CVE-2025-8029

Mozilla Thunderbird and Firefox (including ESR versions) are vulnerable to the execution of javascript: URLs when used within object and embed tags. This issue affects versions prior to Firefox 141 , Firefox ESR 128.13 , Firefox ESR 140.1 , Thunderbird 141 , Thunderbird 128.13 , and Thunderbird 1...

CVE-2025-8031

The Mozilla Firefox , Firefox ESR , and Thunderbird email clients are vulnerable to a security flaw where the username:password portion of URLs was not correctly stripped from CSP reports . This oversight could potentially lead to the leakage of HTTP Basic Authentication credentials. The issue ha...

CVE-2025-9181

Mozilla Firefox and Thunderbird are affected by a vulnerability involving uninitialized memory in the JavaScript Engine component. Specifically, the issue relates to access to an uninitialized pointer , which could allow a malicious actor to compromise the confidentiality, integrity, and accessib...

CVE-2026-106016

A security bypass vulnerability exists in the File Handling component of Mozilla Firefox (earlier than version 157.0.1 ). This flaw allows malicious users to bypass security restrictions, potentially enabling actions restricted by current security settings. The vulnerability is addressed in Firef...

CVE-2026-74969

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw was addressed in the release of Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140...

CVE-2026-84124

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird software. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The vulnerability has been addressed in the following versions: Firefo...

CVE-2026-84131

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by an invalid pointer within the Graphics component . This security issue could potentially allow for the execution of arbitrary code or other unauthorized actions. Remediation is available in the followin...

CVE-2026-92079

A mitigation bypass exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird . This vulnerability impacts several versions and was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific root cause is not detailed beyond the comp...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2014-1498

CVE-2014-1498 : The vulnerability affects Mozilla Firefox before 28.0 and SeaMonkey before 2.25, where crypto.generateCRMFRequest fails to validate a specific key type. This can cause remote crashes/DoS via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algo...

CVE-2014-1511

Mozilla Firefox versions before 28.0 , Firefox ESR 24.x before 24.4 , Thunderbird before 24.4 , and SeaMonkey before 2.25 are vulnerable to a security flaw that allows remote attackers to bypass the popup blocker via unspecified vectors. While specific technical root causes for this bypass are no...

CVE-2017-5468

The CVE-2017-5468 issue affects Mozilla Firefox before version 53, related to an incorrect ownership model of privateBrowsing information exposed via developer tools. The underlying problem is in how privateBrowsing ownership is tracked in the developer tools, which can trigger a non-exploitable ...

CVE-2023-37210

CVE-2023-37210 affects Mozilla Firefox prior to 115, where a website could prevent exiting full-screen mode using alert/prompt, potentially causing user confusion or spoofing. The issue is confirmed in multiple sources and is addressed by updating Firefox to 115 or newer (fix included in Firefox ...

CVE-2025-6429

Mozilla Firefox and Thunderbird are vulnerable to a security bypass due to the incorrect parsing of URLs within an embed tag. The flaw could cause the browser to rewrite the URL to the youtube.com domain, potentially bypassing website security checks that restrict which domains users are permitte...

CVE-2026-16352

A sandbox escape vulnerability exists in the Disability Access APIs component of the Mozilla Firefox and Thunderbird browsers. This flaw is caused by a use-after-free condition. Impacting multiple components, this issue was addressed in Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thun...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-6760

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass vulnerability in the Networking: Cookies component. The root cause is related to the software's reliance on cookies without sufficient checks for their authenticity and integrity . Exploitation of this flaw c...

CVE-2026-74948

A vulnerability in the Graphics component of Mozilla Firefox and Thunderbird leads to information disclosure . This issue has been addressed in several releases, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunde...

CVE-2026-74966

A vulnerability exists in the Form Autofill component, leading to an information disclosure . The issue has been resolved in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Exploitation details are not provided in the available documents.

CVE-2026-74977

An integer overflow vulnerability exists in the Graphics component of Firefox and Thunderbird . This issue was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the documents provide high-level details regarding the overflow and the affected software v...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2017-5458

CVE-2017-5458 describes a reflected XSS in Firefox where dragging a javascript: URL into the address bar can be executed by the victim. The vulnerability affects Firefox versions prior to 53; the issue arises from insufficient validation of javascript: URLs in the address bar during drag-and-drop...

CVE-2025-1942

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability in the String.toUpperCase() function. When this function results in a longer string, it can incorporate uninitialized memory into the output. This flaw originates from access to an uninitialized point...

CVE-2025-9182

The Graphics: WebRender component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an out-of-memory condition, which may be triggered by improper resource cleanup or release. This vulnerability allows an attacker to cause remo...

CVE-2026-12312

A memory safety bug has been identified in Firefox and Thunderbird . The vulnerability is present in several versions, including Firefox 152 , Firefox ESR 140.12 , and Thunderbird 152 and Thunderbird 140.12 . This bug has been addressed in the aforementioned versions. No specific root cause detai...

CVE-2026-6768

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by a vulnerability in the Networking: Cookies component. This flaw allows for a mitigation bypass , where an attacker can bypass authentication by utilizing an alternative path or channel. Exploitation of this vulne...

CVE-2026-74945

CVE-2026-74945 identifies an information disclosure vulnerability within the Graphics: Text component of Firefox and Thunderbird . The root cause involves an uninitialized heap disclosure that can be triggered via a crafted web font. Specifically, a malicious @font-face font can walk the OTS outp...

CVE-2026-74974

CVE-2026-74974 describes a Same-origin policy bypass within the Graphics: ImageLib component of Mozilla products. The vulnerability affects Firefox and Thunderbird . This issue has been addressed in several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 15...

CVE-2026-8959

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. This input validation error allows for potential sandbox escapes in affected versions. The vulnerability has been addres...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2025-8039

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by an information disclosure vulnerability where search terms persist in the URL bar even after navigating away from the search page. This exposure can allow an attacker to compromise the confidentiality and integrity o...

CVE-2026-16354

CVE-2026-16354 is an information disclosure vulnerability within the Graphics: ImageLib component of the Mozilla Firefox and Thunderbird browsers. The flaw was addressed in Firefox versions 153 , ESR 115.38 , and ESR 140.13 , as well as Thunderbird versions 153 and 140.13 . No specific exploit de...

CVE-2026-16379

CVE-2026-16379 involves a privilege escalation vulnerability within the DOM: Content Processes component of the Mozilla Firefox browser and Thunderbird mail client. The issue allows for elevated privileges and was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 1...

CVE-2026-6779

The JavaScript Engine component in Mozilla Firefox and the Thunderbird email client is vulnerable to an issue caused by insufficient validation of input data . This security flaw could allow an attacker to compromise the confidentiality of protected information . The vulnerability has been addres...

CVE-2026-74942

A privilege escalation vulnerability exists in the Remote Settings Client component of the Firefox browser and Thunderbird mail client. The vulnerability affects multiple versions and has been addressed in Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154...

CVE-2026-74984

A race condition vulnerability exists in the JavaScript Engine component of several Mozilla products. This flaw, identified as CVE-2026-74984 , was patched in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . The vulnerability is characterized as CWE-362 (Concurrent Exec...

CVE-2026-92071

A sandbox escape vulnerability exists in the Widget: Win32 component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw allows an attacker to escape the sandbox environment, potentially leading to broader system impact. The issue was addressed in Firefox 156 , Firefox ESR ...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2017-5392

CVE-2017-5392 affects Firefox for Android. Weak proxy objects hold weak references on multiple threads, causing memory usage issues and potential crashes. Affected: Firefox for Android, Firefox

CVE-2017-5415

CVE-2017-5415 is a blob URL address-bar spoofing vulnerability in Mozilla Firefox (affecting Firefox < 52). The issue enables spoofing the address bar through a blob: URL, potentially confusing users and enabling follow-on spoofing. IBM SONAS bulletin confirms CVE-2017-5415 alongside other Fir...

CVE-2021-29973

Firefox for Android was vulnerable to password autofill being triggered on insecure websites without user interaction. The issue, affecting Firefox versions earlier than 90, was fixed by requiring user interaction before autofill occurs; the mitigation is upgrading to Firefox 90 or newer. The vul...

CVE-2025-8036

Mozilla products, specifically Firefox , Firefox ESR , and Thunderbird , are vulnerable to a flaw where Thunderbird caches CORS preflight responses across IP address changes. This behavior enables attackers to circumvent Cross-Origin Resource Sharing (CORS) policies using DNS rebinding attacks. A...

CVE-2026-12299

CVE-2026-12299 involves a JIT miscompilation vulnerability within the DOM: Core & HTML component . This issue impacts the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird...

CVE-2026-6752

The WebRTC component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client is vulnerable to incorrect boundary conditions . This flaw allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information. The vulnerability has been addressed in ...

CVE-2026-74953

A privilege escalation vulnerability exists in the Networking: Cookies component of Mozilla Firefox and Mozilla Thunderbird . The flaw was addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . No specific root cause or e...