data to a malicious site. The issue targets Firefox versions earlier than 115 and stems from insufficient validation of symbolic links in the file-system API. Public advisories and vend...

CVE-2025-6427

A security bypass vulnerability exists in Mozilla Firefox and Thunderbird (versions prior to 140 ) due to a flaw in the Content Security Policy mechanism. An attacker can bypass the connect-src directive by manipulating subdocuments , allowing them to circumvent security restrictions and gain una...

CVE-2025-8033

The JavaScript engine in Mozilla Firefox and Thunderbird contains a vulnerability where it fails to correctly handle closed generators. This flaw allows an attacker to resume these generators, leading to a nullptr dereference . Affected versions include Firefox < 141, Firefox ESR < 115.26, ...

CVE-2025-9180

A Same-origin policy bypass vulnerability exists in the Graphics: Canvas2D component of Firefox and Thunderbird . This flaw allows for a bypass of security boundaries, leading to potential cross-origin data access. The vulnerability has been addressed in Firefox 142 , Firefox ESR 115.27 , Firefox...

CVE-2026-12315

A mitigation bypass exists in the DOM: Security component of the Firefox and Thunderbird applications. This vulnerability was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not provided in the available documentation. For Amazon...

CVE-2026-6771

The DOM: Security component in Mozilla Firefox , Firefox ESR , and Thunderbird contains a mitigation bypass vulnerability. A malicious actor could exploit this flaw to circumvent existing security restrictions remotely. The issue has been addressed in Firefox 150 , Firefox ESR 140.10 , Thunderbir...

CVE-2026-84137

CVE-2026-84137 involves a spoofing issue within the DOM: Core & HTML component . This vulnerability affects Mozilla Firefox and Mozilla Thunderbird . The issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or remote e...

CVE-2026-92048

A sandbox escape vulnerability exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions. This issue affects multiple versions of the browser and its email client. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , a...

CVE-2014-1504

CVE-2014-1504 affects Mozilla Firefox (pre-28.0) and SeaMonkey (pre-2.25). The session-restore feature does not honor the CSP of data: URLs, enabling remote XSS via a crafted document opened after a browser restart. The impact stated is cross-site scripting with partial integrity/complete confide...

CVE-2016-5288

CVE-2016-5288 concerns Mozilla Firefox versions prior to 49.0.2 where, when e10s is disabled, web content could read information from the HTTP cache (visited URLs and page contents). Affected products: Firefox 48 and 49 (Windows, macOS, Linux). Root cause details are not deeply described in the p...

CVE-2017-5379

CVE-2017-5379 is a use-after-free vulnerability in Web Animations when interacting with cycle collection, affecting Mozilla Firefox versions earlier than 51. It stems from memory safety issues in the Web Animations code path and is associated with the Firefox

CVE-2017-5385

CVE-2017-5385 affects Mozilla Firefox prior to 51.0.1. The issue arises when data is sent over multipart channels (notably multipart/x-mixed-replace); the Referrer-Policy header is ignored, potentially enabling information disclosure. Public advisories (mfsa2017-01) and multiple vendor notes conf...

CVE-2017-5412

CVE-2017-5412 is a buffer overflow read in SVG filter color value processing that results in data exposure. Affected products are Firefox and Thunderbird versions older than 52. The root cause is a memory safety/overflow issue in SVG filter handling. Remediation is to update to Firefox 52.0+ and ...

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2019-17018

CVE-2019-17018 affects Mozilla Firefox versions before 72 on Windows 10, where in Private Browsing Mode the Windows keyboard may retain word suggestions to improve keyboard accuracy. This is the asserted vulnerability detail; no additional remediation or exploit information is provided in the con...

CVE-2023-6866

Summary: CVE-2023-6866 affects Mozilla Firefox prior to version 121. The issue arises from how TypedArrays can be fallible due to insufficient exception handling, which can enable abuse in other APIs that rely on TypedArrays to succeed. Technical details found in connected documents: Firefox

CVE-2026-6784

Mozilla Firefox and Thunderbird versions 149 and earlier are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed and fixed in Firefox 150 and Thunderbird 150 . Evidenc...

CVE-2026-7324

Mozilla Firefox (version 150.0.0) and Thunderbird (version 150.0.0) are affected by memory safety bugs that result in memory corruption. These flaws could potentially be exploited to achieve arbitrary code execution . The issue was addressed in the release of Firefox 150.0.1 and Thunderbird 150.0...

CVE-2026-74983

A mitigation bypass exists in the Data Loss Prevention component of Mozilla Firefox and Thunderbird . This vulnerability is present in versions prior to Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . The impact is characterize...

CVE-2026-8092

Memory safety bugs exist in Mozilla Firefox (versions ESR 115.35.1, ESR 140.10.1, and 150.0.1) and Thunderbird (versions 140.10.1 and 150.0.1). These vulnerabilities involve memory corruption and could potentially be exploited by an attacker to execute arbitrary code . The issues were addressed i...

CVE-2012-3989

CVE-2012-3989 affects Mozilla Firefox (and related Mozilla products) prior to version 16.0, Thunderbird prior to 16.0, and SeaMonkey prior to 2.13. The vulnerability is a crash caused by an invalid cast when using the instanceof operator on certain JavaScript objects, which could allow remote att...

CVE-2017-7782

CVE-2017-7782 affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2017-7794

CVE-2017-7794 concerns Linux-specific vulnerability in Firefox where a compromised content process allows the sandbox broker to truncate files despite read-only permissions. Affects Firefox versions earlier than 55 on Linux; other OSes are not affected. Root cause and impact are described as a br...

CVE-2017-7844

CVE-2017-7844 【Firefox】 is caused by a combination of an external SVG image on a page and coloring of links within that image, enabling a malicious site to infer which pages a user has visited in history. Affected: Firefox 57; earlier releases are not affected. The issue is mitigated by upgrading...

CVE-2019-17019

The CVE-2019-17019 entry concerns Mozilla Firefox on Windows prior to version 72, where serving a Python-encoded text/plain file could cause Python to execute the file instead of opening it as text. The issue is Windows-only and relates to how Python interaction with downloaded content could lead...

CVE-2020-15647

The CVE-2020-15647 issue affects Mozilla Firefox for Android prior to 68.10.1. Root cause: a Content Provider in Firefox for Android allowed local files accessible by the browser to be read by remote web pages, enabling disclosure of sensitive data including cookies for other origins. Impact: sen...

CVE-2025-1943

Mozilla Firefox and Thunderbird (versions prior to 136 ) are affected by memory safety bugs involving memory corruption . A buffer overflow in dynamic memory could allow a remote attacker to execute arbitrary code . Remediation is available in Firefox 136 and Thunderbird 136 . Exploitation detail...

CVE-2025-8037

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability where setting a nameless cookie with an equals sign in its value can shadow other cookies. This occurs even if the nameless cookie is transmitted over HTTP and the targeted shadowed cookie includes the Secure attribut...

CVE-2026-12311

A vulnerability in the Security: Process Sandboxing component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure and a sandbox escape . This issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . No specific exploit deta...

CVE-2026-6751

The Audio/Video: Web Codecs component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client is vulnerable to uninitialized memory . This flaw could allow a remote attacker to induce service interruptions . The vulnerability has been addressed in Firefox 150 , Firefox ESR 140.10 , Th...

CVE-2026-74958

CVE-2026-74958 is an information disclosure vulnerability affecting the WebRTC component in Mozilla products. The vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific technical root cause or exploit details are provided in the...

CVE-2026-74960

A site isolation issue exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This vulnerability has been addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . No specific details regardin...

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2017-5417

CVE-2017-5417 describes an address-bar spoofing vulnerability in Mozilla Firefox (affecting versions before 52). By dragging content from the browser pane to a malicious site’s address bar, the navigation URL could display differently from the loaded page URL, enabling spoofing. The issue is tied...

CVE-2025-4082

CVE-2025-4082 involves a memory corruption vulnerability in the WebGL Shader Attribute Handler component of Mozilla Firefox , Mozilla Firefox ESR , and the Mozilla Thunderbird email client. Modification of specific WebGL shader attributes can trigger an out-of-bounds read , which, when chained wi...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2026-74964

An integer overflow vulnerability exists in the Graphics component of the Mozilla Firefox and Mozilla Thunderbird applications. This flaw was addressed in the release of Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While spe...

CVE-2026-84141

CVE-2026-84141 is an integer overflow in the Graphics: ImageLib component of Mozilla's image processing library, enabling remote code execution via crafted image content. The vulnerability affects Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (bef...

CVE-2026-84145

This vulnerability involves internally found bugs in Mozilla Thunderbird and Mozilla Firefox . The defects may lead to memory corruption or other security-relevant issues, which could potentially be exploited with sufficient effort. Affected versions include Thunderbird 154 , Thunderbird ESR 153....