CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2017-7755

CVE-2017-7755 affects Mozilla Firefox and Thunderbird installers on Windows. The Firefox installer can be made to load malicious DLLs stored in the same directory as the installer, enabling privilege escalation when the installer runs with elevated privileges. Affected products/versions include F...

CVE-2020-12414

CVE-2020-12414 affects Firefox for iOS prior to version 27. The issue is that IndexedDB is not cleared upon leaving Private Browsing mode due to incorrect use of WKWebViewConfiguration API, which requires the private instance to be deleted when exiting private mode. Published references confirm M...

CVE-2020-15661

The CVE affects Firefox for iOS before version 28. A rogue webpage can override the injected WKUserScript used by the login autofill, potentially leaking the password for the current domain. This is caused by an override in the login autofill workflow. Mitigation per connected sources is to upgra...

CVE-2024-31392

The CVE-2024-31392 entry concerns Firefox for iOS prior to version 124, where an insecure element added to a page after a delay could fail to replace the secure icon with the correct mixed content status. Concrete details in connected documents identify the affected product as Firefox for iOS, th...

CVE-2025-5270

CVE-2025-5270 concerns Mozilla Firefox and Thunderbird where SNI could be sent unencrypted even when encrypted DNS is enabled. Affected products are Firefox versions earlier than 139 and Thunderbird versions earlier than 139. The vulnerability’s impact includes potential disclosure of sensitive i...

CVE-2025-6432

CVE-2025-6432 affects Mozilla Firefox and Thunderbird (Firefox < 140 and Thunderbird

CVE-2011-2670

CVE-2011-2670 affects Mozilla Firefox prior to 3.6. The vulnerability arises in the rendering of Cascading Style Sheets (CSS), enabling cross-site scripting (XSS). The impact per sources is arbitrary script execution in the affected browser. Affected product/version: Firefox

CVE-2017-7765

CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2025-27424

Summary: CVE-2025-27424 describes a vulnerability where websites that redirect to non-HTTP schemes can allow spoofing of the displayed URL, affecting Firefox for iOS before version 136. The issue is linked to URL handling that permits non-HTTP schemes in redirects, enabling a malicious page to im...

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2017-5450

CVE-2017-5450 describes a spoofing vulnerability in Firefox for Android where the address bar can be spoofed via a javascript: URI due to incorrect parsing of the base URL. Affected: Firefox for Android versions

CVE-2017-5463

CVE-2017-5463 affects Firefox for Android prior to version 53.0. The issue arises when Android intents can launch Firefox in reader mode with a user-supplied URL, allowing spoofing of the address bar contents shown to users. Public details in the provided sources confirm the affected product (Fir...

CVE-2017-5471

Summary (CVE-2017-5471): Firefox

CVE-2017-7767

CVE-2017-7767 involves privilege escalation and arbitrary file overwrites via the Mozilla Windows Updater and Mozilla Maintenance Service on Windows. Affected products are Firefox ESR versions older than 52.2 and Firefox versions older than 54. The root cause is the update/maintenance components ...

CVE-2025-23109

CVE-2025-23109 affects Firefox for iOS prior to version 134. The issue arises from long hostnames in URLs that can be used to obscure the actual host or spoof the website address. Mozilla’s advisory MFSA2025-06 confirms fixes shipped with Firefox iOS 134, and related entries note client-side path...

CVE-2025-4088

CVE-2025-4088 describes a cross-origin CSRF issue in Thunderbird (and affected Firefox) where malicious sites could exploit Redirects via the Storage Access API to send credentialed requests to arbitrary endpoints. Affected products: Firefox < 138 and Thunderbird

CVE-2007-0896

CVE-2007-0896 affects Sage before 1.3.10 and Sage++ extensions for Firefox. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via a <SCRIPT/=''SRC=' sequence in an RSS feed. Supported sources classify the issue as active hist...

CVE-2025-5272

CVE-2025-5272 arises from memory-safety bugs in Mozilla Firefox 138 and Thunderbird 138, with some bugs showing memory corruption that could potentially allow arbitrary code execution. The affected products are Firefox versions prior to 139 and Thunderbird versions prior to 139. The issue is addr...

CVE-2025-9182

CVE-2025-9182 denotes a denial-of-service caused by an out-of-memory condition in the Graphics: WebRender component. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird

CVE-2026-12289

CVE-2026-12289 describes a privilege-escalation vulnerability in the Graphics: WebRender component. The public description and connected advisories indicate this affects Mozilla Firefox and Thunderbird products, with fixes shipped in: Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbi...

CVE-2026-6746

This CVE (CVE-2026-6746) is a use-after-free in the DOM: Core & HTML component. The Initial document states it was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected documents also reference Mozilla advisories tying this CVE to Firefox...

CVE-2026-6773

The vulnerability CVE-2026-6773 is a denial-of-service caused by an integer overflow in the Graphics: WebGPU component. Affected products identified in the provided sources include Firefox and Thunderbird; the issue was fixed in Firefox 150 and Thunderbird 150. The CVE’s impact is documented as h...

CVE-2009-1597

Summary : CVE-2009-1597 affects Mozilla Firefox. What’s affected : Firefox’s handling of a javascript: URI in the target attribute of a submit element within a form embedded in a PDF, potentially bypassing Adobe Acrobat JavaScript restrictions. Root cause / vector : DOM calls triggered by the jav...

CVE-2023-37456

Summary of CVE-2023-37456 (Firefox for iOS) : The issue is a crash in the session restore helper when no parameter is sent to the message handler, affecting Firefox for iOS versions prior to 115. Per connected documents, this creates a denial-of-service risk that can be triggered remotely. The ro...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-15719

The CVE-2026-15719 entry refers to Firefox Site isolation in the DOM: Navigation component. Publicly disclosed exploit code exists, but none are documented as in-the-wild attacks in the provided sources. Affected software is Firefox; the vulnerability was fixed in Firefox 152.0.6. The Mozilla adv...

CVE-2026-6764

CVE-2026-6764 is an issue described as incorrect boundary conditions in the DOM: Device Interfaces component, affecting Firefox/Thunderbird. Public references in the connected advisories show fixes for this CVE in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and Thunderbird 140.10). The root...

CVE-2013-0777

CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...

CVE-2017-7760

CVE-2017-7760 affects Mozilla Firefox/Firefox ESR on Windows via the Mozilla Windows Updater and Maintenance Service. The vulnerability stems from the updater reading the original file and applying changes, with a malicious actor able to pass a crafted path to the callback parameter, enabling man...

CVE-2026-6760

Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...

CVE-2026-6768

CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...

CVE-2026-6769

CVE-2026-6769 is a privilege-escalation issue in the Firefox/Thunderbird Debugger component. The Initial Description states a fix in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:10757, Debian DLA/...

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2023-49060

CVE-2023-49060 affects Firefox for iOS prior to 120. The issue allows an attacker to exfiltrate a security key from Reader Mode by abusing the referrerpolicy attribute, potentially enabling access to internal pages/data. Root cause: misuse of Reader Mode and referrer policy handling leading to da...

CVE-2020-15671

CVE-2020-15671 involves a race condition in Firefox for Android (

CVE-2021-43530

Affected software: Firefox for Android. The CVE-2021-43530 entry describes a Universal XSS vulnerability caused by improper sanitization when processing a URL scanned from a QR code, affecting Firefox versions before 94. The condition is explicit in multiple sources (NVD/Nessus aggregation and re...

CVE-2025-8036

CVE-2025-8036 : Affects Mozilla Firefox (prior to 141, ESR prior to 140.1) and Thunderbird (prior to 141, 140.1). Root cause is caching of CORS preflight responses across IP address changes, enabling bypass of same-origin policy via DNS rebinding. Connected sources corroborate a DNS-rebinding vec...

CVE-2025-8039

The CVE-2025-8039 entry concerns a vulnerability where search terms persist in the URL bar after navigating away from a search page. Affected software and versions are Mozilla Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird

CVE-2026-6749

CVE-2026-6749 is an information disclosure vulnerability in the Graphics: Canvas2D component, caused by uninitialized memory. It affects Firefox and Thunderbird products; Mozilla advisories state fixes in Firefox 150, Firefox ESR 115.35 and 140.10, and Thunderbird 150 and 140.10. Amazon Linux 2 a...

CVE-2026-6784

CVE-2026-6784 covers memory safety bugs in Mozilla Firefox 149 and Thunderbird 149 that could lead to memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is evidenced across multiple feeds and is mitigated by upgrading to Firefox 150 and Thunderb...

CVE-2012-4212

Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.

CVE-2017-7761

Summary: CVE-2017-7761 affects Firefox on Windows (Firefox ESR < 52.2 and Firefox

CVE-2017-7768

CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox

CVE-2020-12412

This CVE (CVE-2020-12412) affects Mozilla Firefox prior to version 70, where navigating a tab via the History API could spoof the address bar to display an incorrect domain (https scheme, blocked port, no lock icon) while the page content is controlled. The vulnerability enables spoofing of the v...

CVE-2020-15662

The CVE-2020-15662 vulnerability affects Firefox for iOS

CVE-2025-8040

CVE-2025-8040 corresponds to memory-safety bugs in Mozilla Firefox/Thunderbird products (Firefox/Thunderbird 140 line, ESR 140.0 and related versions) with evidence of memory corruption that could potentially lead to arbitrary code execution. Affected components are the Firefox and Thunderbird br...