CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2014-1499

CVE-2014-1499 affects Mozilla Firefox prior to 28.0 and SeaMonkey prior to 2.25. The issue lets a remote attacker spoof the domain in the WebRTC camera or microphone permission prompts by triggering a navigation at a specific moment during prompt generation. This is caused by how the browser hand...

CVE-2025-27424

The Firefox for iOS browser is affected by an input validation error where websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability specifically affects Firefox for iOS versions prior to 136 . The issue was resolved in Fire...

CVE-2026-16359

The Audio/Video: GMP component in Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This flaw can lead to security risks, including potential arbitrary code execution, as indicated by related security advisories. The vulnerability has been addressed in Firefox 153 , Firefox...

CVE-2026-16369

An integer overflow vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird applications. This flaw could lead to security compromises, potentially allowing for the execution of arbitrary code. Remediation is available in Firefox 153 , Firefox ESR 140.13 , and...

CVE-2026-2634

The vulnerability CVE-2026-2634 affects Firefox for iOS . Malicious scripts could cause desynchronization between the address bar and web content before a response is received, allowing attacker‑controlled pages to be displayed under spoofed domains. The vulnerability is stated to be fixed in Fir...

CVE-2026-74963

A Same-origin policy bypass exists in the Networking: Cookies component of the Mozilla Firefox and Thunderbird applications. This vulnerability affects various versions of Firefox and Thunderbird, including Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.1...

CVE-2026-8391

The JavaScript Engine component in the Mozilla Firefox web browser and Thunderbird email client is affected by a vulnerability. The root cause is identified as insufficient input validation , which could allow a remote attacker to gain access to confidential data . Remediation is available in the...

CVE-2026-84118

A use-after-free vulnerability exists in the SpiderMonkey GC component (Bug 2057457) affecting Mozilla Firefox and Thunderbird . The root cause is that version 154 conflates per-zone atom mark bitmaps with reference tracking; specifically, a weak CacheIR edge to a Symbol is not re-marked when the...

CVE-2026-8946

The Audio/Video: Web Codecs component in the Firefox web browser and Thunderbird email client is susceptible to a vulnerability caused by incorrect boundary conditions . This flaw allows a remote attacker to perform arbitrary code execution by triggering operations outside the buffer in memory. T...

CVE-2026-8955

A privilege escalation vulnerability exists in the DOM: Workers component of the Firefox web browser and Thunderbird email client. The flaw is caused by insecure management of privileges , which could allow a malicious actor to cause service interruptions or trigger service failures. This issue h...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2025-27425

Mozilla Firefox for iOS (versions

CVE-2026-100819

The XPCOM component in the Firefox browser is vulnerable to a sandbox escape caused by incorrect boundary conditions . This issue was addressed in several releases, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Exploitation details and direct links are ...

CVE-2026-12313

A vulnerability in the Security: Process Sandboxing component of Mozilla Firefox and Mozilla Thunderbird products allows for information disclosure and a sandbox escape . The issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Specific details...

CVE-2026-13356

A malicious webpage can exploit a vulnerability in Firefox for iOS by enqueuing a synchronous JavaScript dialog to interrupt a pending navigation. This results in a UI misrepresentation where the address bar displays the destination origin while the browser continues to render attacker-controlled...

CVE-2026-16370

CVE-2026-16370 identifies a mitigation bypass within the DOM: Networking component. This vulnerability affects the Mozilla Firefox and Mozilla Thunderbird browsers. The issue was officially addressed and fixed in Firefox 153 and Thunderbird 153 . No specific exploit details or in-the-wild exploit...

CVE-2026-6753

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a flaw involving incorrect boundary conditions in the WebRTC component . In some environments, this vulnerability is also associated with the execution of operations outside of the buffer in memory. Exploiting this...

CVE-2026-6761

A privilege escalation vulnerability exists in the Networking component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. The flaw is caused by deficiencies in access control , which could allow a malicious actor to remotely enhance their privileges. The issue has been addresse...

CVE-2026-6765

The Form Autofill component in Mozilla Firefox and the Thunderbird email client is vulnerable to an information disclosure flaw. This vulnerability stems from deficiencies in access control for personal information, which could allow a malicious actor to gain unauthorized access to protected data...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2017-7757

CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...

CVE-2025-1940

The Android version of Firefox is vulnerable to a flaw where a select option can partially obscure the confirmation prompt displayed before launching external applications. This behavior could be exploited to trick users into launching an external app unexpectedly. This vulnerability affects Fire...

CVE-2025-3031

The Mozilla Firefox browser and Mozilla Thunderbird email client are vulnerable to an information disclosure flaw. An attacker could read 32 bits of values spilled onto the stack within a JIT compiled function . This vulnerability could allow a malicious actor to compromise the confidentiality an...

CVE-2025-3035

Mozilla Firefox (including Firefox-ESR ) is affected by a vulnerability where the document title of a previous tab leaks into an AI chatbot prompt. This occurs when a user interacts with the chatbot in one tab and subsequently activates it in another tab. This flaw affects versions prior to 137 ....

CVE-2025-4084

The "Copy as cURL" feature in Mozilla Firefox ESR (on Windows) and Mozilla Thunderbird is vulnerable to local code execution due to insufficient escaping of special characters . An attacker could trick a user into executing a malicious command on their system. This issue specifically affects Fire...

CVE-2026-16366

CVE-2026-16366 identifies a privilege escalation vulnerability within the DOM: Navigation component . This security flaw has been addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the available documentation.

CVE-2026-84139

A clickjacking vulnerability exists in the DOM: Events component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wild exploitation instances were provi...

CVE-2026-92007

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This vulnerability affects various versions of the software, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thu...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2016-5299

CVE-2016-5299 affects Firefox for Android (Android), where a previously installed malicious app with signature-level permissions can intercept AuthTokens intended for Firefox. The issue is limited to Firefox for Android and does not affect other platforms; vulnerable version is Firefox prior to 5...

CVE-2025-1941

The Mozilla Firefox browser is affected by a vulnerability where a user opt-in setting intended to require authentication for Focus could be bypassed. This flaw is distinct from CVE-2025-0245. The issue was resolved in Firefox 136 . Users are advised to upgrade to the latest version in their rele...

CVE-2025-8040

Mozilla Firefox and Thunderbird are affected by memory safety bugs involving memory corruption. The vulnerability arises from the execution of operations outside of the buffer in memory , which could allow a remote attacker to cause a service failure or potentially execute arbitrary code with suf...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-16388

CVE-2026-16388 identifies a sandbox escape vulnerability in the DOM: Networking component of the Mozilla Thunderbird and Firefox browsers. The vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or information regarding the underlying root cause are provid...

CVE-2026-74971

A security vulnerability in the DOM: UI Events & Focus Handling component allows for information disclosure . This issue affects the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 ,...

CVE-2026-8950

A Same-origin policy bypass exists in the Networking: HTTP component of the Firefox web browser and Thunderbird email client. The vulnerability is caused by a lack of mechanisms for verifying the source of data , which could allow an attacker to gain access to confidential data and compromise dat...

CVE-2026-8974

Memory safety bugs in Firefox ESR 140.10 , Firefox 150 , Thunderbird 140.10 , and Thunderbird 150 can lead to memory corruption. If successfully exploited with significant effort, these vulnerabilities could allow an attacker to execute arbitrary code . The issues are addressed in Firefox 151 , F...

CVE-2026-9078

Mozilla Firefox for iOS versions prior to 151.1 are vulnerable to a flaw where specially crafted right-to-left (RTL) and internationalized domain names (IDNs) are displayed incorrectly in link preview UI surfaces. An attacker can use a crafted RTL hostname to visually reorder the displayed domain...

CVE-2003-1492

CVE-2003-1492 affects Netscape Navigator 7.0.2 and Mozilla, where an HTTP request to a domain with a trailing dot can cause cross-domain cookie access. The connected ROSA advisory lists this CVE as Fixed and notes remediation as updating Firefox (DNF command reference: sudo dnf update firefox). T...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2016-9061

CVE-2016-9061 affects Firefox for Android, where a previously installed malicious Android app can exploit a signature-level permission to access API keys meant for Firefox. The issue is limited to Firefox for Android; other platforms are unaffected and Firefox versions prior to 50 are affected. T...

CVE-2025-4085

The Firefox web browser and Thunderbird email client are affected by a vulnerability involving insecure management of privileges. An attacker who gains control over a content process can leverage the privileged UITour actor to leak sensitive information or escalate privileges. This flaw impacts v...

CVE-2025-6435

Mozilla Firefox and Thunderbird versions prior to 140 are affected by a vulnerability where saving a response from the Network tab in Devtools via the Save As context menu may fail to append the .download file extension. This lack of extension sanitization could lead to a user inadvertently runni...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird

CVE-2026-12306

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability affects multiple versions, including Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. While the specific root cause is described generally as a memory safety i...

CVE-2026-16364

CVE-2026-16364 involves incorrect boundary conditions in the Audio/Video: Playback component of the Mozilla software suite. This vulnerability was addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the available documentation.