CVE-2025-8037

CVE-2025-8037 affects Mozilla Firefox (and Thunderbird) browsers when a nameless cookie value contains an equals sign, shadowing other cookies. Affected: Firefox <141, Firefox ESR <140.1, Thunderbird <141, Thunderbird

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2026-6777

CVE-2026-6777 is a general description of an issue in the Networking: DNS component, without explicit exploitation details. The connected advisories indicate a fix in Firefox 150 and Thunderbird 150, and Fedora advisories recommend updating NSS to 3.122.1 along with Firefox to 150.0. The ENISA/EU...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2025-8031

CVE-2025-8031 concerns a vulnerability where the username:password portion is not correctly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. The CVE’s context across connected documents shows affected software including Firefox and Thunderbird variants...

CVE-2026-6770

CVE-2026-6770 concerns an issue in the Storage: IndexedDB component affecting Firefox and Thunderbird. The initial entry notes an “Other issue in the Storage: IndexedDB component” and states it was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected adviso...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2025-8039

The CVE-2025-8039 entry concerns a vulnerability where search terms persist in the URL bar after navigating away from a search page. Affected software and versions are Mozilla Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2021-43531

CVE-2021-43531 affects Firefox prior to version 94. The issue arises when a Web Extension loads a context menu and could access the post-redirect URL of the clicked element if it lacked WebRequest permissions for the involved hosts, causing a same-origin-violation that leaks data the extension wo...

CVE-2025-27424

Summary: CVE-2025-27424 describes a vulnerability where websites that redirect to non-HTTP schemes can allow spoofing of the displayed URL, affecting Firefox for iOS before version 136. The issue is linked to URL handling that permits non-HTTP schemes in redirects, enabling a malicious page to im...

CVE-2025-27425

Firefox for iOS before version 136 is vulnerable to QR-code URL handling where scanning text in a QR code could open the URL without a user confirmation alert. This affects Firefox for iOS builds prior to 136; Mozilla MFSA2025-13 indicates related URL-spoofing/redirect concerns. Remediation: upda...

CVE-2025-6433

CVE-2025-6433 describes a WebAuthn behavior where, if a user visits a page with an invalid TLS certificate and grants an exception, the page could present a WebAuthn challenge, violating WebAuthN’s requirement for a secure transport. Affected products include Mozilla Firefox and Thunderbird prior...

CVE-2025-8028

CVE-2025-8028 describes a vulnerability in Firefox and Thunderbird affecting arm64 WASM, where a br_table with many entries can cause the branch label to be miscomputed due to truncation. Affected are Firefox and Firefox ESR versions prior to 141/115.26/128.13/140.1 and Thunderbird versions prior...

CVE-2026-6769

CVE-2026-6769 is a privilege-escalation issue in the Firefox/Thunderbird Debugger component. The Initial Description states a fix in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:10757, Debian DLA/...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2014-1478

This CVE (CVE-2014-1478) affects Mozilla Firefox before 27.0 and SeaMonkey before 2.24. The issue involves memory corruption in the browser engine (MPostWriteBarrier in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey) and may allow remote code execution or cause a crash...

CVE-2014-1519

CVE-2014-1519 refers to multiple vulnerabilities in Mozilla Firefox (browser engine) prior to 29.0 and SeaMonkey prior to 2.26. The core issue is memory corruption that can cause a denial of service or possibly allow arbitrary code execution via unknown vectors. The connected documents corroborat...

CVE-2016-9065

CVE-2016-9065 affects Firefox for Android and is a UI spoofing flaw where the location bar can be spoofed by forcing fullscreen mode, blocking exit, and displaying a fake address bar without user notification. The issue is limited to Firefox for Android; other OSes are not affected, and the vulne...

CVE-2017-5397

The CVE-2017-5397 issue affects Mozilla Firefox, specifically versions earlier than 51.0.3. The root cause is a world-writable cache directory on the local filesystem, which Firefox uses to extract libraries. This configuration allows a local attacker with write access (e.g., a malicious installe...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2021-4128

The CVE-2021-4128 entry describes a macOS-specific Firefox vulnerability where a graphics object isn’t properly protected when entering/exiting fullscreen, causing memory corruption and a potentially exploitable crash. Affected product: Mozilla Firefox on macOS (Firefox versions earlier than 95)....

CVE-2025-6432

CVE-2025-6432 affects Mozilla Firefox and Thunderbird (Firefox < 140 and Thunderbird

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2017-5409

The CVE-2017-5409 issue affects Mozilla Firefox on Windows (Firefox ESR <45.8 and Firefox

CVE-2025-9182

CVE-2025-9182 denotes a denial-of-service caused by an out-of-memory condition in the Graphics: WebRender component. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird

CVE-2026-6754

CVE-2026-6754 is a memory-safety issue (Use-after-free) in the JavaScript Engine component that was fixed in Firefox 150 and related ESR branches, as well as Thunderbird 150/140.x lines. Public advisories confirm the flaw in the JavaScript engine leads to a potentially exploitable memory corrupti...

CVE-2026-6773

The vulnerability CVE-2026-6773 is a denial-of-service caused by an integer overflow in the Graphics: WebGPU component. Affected products identified in the provided sources include Firefox and Thunderbird; the issue was fixed in Firefox 150 and Thunderbird 150. The CVE’s impact is documented as h...

CVE-2026-8093

CVE-2026-8093 concerns memory-safety bugs in Firefox 150.0.1. The gathered records describe memory corruption clues and state that, with sufficient effort, some flaws could have allowed arbitrary code execution. Mozilla's advisory confirms the issue was fixed in Firefox 150.0.2. Affected software...

CVE-2025-3035

Mozilla Firefox vulnerability CVE-2025-3035 affects Firefox versions earlier than 137.0. When a user opens an AI chatbot in one tab and later activates it in another, the document title from the previous tab can leak into the chat prompt. The available connected sources confirm the affected produ...

CVE-2026-16358

Summary: CVE-2026-16358 is a site-isolation issue in the Graphics: WebRender component of Mozilla Firefox/Firefox ESR. The underlying problem is within WebRender's handling of cross-origin/site isolation, and it has been fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected p...

CVE-2026-8388

CVE-2026-8388 corresponds to a vulnerability in the JavaScript Engine: JIT component with incorrect boundary conditions. Publicly documented fixes indicate Firefox fixed this in Firefox 150.0.3 and in Firefox ESR releases 115.36, 140.11, and Thunderbird 140.11. Connected advisories confirm Firefo...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2025-1941

CVE-2025-1941 concerns Mozilla Firefox before version 136, with an authentication-bypass in an opt-in focus setting. The initial description states bypass under certain circumstances but provides no specific root-cause or exploit details. Connected documents corroborate Firefox < 136 as affect...

CVE-2025-3031

CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2012-4217

CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey

CVE-2021-4221

CVE-2021-4221 : Affects Firefox for Android. If a domain name contains a RTL (Right-to-Left) character, the domain could render to the right of the path, enabling user confusion and spoofing. The vulnerability is limited to Firefox for Android; other OSes are unaffected. The advisory notes Firefo...

CVE-2025-8038

CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...

CVE-2017-7763

CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...

CVE-2025-4089

CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...

CVE-2025-5270

CVE-2025-5270 concerns Mozilla Firefox and Thunderbird where SNI could be sent unencrypted even when encrypted DNS is enabled. Affected products are Firefox versions earlier than 139 and Thunderbird versions earlier than 139. The vulnerability’s impact includes potential disclosure of sensitive i...

CVE-2025-6435

CVE-2025-6435 corresponds to a Mozilla Firefox/Thunderbird issue where saving a response from Devtools Network tab via the Save As menu may fail to preserve the .download extension. This could allow a user to inadvertently run a malicious executable. The FreeBSD advisory also notes memory safety ...