CVE-2025-23109

The Mozilla Firefox browser for iOS is affected by a vulnerability where long hostnames in URLs can be leveraged to obscure the actual host of a website or spoof the website address . Specifically, opening JavaScript links in a new tab via long-press in the Firefox iOS client could allow a malici...

CVE-2026-16397

CVE-2026-16397 is a clickjacking vulnerability affecting the WebExtensions component in Firefox for Android . The issue was addressed in Firefox 153 . While the specific root cause is not detailed in the provided documents, this vulnerability was part of the MFSA 2026-68 security fixes. Exploitat...

CVE-2026-16402

A vulnerability exists in the Graphics: ImageLib component due to an integer overflow . This issue has been addressed in Firefox 153 and Thunderbird 153 . Technical details regarding the specific root cause or impact are not provided in the documents beyond the component name and the overflow typ...

CVE-2026-8956

An integer overflow vulnerability exists in the Networking: JAR component of the Firefox web browser and the Thunderbird email client. Exploiting this numerical overflow condition can allow a remote attacker to cause service interruptions . The vulnerability has been addressed in Firefox 151 , Fi...

CVE-2026-92024

Mozilla Firefox and Thunderbird are affected by a use-after-free vulnerability in the SVG component (CVE-2026-92024). This flaw can potentially impact the security of the browser and mail client. The vulnerability has been addressed in the following versions: Firefox 156 , Firefox ESR 115.41 , Fi...

CVE-2026-92028

A Use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . While ...

CVE-2026-92060

A use-after-free vulnerability exists in the Internationalization component of Mozilla Firefox and Thunderbird . The issue has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Specific details regarding exploitation vectors or impacts are not provided ...

CVE-2021-43531

CVE-2021-43531 affects Firefox prior to version 94. The issue arises when a Web Extension loads a context menu and could access the post-redirect URL of the clicked element if it lacked WebRequest permissions for the involved hosts, causing a same-origin-violation that leaks data the extension wo...

CVE-2025-10536

An information disclosure vulnerability exists in the Networking: Cache component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is an error within the cache component that could allow an attacker to obtain sensitive information. This vulnerability affects...

CVE-2026-16399

CVE-2026-16399 describes a site isolation issue within the DOM: Navigation component . This vulnerability was addressed in Firefox 153 and Thunderbird 153 . While the vulnerability is confirmed in the provided documentation, specific details regarding the root cause or practical exploit vectors a...

CVE-2026-2792

CVE-2026-2792 involves memory safety bugs found in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some flaws showed memory corruption indicators and could potentially be exploited to run arbitrary code; Mozilla fixed these in Firefox 148, Firefox ESR 140.8, Thunderbird...

CVE-2026-92032

A sandbox escape vulnerability exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird due to an invalid pointer . This flaw allows for the execution of arbitrary code. Impacted versions include Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 1...

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2017-7759

Firefox for Android prior to version 54 is affected by CVE-2017-7759, where Android intent URLs can cause navigation from HTTP/HTTPS to local file: URLs, potentially exposing local data due to a same-origin policy violation. The issue is fixed in Firefox 54 (as noted in mfsa2017-15). Affected pro...

CVE-2025-8044

Mozilla Firefox and Thunderbird (specifically versions 140 and Firefox ESR ) are affected by memory safety bugs. These vulnerabilities stem from memory corruption issues where operations are executed outside of the buffer in memory. A malicious actor could exploit these flaws to cause service int...

CVE-2026-10701

The Firefox web browser is affected by a vulnerability caused by incorrect boundary conditions within the Graphics: Text component. This flaw allows for the execution of operations beyond the buffer boundaries in memory, which could enable an attacker to gain access to confidential data . The vul...

CVE-2026-6757

The JavaScript: WebAssembly component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client contains an invalid pointer vulnerability. This flaw relates to an uninitialized pointer , which a malicious actor could exploit to trigger a service failure or service interruptions. The vul...

CVE-2026-8958

A vulnerability in the Security: Process Sandboxing component of Firefox and Thunderbird allows for information disclosure and a sandbox escape . Exploiting this flaw can permit a remote attacker to access confidential data . The issue was addressed in Firefox 151 , Firefox ESR 140.11 , Thunderbi...

CVE-2026-92049

A use-after-free vulnerability exists in the Widget: Win32 component of Mozilla products. This issue impacts Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . Documentation con...

CVE-2026-92066

A sandbox escape vulnerability exists in the Profile Backup component of Firefox and Thunderbird . The vulnerability was addressed in Firefox 156 and Thunderbird 156 . While specific root cause technical details are not provided in the documents, the impact involves a potential escape from the ap...

CVE-2026-92067

A use-after-free vulnerability exists in the Widget: Gtk component of Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . This flaw was addressed in Firefox versions 156 and 153.3 (ESR), and Thunderbird versions 156 and 153.3 (ESR). Exploitation details are not provided in the doc...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2014-1478

This CVE (CVE-2014-1478) affects Mozilla Firefox before 27.0 and SeaMonkey before 2.24. The issue involves memory corruption in the browser engine (MPostWriteBarrier in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey) and may allow remote code execution or cause a crash...

CVE-2016-9065

CVE-2016-9065 affects Firefox for Android and is a UI spoofing flaw where the location bar can be spoofed by forcing fullscreen mode, blocking exit, and displaying a fake address bar without user notification. The issue is limited to Firefox for Android; other OSes are not affected, and the vulne...

CVE-2025-10527

A sandbox escape vulnerability exists in the Graphics: Canvas2D component of Mozilla products due to a use-after-free condition. This flaw could allow an attacker to execute arbitrary code remotely or cause a denial of service. The vulnerability affects Firefox versions earlier than 143, Firefox ...

CVE-2025-10533

An integer overflow vulnerability exists in the SVG component of Mozilla Firefox , Firefox ESR , and Thunderbird . This flaw allows an attacker to potentially achieve remote code execution or cause a denial of service on the affected system. The vulnerability has been addressed in Firefox 143 , F...

CVE-2026-0884

A use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox , Firefox ESR , and Thunderbird . An attacker could exploit this flaw to execute arbitrary code on a system or cause service interruptions . The issue was resolved in Firefox 147 , Firefox ESR 140.7 , Thun...

CVE-2026-100781

A sandbox escape vulnerability exists in the Graphics: WebRender component due to incorrect boundary conditions . This issue affects multiple Mozilla products, including Firefox ESR 115.42 , Firefox ESR 140.17 , Firefox 157 , Thunderbird 140.17 , Thunderbird 153.4 , and Thunderbird 157 . The vuln...

CVE-2026-100787

A sandbox escape vulnerability exists in the XUL component affecting Mozilla Firefox and Thunderbird . The flaw allows for a sandbox escape, and the issue has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the...

CVE-2026-12320

An information disclosure vulnerability exists in the Password Manager component of the Firefox and Thunderbird web browsers. This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 152 and Thunderbird 152 . Exploitation details are not...

CVE-2026-2760

CVE-2026-2760 is a Firefox/Thunderbird Firefox Graphics: WebRender sandbox escape caused by incorrect boundary conditions. Multiple public advisories confirm the issue and that it is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected comp...

CVE-2026-6774

A mitigation bypass exists in the DOM: Security component of Mozilla Firefox and Mozilla Thunderbird browsers/clients. The root cause is related to a flaw in data protection mechanisms , which could allow an attacker to bypass existing security restrictions remotely. This vulnerability was addres...

CVE-2026-8957

A privilege escalation vulnerability exists in the Enterprise Policies component of Mozilla Firefox and Thunderbird . In the case of Firefox, this issue affects versions prior to 151 and ESR 140.11 . For Thunderbird, it affects versions prior to 151 and 140.11 . One report indicates that exploiti...

CVE-2026-8970

A privilege escalation vulnerability exists in the Security component of the Firefox web browser and the Thunderbird email client. This vulnerability is related to the insecure management of privileges and could allow a malicious actor to cause service interruptions . The issue has been addressed...

CVE-2026-92013

Mozilla Firefox and Thunderbird are vulnerable to privilege escalation due to incorrect boundary conditions within the Graphics: CanvasWebGL component. This flaw impacts multiple versions of the software, including Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, and corres...

CVE-2026-92056

A use-after-free vulnerability exists in the Graphics: Text component of Mozilla Firefox and Thunderbird . The flaw was addressed in Firefox versions 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . No specific exploit details are provided in the documentation.

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2017-5409

The CVE-2017-5409 issue affects Mozilla Firefox on Windows (Firefox ESR <45.8 and Firefox

CVE-2025-4086

This vulnerability affects Thunderbird for Android and versions of Firefox prior to 138 . A specially crafted filename containing a large number of encoded newline characters can obscure the file's extension when displayed in the download dialog. The issue was resolved in Firefox 138 and Thunderb...

CVE-2025-5271

Mozilla Firefox and the Thunderbird email client are affected by a vulnerability in the DevTools suite. The issue stems from a lack of mechanisms for encoding or blocking output data, which causes the previewing function to ignore Content Security Policy (CSP) headers. This oversight could allow ...

CVE-2026-12322

The Firefox web browser and Thunderbird email client are affected by a clickjacking vulnerability in the Widget: Gtk component. The issue stems from an incorrect limitation on the visible layers of the user interface, which could allow an attacker to cause service failures . This vulnerability ha...

CVE-2026-16376

CVE-2026-16376 describes a Denial-of-Service (DoS) vulnerability in the Graphics: WebGPU component. This flaw was addressed in Firefox 153 and Thunderbird 153 . While the technical root cause is not detailed in the provided documents, the vulnerability is associated with CWE-400 (Uncontrolled Res...

CVE-2026-8975

Memory safety bugs exist in Firefox ESR 115.35 , Firefox ESR 140.10 , and Firefox 150 , as well as Thunderbird 140.10 and Thunderbird 150 . These vulnerabilities involve memory corruption , which could potentially be exploited by an attacker with sufficient effort to execute arbitrary code . The ...

CVE-2026-92027

A use-after-free vulnerability exists in the DOM: Streams component of Mozilla Firefox and Thunderbird . The flaw allows for potential memory corruption or instability. This issue has been addressed in Firefox versions 156, ESR 115.41, ESR 140.16, and ESR 153.3, as well as Thunderbird versions 15...

CVE-2026-92044

CVE-2026-92044 involves information disclosure in the Networking: HTTP component of Mozilla products. The vulnerability has been addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While technical details regarding the specific root cause are not provided in t...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2021-4221

CVE-2021-4221 : Affects Firefox for Android. If a domain name contains a RTL (Right-to-Left) character, the domain could render to the right of the path, enabling user confusion and spoofing. The vulnerability is limited to Firefox for Android; other OSes are unaffected. The advisory notes Firefo...

CVE-2025-27426

Firefox for iOS versions prior to 136 are vulnerable to an input validation error where malicious websites can utilize a server-side redirect to an internal error page. This flaw allows for a spoofed website URL , potentially leading to phishing or deceptive content. The issue was addressed in Fi...