CVE-2009-4130

Mozilla Firefox vulnerability CVE-2009-4130 affects the MakeScriptDialogTitle function in nsGlobalWindow.cpp. A visual truncation flaw allows remote attackers to spoof the origin domain name of a script by providing an excessively long name, enabling spoofing of the script’s perceived origin. Roo...

CVE-2007-3827

Mozilla Firefox is affected by CVE-2007-3827: cookies can be set with a null domain (domainless cookies), enabling information to pass between arbitrary domains and potential user tracking via document.cookie in javascript:. window. The vulnerability stems from how cookies are handled with a null...

CVE-2007-6715

CVE-2007-6715 : Mozilla Firefox is vulnerable to a denial of service (crash) via a crafted image, as demonstrated by the zzuf lol-firefox.gif test case. Public sources (NVD/SUSE/Ubuntu) confirm the vulnerability in Firefox and note the fix has been applied in the product (status: Fixed). The avai...

CVE-2025-10527

The CVE-2025-10527 entry corresponds to a sandbox escape via use-after-free in the Graphics: Canvas2D component. Affected products include Firefox <143, Firefox ESR <140.3, Thunderbird <143, and Thunderbird

CVE-2025-6431

The connected documents confirm CVE-2025-6431 affects Firefox for Android and describes a bypass where the prompt to open a link in an external application could be bypassed, potentially exposing users to security/privacy risks in external apps. The vulnerability is limited to Firefox for Android...

CVE-2026-12293

CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...

CVE-2026-12311

CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...

CVE-2026-6761

CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...

CVE-2025-10536

Mode C: CVE-2025-10536 is an Information disclosure in the Networking: Cache component affecting Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-6750

CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...

CVE-2026-8391

CVE-2026-8391 is a Mozilla Firefox JavaScript Engine issue categorized as an “Other issue in the JavaScript Engine component.” The CVE entry states fixes in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11. Connected advisories reiterate this CVE among Firefox JS En...

CVE-2011-3656

CVE-2011-3656 affects Mozilla Firefox up to version 3.6.24 and 4.x through 7, with a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via HTTP 0.9 error handling, non-default ports, and content-sniffing. The provided documents consistently describe t...

CVE-2025-6428

The CVE-2025-6428 issue affects Firefox for Android only (other Firefox versions are not affected) and is triggered when a URL is provided in a link querystring parameter; the browser would navigate to that URL instead of the intended one, enabling phishing under certain conditions. Affected scop...

CVE-2026-6774

CVE-2026-6774 is a mitigation bypass in the DOM: Security component that affects Firefox and Thunderbird. The issue is described as a bypass of mitigation in the DOM security stack and was fixed in Firefox 150 and Thunderbird 150. The provided metadata indicates a CVSS v3.1 base score of 5.4 (Med...

CVE-2026-6775

CVE-2026-6775: Affects the WebRTC component with incorrect boundary conditions. Urban/Thunderbird users should upgrade to Firefox 150 and Thunderbird 150 where the issue is fixed. The vulnerability entry specifies this CVE’s root cause and that remediation is through upgrading to the listed versi...

CVE-2026-12295

CVE-2026-12295 describes a sandbox escape in the DOM: Navigation component affecting Mozilla Firefox and Thunderbird. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The entry lists a CVSS v3.1 base score of 9.6 (CRITICAL...

CVE-2026-2634

The vulnerability CVE-2026-2634 affects Firefox for iOS . Malicious scripts could cause desynchronization between the address bar and web content before a response is received, allowing attacker‑controlled pages to be displayed under spoofed domains. The vulnerability is stated to be fixed in Fir...

CVE-2026-2797

CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...

CVE-2026-6751

CVE-2026-6751 is a vulnerability described as an uninitialized memory issue in the Audio/Video: Web Codecs component. The primary CVE entry references Firefox (fixed in Firefox 150 and Firefox ESR 140.10), Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). Connected advisories confirm...

CVE-2026-12304

CVE-2026-12304 involves a Same-origin policy bypass in the Networking: Cookies component affecting Mozilla products. The vulnerability is documented for Firefox and Thunderbird (including firefox-esr and Thunderbird ESR variants) with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderb...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2025-13027

CVE-2025-13027 is a memory-safety issue affecting Firefox and Thunderbird prior to version 145. The connected documents corroborate memory-corruption–related bugs in Firefox 144/Thunderbird 144, with the advisory noting potential arbitrary-code execution if exploited. Affected products include Fi...

CVE-2026-12291

CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...

CVE-2026-6757

CVE-2026-6757 corresponds to an invalid pointer in the JavaScript: WebAssembly component. The connected advisories confirm affected products as Firefox (including Firefox 150 and Firefox ESR 140.10) and Thunderbird (150 and 140.10), with fixes in those respective versions. Several entries (ALSA p...

CVE-2025-10528

CVE-2025-10528 is a sandbox escape in Mozilla Firefox/Thunderbird caused by undefined behavior due to an invalid pointer in Graphics: Canvas2D. Affected products include Firefox < 143 and Firefox ESR < 140.3, Thunderbird < 143 and Thunderbird

CVE-2025-10531

CVE-2025-10531 : Affects Firefox < 143 and Thunderbird

CVE-2025-10532

CVE-2025-10532 involves incorrect boundary conditions in the JavaScript: GC component affecting Firefox and Thunderbird products. Affected versions: Firefox and Thunderbird before 143, and ESR before 140.3. Connected advisories indicate fixes released as Firefox/Thunderbird updates (e.g., Firefox...

CVE-2026-24869

CVE-2026-24869 documents a Use-after-free in Firefox’s Layout: Scrolling and Overflow component, affecting Firefox versions earlier than 147.0.2. The vulnerability is described in multiple sources as a use-after-free issue with potential impact to memory safety in that UI/layout area. Nessus/Free...

CVE-2026-2792

CVE-2026-2792 involves memory safety bugs found in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some flaws showed memory corruption indicators and could potentially be exploited to run arbitrary code; Mozilla fixed these in Firefox 148, Firefox ESR 140.8, Thunderbird...

CVE-2026-4684

CVE-2026-4684 describes a race condition leading to a use-after-free in the Graphics: WebRender component. Affected products/versions are Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2026-8389

CVE-2026-8389 is a JIT miscompilation vulnerability in the Firefox JavaScript Engine (JIT component). Multiple connected sources (NVD, EUVD, CIRCL sighting, Debian/MD advisories, and Mozilla MFSA advisory) confirm the issue affects Firefox and was addressed in version 150.0.3. The underlying issu...

CVE-2025-10533

CVE-2025-10533 describes an integer overflow in the SVG component affecting Firefox before 143, Firefox ESR before 115.28 and 140.3, Thunderbird before 143 and 140.3. Connected sources confirm the same vulnerability details. The Astra Linux security bulletin echoes this issue and lists the affect...

CVE-2026-0877

CVE-2026-0877 is a mitigation bypass in the DOM: Security component, affecting Firefox versions below 147, including Firefox ESR <115.32 and ESR

CVE-2026-12297

CVE-2026-12297 describes a sandbox escape caused by incorrect boundary conditions in Mozilla Firefox/Thunderbird networking code. Affects Firefox and Thunderbird components; underlying fault is boundary-condition handling in the Networking component that allowed escape from the sandbox. Impact pe...

CVE-2026-9308

CVE-2026-9308 affects Firefox for iOS Reader View. The issue occurs when HTML templates are processed before internal placeholders are replaced, allowing a malicious page to substitute a placeholder with JSON-LD data and potentially execute arbitrary JavaScript. The fix is in Firefox for iOS 151....

CVE-2025-10537

CVE-2025-10537 involves memory-safety bugs in Mozilla Firefox and Thunderbird (Firefox ESR 140.2/ Thunderbird ESR 140.2; Firefox 142/ Thunderbird 142) with potential to corrupt memory and, with enough effort, could allow arbitrary code execution. Affected: Firefox < 143, Firefox ESR < 140.3...

CVE-2025-8043

CVE-2025-8043 relates to Firefox and Thunderbird where URL truncation occurs toward the origin, with affected versions Firefox < 141 and Thunderbird

CVE-2026-8959

CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...

CVE-2026-9078

Firefox for iOS suffers a rendering issue in link-preview UI where specially crafted RTL and internationalized domain names could cause the displayed domain to visually reorder, making attacker-controlled sites appear as trusted origins. The vulnerability affects the RTL/IDN rendering surface wit...

CVE-2025-8042

CVE-2025-8042 affects Mozilla Firefox for Android up to version 141. A sandboxed iframe without the allow-downloads attribute could initiate downloads, enabling information disclosure and potentially arbitrary code execution. CVSSv3.1 is high/critical with network vector, no user interaction. Rem...

CVE-2026-4698

CVE-2026-4698 — JIT miscompilation in the JavaScript Engine (JIT component) . The issue is disclosed for Firefox/Thunderbird products and is described as a JIT miscompilation in the JavaScript engine’s JIT path. Affected versions are Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2025-11711

The provided connected advisories confirm CVE-2025-11711 affects Firefox and Thunderbird across multiple versions (Firefox < 144, ESR < 140.4, Thunderbird < 144, ESR

CVE-2025-13013

CVE-2025-13013 is a mitigation-bypass in the DOM: Core & HTML component, affecting Firefox and Thunderbird up to certain pre‑145/ESR versions (Firefox <145, ESR <140.5, ESR

CVE-2025-14322

CVE-2025-14322: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Affected software: Firefox versions before 146 and ESR before 115.31 and 140.6. The issue is described across multiple advisories (ALAS2023-2025-1337, ALAS2FIREFOX-2025-049, ALSA-2025:23128...

CVE-2025-14861

Firefox versions prior to 146.0.1 are affected by memory safety bugs (CVE-2025-14861) that can lead to memory corruption and, with enough effort, arbitrary code execution. The issue is fixed in Firefox 146.0.1; affected products include Firefox

CVE-2026-12290

A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...

CVE-2026-12313

CVE-2026-12313 affects Firefox and Thunderbird: Information disclosure and sandbox escape in the Security: Process Sandboxing component. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12 (per Mozilla advisories and downstream vendor trackers). ...

CVE-2026-12328

CVE-2026-12328 pertains to memory safety bugs in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151, and Thunderbird 151. Some bugs showed memory corruption and could potentially be exploited to run arbitrary code. Remediations are available: Firefox 152, Firefox ESR 140....