CVE-2026-9308

Firefox for iOS is vulnerable to arbitrary JavaScript execution within the Reader View due to an incorrect HTML replacement order. The application incorrectly replaces page content in its HTML template before processing other internal placeholders. This flaw allows a malicious page to include a p...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2017-5397

The CVE-2017-5397 issue affects Mozilla Firefox, specifically versions earlier than 51.0.3. The root cause is a world-writable cache directory on the local filesystem, which Firefox uses to extract libraries. This configuration allows a local attacker with write access (e.g., a malicious installe...

CVE-2025-4090

A vulnerability in Thunderbird for Android allows potentially sensitive library locations to be leaked via Logcat logs. This issue also impacts Firefox versions prior to 138 . The root cause involves the improper logging of internal paths, which could potentially provide information to an attacke...

CVE-2025-5272

Mozilla Firefox and Thunderbird versions prior to 139 (specifically version 138) are affected by memory safety bugs . These vulnerabilities involve memory corruption, which could potentially allow an attacker to execute arbitrary code with sufficient effort. The issue is mitigated by updating to ...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability affecting the Networking: HTTP component in Mozilla products. This flaw impacts Firefox , Firefox ESR , and Thunderbird . The vulnerability has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . N...

CVE-2026-92006

Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This security flaw impacts various versions, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thund...

CVE-2026-92054

The Memory component in Mozilla Firefox is vulnerable to privilege escalation (CVE-2026-92054). This issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific root cause or exploit details are provided in the documentation.

CVE-2009-2472

Affected software: Mozilla Firefox before 3.0.12 (as per CVE-2009-2472). Issue: during object construction, Firefox did not always use XPCCrossOriginWrapper, allowing bypass of the Same Origin Policy and enabling cross-site scripting (XSS) via a crafted document. Impact: potential XSS vulnerabili...

CVE-2013-5610

CVE-2013-5610 is a memory-corruption vulnerability in the Mozilla Firefox browser engine (pre-26.0) and SeaMonkey (pre-2.23) with potential remote code execution via unknown vectors and denial of service. Public advisories (e.g., openSUSE/MFSA entries) indicate fixes are available by upgrading Fi...

CVE-2018-18510

The CVE-2018-18510 entry affects Mozilla Firefox prior to version 64. The issue arises when web content can trigger the internal about:crashcontent and about:crashparent pages, enabling a non-persistent denial-of-service (DoS) against the loaded page or the browser. Affected component: Firefox re...

CVE-2025-4088

A security vulnerability in Mozilla Firefox and the Thunderbird email client allows malicious websites to use redirects to send credentialed requests to arbitrary endpoints. This occurs on any site that has invoked the Storage Access API , enabling potential Cross-Site Request Forgery (CSRF) atta...

CVE-2026-12317

A memory safety bug exists in the Mozilla Firefox and Thunderbird web browser and email client. The vulnerability is caused by operations performing beyond the buffer boundaries in memory. Successful exploitation by a remote attacker can lead to service interruptions (Denial of Service). This iss...

CVE-2026-16398

A site isolation issue exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird. This vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific root cause, exploit details, or impact consequences are provided in the documents beyond the identified site isolat...

CVE-2026-16401

CVE-2026-16401 describes a privilege escalation vulnerability in the Data Loss Prevention component of Mozilla Firefox and Thunderbird . The vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific root cause or exploit details are provided in the documentation.

CVE-2026-92046

A Use-after-free vulnerability exists in the Graphics component of Mozilla Firefox and Thunderbird . The issue affects these applications across various distributions, including openSUSE and SUSE Linux. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbir...

CVE-2026-92074

CVE-2026-92074 involves a mitigation bypass in the Popup Blocker component of the Mozilla Firefox browser and Thunderbird mail client. This vulnerability is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . The provided documents do not specify the underlyin...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2025-3032

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability involving a file descriptor leak from the fork server to web content processes. This flaw could allow an attacker to perform privilege escalation attacks. The issue is present in versions prior to 137...

CVE-2025-9183

Mozilla Firefox is affected by a spoofing issue in the Address Bar component. This vulnerability impacts Firefox versions prior to 142 and Firefox ESR versions prior to 140.2 . The issue was resolved in the mentioned versions. Exploitation details are not provided in the documents.

CVE-2026-2766

CVE-2026-2766 is a use-after-free in the JavaScript Engine: JIT component of Firefox/Firefox ESR that was fixed in Firefox 148, ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products in the provided documents include Firefox-based browsers and Thunderbird; multiple advisories (Astra...

CVE-2026-2779

CVE-2026-2779 covers incorrect boundary conditions in Networking: JAR within Firefox (and Firefox ESR). Public advisories indicate the issue affects Firefox before version 148 and Firefox ESR before 140.8, with Firefox 148/ESR 140.8 and Thunderbird updates mitigating it. The connected Amazon Linu...

CVE-2026-4722

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the IPC component caused by context privilege switching errors. An attacker could exploit this flaw to achieve arbitrary code execution or cause a denial of service (service interruption). The vulnerability ha...

CVE-2026-8947

A use-after-free vulnerability exists in the DOM: Bindings (WebIDL) component of the Firefox browser and the Thunderbird email client. This memory safety issue allows a remote attacker to execute arbitrary code . The vulnerability has been addressed in Firefox 151 , Firefox ESR 115.36 , Firefox E...

CVE-2026-92034

A site isolation issue exists in the Graphics component of Firefox and Thunderbird . This vulnerability is addressed in Firefox 156 and Thunderbird 156 . No specific root cause or exploitation details are provided in the documentation, but the issue has been identified in several distributions an...

CVE-2026-92053

CVE-2026-92053 is a privilege escalation vulnerability affecting the Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird . The flaw allows for elevated privileges, and a fix has been implemented in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No speci...

CVE-2026-92055

The DevTools component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation . This flaw was addressed in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the specific technical root cause is not detailed beyond the compo...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2014-1519

CVE-2014-1519 refers to multiple vulnerabilities in Mozilla Firefox (browser engine) prior to 29.0 and SeaMonkey prior to 2.26. The core issue is memory corruption that can cause a denial of service or possibly allow arbitrary code execution via unknown vectors. The connected documents corroborat...

CVE-2019-11702

Summary of the vulnerability (CVE-2019-11702) : Mozilla Firefox versions prior to 67.0.2 on Windows are affected. A hyperlink using protocols associated with Internet Explorer (e.g., IE.HTTP:) can be used to open local files at a known location in Firefox if the user approves execution when promp...

CVE-2024-31392

A security bypass vulnerability exists in Mozilla Firefox for iOS versions

CVE-2026-100762

A use-after-free vulnerability in the DOM: Content Processes component of Firefox allows for a sandbox escape . This flaw has been addressed in the following versions: Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . Technical details regarding the specific root cau...

CVE-2026-12302

A mitigation bypass exists in the DOM: Security component of Mozilla Firefox and Thunderbird . This vulnerability affects various versions and has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not prov...

CVE-2026-12305

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . This vulnerability specifically affected the Thunderbird application and was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described ...

CVE-2026-12314

A memory safety bug was identified and fixed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause for CVE-2026-12314 is not detailed beyond its classification as a memory safety issue, several connected documents indicate that si...

CVE-2026-12316

A mitigation bypass exists in the DOM: Security component of the Firefox web browser and Thunderbird email client. This vulnerability stems from a lack of adequate data security mechanisms, which could allow a malicious actor to access confidential data and compromise data integrity . The issue h...

CVE-2026-16361

Mozilla Thunderbird and Firefox ESR are affected by memory safety bugs that can lead to memory corruption . If successfully exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed in Thunderbird 140.13 , Firefox ESR 115.38 , and Firefox ESR 1...

CVE-2026-16378

CVE-2026-16378 identifies an issue within the DOM: Copy & Paste and Drag & Drop component . This vulnerability has been addressed in Firefox 153 and Thunderbird 153 . Technical details regarding the specific root cause or impact are not provided in the available documentation.

CVE-2026-16382

CVE-2026-16382 is a mitigation bypass vulnerability in the DOM: Service Workers component. This security issue has been addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or practical consequences are provided in the available documentation.

CVE-2026-2774

CVE-2026-2774 is an integer overflow in the Firefox Audio/Video component. Public sources indicate Firefox/ESR updates (Firefox 148, ESR 115.33, ESR 140.8) fix the flaw; affected products include Firefox and Thunderbird per accompanying advisories. The issue is rated high/critical by CVSS sources...

CVE-2026-4710

CVE-2026-4710 is an Audio/Video boundary-conditions flaw that affects Firefox (including ESR) and Thunderbird. The issue’s root cause is incorrect boundary handling in the Audio/Video component. Public advisories list the impact as high/critical, with CVSS 3.1 base score 9.8 (Impact: Confidential...

CVE-2026-6782

The Firefox web browser and Thunderbird email client are susceptible to an information disclosure vulnerability in the IP Protection component . This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploitat...

CVE-2026-92010

The Mozilla Firefox and Mozilla Thunderbird browsers/mail clients are vulnerable to privilege escalation due to incorrect boundary conditions within the Graphics: CanvasWebGL component. This vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Firefox ESR...

CVE-2026-92037

The Mozilla Firefox and Thunderbird applications are affected by CVE-2026-92037 , which is caused by incorrect boundary conditions in the DOM: Animation component . This vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific exploit details are not provided, the issue has...

CVE-2026-92052

A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component due to uninitialized memory . This issue impacts Mozilla Firefox , Mozilla Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thund...

CVE-2026-92065

Mozilla Firefox and Mozilla Thunderbird are affected by a sandbox escape vulnerability in the Widget: Win32 component. The root cause is identified as incorrect boundary conditions within the component. This issue impacts the security boundary of the browser and mail client's sandbox. Remediation...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2021-4128

The CVE-2021-4128 entry describes a macOS-specific Firefox vulnerability where a graphics object isn’t properly protected when entering/exiting fullscreen, causing memory corruption and a potentially exploitable crash. Affected product: Mozilla Firefox on macOS (Firefox versions earlier than 95)....