CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...

CVE-2012-3976

CVE-2012-3976 affects Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, and SeaMonkey before 2.12. The issue arises from improper handling of onLocationChange events when navigating between https sites, allowing remote attackers to spoof the X.509 certificate information in the address...

CVE-2016-9076

CVE-2016-9076 is a Firefox UI spoofing vulnerability where a dropdown can cover the address bar content when e10s is enabled. Affected: Firefox

CVE-2023-6868

CVE-2023-6868 affects Mozilla Firefox on Android. The issue allows a user-agent to send push requests without a valid VAPID even when the push subscription defines one, enabling empty messages to be sent by unauthorized parties. Impact is limited to Firefox

CVE-2025-5270

The Mozilla Firefox web browser and Thunderbird email client are affected by a vulnerability where SNI (Server Name Indication) could be sent unencrypted even when encrypted DNS is enabled. This flaw allows a remote attacker to potentially gain unauthorized access to protected information by inte...

CVE-2026-16372

CVE-2026-16372 involves a privilege escalation vulnerability within the DOM: Content Processes component of the browser engine. This security issue affects products including Firefox and Thunderbird . The vulnerability was addressed and fixed in Firefox 153 and Thunderbird 153 . Specific details ...

CVE-2026-16392

A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of Mozilla Firefox and Mozilla Thunderbird . This flaw was addressed in Firefox 153 and Thunderbird 153 . While specific technical root causes or exploit details are not provided in the documentation, the issue is c...

CVE-2026-2796

CVE-2026-2796 describes a JIT miscompilation in the JavaScript: WebAssembly component that affects Firefox and Thunderbird prior to version 148. The root cause is a JIT miscompilation in the WebAssembly pathway within the JavaScript engine, leading to a high-severity impact (as reflected by the C...

CVE-2012-4209

Mode C: The CVE-2012-4209 issue affects Mozilla-based components used in MiracleLinux 4 (firefox-10.0.11-1.0.1.AXS4, xulrunner-10.0.11-1.0.1.AXS4) and is described as allowing cross-site scripting by abusing top frame name and location access. Affected products include Mozilla Firefox and Firefox...

CVE-2013-0767

CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2014-1500

CVE-2014-1500 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue allows remote attackers to cause resource exhaustion and application hang via onbeforeunload events that trigger background JavaScript execution. Exploitation details are not provided in the available docum...

CVE-2016-5295

CVE-2016-5295 is a Windows-only privilege-escalation in Mozilla Maintenance Service that can let an attacker run malicious local files via the Mozilla Updater. Affected: Firefox before 50 on Windows. Impact: SYSTEM-level privilege elevation (confidentiality/integrity/availability at risk) as desc...

CVE-2019-9804

CVE-2019-9804 is a macOS-specific issue in Firefox Developer Tools where pasting the output of the ‘Copy as cURL’ command could cause the execution of unintended additional bash commands if the URL was maliciously crafted. The root cause is tied to how the native Bash on macOS handles the pasted ...

CVE-2025-6434

The Mozilla Firefox browser and Thunderbird email client are vulnerable to a clickjacking attack due to an information representation error in the user interface. Specifically, the exception page for the HTTPS-Only feature, which appears when a website is accessed via HTTP, lacked a necessary ant...

CVE-2025-8028

On arm64 architecture, a WASM br_table instruction containing numerous entries can cause the label to be positioned too far from the instruction. This results in truncation and the incorrect computation of the branch address . This vulnerability affects Firefox versions prior to 141, Firefox ESR ...

CVE-2026-74974

CVE-2026-74974 describes a Same-origin policy bypass within the Graphics: ImageLib component of Mozilla products. The vulnerability affects Firefox and Thunderbird . This issue has been addressed in several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 15...

CVE-2026-8949

An integer overflow exists in the Widget: Win32 component across several Mozilla products, including Firefox , Firefox ESR , and Thunderbird . This input validation error can lead to multiple impacts, including Arbitrary Code Execution (ACE) , Denial of Service (DoS) , Security Bypass (SB) , and ...

CVE-2026-92035

CVE-2026-92035 is a sandbox escape vulnerability in the Graphics component caused by incorrect boundary conditions. This flaw affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Impactful remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbi...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2017-5427

The CVE-2017-5427 entry covers a Mozilla Firefox/Firefox ESR startup vulnerability where a non-existent chrome.manifest file loaded from the primary installation directory can be exploited by a local attacker who places chrome.manifest and referenced files there. If exploited, startup-loaded code...

CVE-2021-29968

The CVE-2021-29968 vulnerability affects Mozilla Firefox on Windows (Firefox

CVE-2023-37205

The vulnerability CVE-2023-37205 affects Mozilla Firefox (and ESR per related advisories) and is caused by the use of RTL Arabic characters in the address bar, which could allow URL spoofing. Affected versions are Firefox before 115. The risk is described in multiple sources, with Mozilla MFSA ad...

CVE-2025-3033

The Mozilla Firefox (prior to 137.0) and Mozilla Thunderbird (prior to 137.0) browsers/clients on Windows are vulnerable to a flaw where selecting a malicious Windows .url shortcut from the local filesystem can lead to an unexpected file upload . This issue is specific to the Windows operating sy...

CVE-2025-3034

Mozilla Firefox and Thunderbird versions prior to 137 are affected by multiple memory safety bugs . These vulnerabilities involve memory corruption issues, which could allow a remote attacker to execute arbitrary code by performing operations beyond buffer boundaries in memory. Remediation is pro...

CVE-2026-106016

A security bypass vulnerability exists in the File Handling component of Mozilla Firefox (earlier than version 157.0.1 ). This flaw allows malicious users to bypass security restrictions, potentially enabling actions restricted by current security settings. The vulnerability is addressed in Firef...

CVE-2026-12298

A memory safety bug was identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability impacts Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described as a memory safety issue, specific details regarding the underlying m...

CVE-2026-12312

A memory safety bug has been identified in Firefox and Thunderbird . The vulnerability is present in several versions, including Firefox 152 , Firefox ESR 140.12 , and Thunderbird 152 and Thunderbird 140.12 . This bug has been addressed in the aforementioned versions. No specific root cause detai...

CVE-2026-16410

CVE-2026-16410 identifies a JIT miscompilation vulnerability within the JIT component of the JavaScript Engine . This flaw affects Firefox and Thunderbird , with remediation available in version 153 for both products. Technical details regarding the root cause, specific exploit vectors, or practi...

CVE-2026-84131

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by an invalid pointer within the Graphics component . This security issue could potentially allow for the execution of arbitrary code or other unauthorized actions. Remediation is available in the followin...

CVE-2026-92079

A mitigation bypass exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird . This vulnerability impacts several versions and was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific root cause is not detailed beyond the comp...

CVE-2016-5287

CVE-2016-5287 affects Mozilla Firefox up to 49.0.2. The issue is a use-after-free crash during actor destruction with service workers, caused by a fault in nsTArray_base::SwapArrayElements. The vulnerability leads to a potentially exploitable crash (no exploit details provided in the supplied doc...

CVE-2016-9075

CVE-2016-9075 : Firefox WebExtensions can misuse mozAddonManager API to elevate privileges because privileged pages are allowed in the permissions list, enabling a malicious extension to install additional extensions without explicit user permission. Affected: Firefox versions before 50. Root cau...

CVE-2017-7811

CVE-2017-7811 : Firefox 55 contains memory safety bugs that could allow memory corruption and potentially arbitrary code execution; affected products are Firefox versions older than 56. Remediation: upgrade to Firefox 56 or later (as referenced in mfsa2017-21). The connected Nessus entries also r...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2018-18496

CVE-2018-18496 is a clickjacking vulnerability in Mozilla Firefox’s feed preview page about:feeds. When the RSS Feed preview is framed in another page, scripted content can coerce a user into downloading and executing an executable from a temporary directory. It affects Firefox versions earlier t...

CVE-2021-29971

CVE-2021-29971 is a Mozilla Firefox vulnerability affecting Firefox for Android. The issue arises when a user grants a webpage permission and saves it; any webpage on the same host (regardless of scheme or port) could gain that permission. The advisory details that this affects Firefox versions o...

CVE-2025-8031

The Mozilla Firefox , Firefox ESR , and Thunderbird email clients are vulnerable to a security flaw where the username:password portion of URLs was not correctly stripped from CSP reports . This oversight could potentially lead to the leakage of HTTP Basic Authentication credentials. The issue ha...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-6760

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass vulnerability in the Networking: Cookies component. The root cause is related to the software's reliance on cookies without sufficient checks for their authenticity and integrity . Exploitation of this flaw c...

CVE-2026-74969

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw was addressed in the release of Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140...

CVE-2026-84124

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird software. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The vulnerability has been addressed in the following versions: Firefo...

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2016-5293

CVE-2016-5293 describes a local vulnerability in the Mozilla Updater on Windows: when the Updater log file in the working directory points to a hardlink, an attacker with local access can cause data to be appended to an arbitrary local file. Affected products include Firefox ESR older than 45.5 a...

CVE-2016-7153

CVE-2016-7153 describes a vulnerability in the HTTP/2 protocol where the TCP congestion window is not considered when determining content length, potentially enabling an attacker to obtain cleartext data by leveraging a web browser configuration that sends third‑party cookies (HEIST). The connect...