CVE-2026-4706

CVE-2026-4706: In Graphics: Canvas2D, a boundary-condition issue could affect Firefox/Thunderbird before certain releases. Public advisories indicate fixes in Firefox 149, ESR 115.34 and ESR 140.9, and Thunderbird 149 and 140.9. Upgrading to these versions (or later) is the advised remediation pe...

CVE-2011-2669

CVE-2011-2669 affects Mozilla Firefox prior to 3.6 due to an issue in certificate validation that can trigger a denial-of-service. Connected sources (e.g., JVN entries) confirm the vulnerability stems from how certificates are validated, with impact described as DoS when loading HTTPS sites with ...

CVE-2025-10535

The Mozilla Firefox browser for Android contains an information disclosure and mitigation bypass vulnerability in its Privacy component . The root cause is related to the insufficient protection of sensitive data , which could allow a remote attacker to bypass security restrictions and obtain sen...

CVE-2025-11153

The Mozilla Firefox web browser is susceptible to a JIT miscompilation vulnerability within the JavaScript Engine: JIT component . This flaw stems from insufficient validation of input data , which can be exploited by a remote attacker to achieve arbitrary code execution on the target system. Thi...

CVE-2025-13015

Mozilla Firefox and Firefox ESR are affected by a spoofing vulnerability caused by errors in the user interface's information representation. This flaw allows a remote attacker to conduct spear-phishing attacks . The issue impacts versions of Firefox prior to 145 , Firefox ESR prior to 140.5 , an...

CVE-2026-0890

A spoofing issue exists in the DOM: Copy & Paste and Drag & Drop components of Mozilla Firefox and Mozilla Thunderbird . This vulnerability allows attackers to carry out deceptive attacks by exploiting errors in these specific components. Affected versions include Firefox < 147 , Firefox ESR &...

CVE-2026-100768

A use-after-free vulnerability exists in the Graphics: WebGPU component of the Firefox browser. This issue was addressed and fixed in Firefox 157 . The vulnerability was reported by Yaqoub Aldurayhim and is associated with Bugzilla report Bug 2064832 . No specific exploitation details or direct l...

CVE-2026-100828

A mitigation bypass exists in the Bookmarks & History component of various Mozilla products. The vulnerability affects Firefox , Firefox ESR , and Thunderbird . Impacting functionality can include a protection mechanism failure (CWE-692 ). Remediation is available as the issue has been fixed in F...

CVE-2026-4711

CVE-2026-4711 describes a use-after-free in the Cocoa-based Widget component affecting Mozilla Firefox before 149 and Firefox ESR before 140.9. The available sources consistently state the vulnerability type and affected versions but do not provide payload details, implicated files, root cause be...

CVE-2026-4720

Memory safety bugs exist in Mozilla Firefox and Thunderbird (specifically versions Firefox ESR 140.8 , Thunderbird ESR 140.8 , Firefox 148 , and Thunderbird 148 ). These vulnerabilities involve memory corruption that could potentially be exploited with significant effort to achieve arbitrary code...

CVE-2026-8951

A spoofing issue exists in the Toolbar component of Mozilla Firefox for Android (versions prior to 151.0). This vulnerability allows an attacker to spoof the user interface , potentially misleading the user into performing inaccurate actions. The issue was addressed in Firefox 151 . Exploitation ...

CVE-2007-2176

CVE-2007-2176 affects Mozilla Firefox with an unspecified vulnerability involving Javascript errors that allows remote code execution. The NVD entry reports a CVSS v2 base score of 10.0 (High) with network attack vector and near-total impact (Confidentiality, Integrity, Availability). The descrip...

CVE-2025-14860

A use-after-free vulnerability exists in the Disability Access APIs component of Mozilla Firefox . This flaw allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information. The vulnerability affects versions prior to 146.0.1 . Remediation is avai...

CVE-2026-2032

Mozilla Firefox for iOS is vulnerable to a security flaw where malicious scripts that interrupt new tab page loading cause a desynchronization between the address bar and the page content. This allows an attacker to spoof arbitrary HTML under a trusted domain. The vulnerability affects versions p...

CVE-2007-1970

CVE-2007-1970 involves Mozilla Firefox where dynamic HTTP elements created on HTTPS pages via a delayed document.write can mislead users and enable phishing content to be served from unauthenticated sources. The vulnerability is described with a moderate base score (CVSS v2.0 base 5.0) and relate...

CVE-2026-100832

Firefox is affected by a use-after-free vulnerability in the Graphics: Canvas2D component. This flaw was addressed in Firefox ESR 153.4 , Firefox ESR 115.42 , and Firefox ESR 140.17 . The vulnerability is associated with Bug 2072467 and is categorized as having high impact by the reporter. No spe...

CVE-2007-4013

CVE-2007-4013 covers multiple unspecified vulnerabilities in Net6Helper.DLL (Net6Launcher Class, 4.5.2 and earlier) and in npCtxCAO.dll (Citrix Endpoint Analysis Client) in a Firefox plugin directory, plus a second npCtxCAO.dll (CAAOControl Object) in Citrix Access Gateway Standard Edition before...

CVE-2020-15651

The CVE-2020-15651 issue affects Firefox for iOS prior to 28. A Unicode RTL order character in the downloaded file name can be used in the download UI flow to rename the file and change its extension. Connected sources confirm the vulnerability and indicate Mozilla fixed it in Firefox iOS 28 (MFS...

CVE-2025-10859

An information disclosure vulnerability exists in Mozilla Firefox for iOS due to the incorrect sharing of cookie storage for non-HTML temporary documents with normal browsing content. This flaw allows sensitive information from private tabs to escape Incognito mode , persisting even after the use...

CVE-2025-11710

A compromised web process could use malicious IPC messages to cause the privileged browser process to reveal blocks of its memory. This vulnerability affects Firefox versions earlier than 144, Firefox ESR earlier than 115.29 and 140.4, and Thunderbird versions earlier than 144 and 140.4. Remediat...

CVE-2025-11716

Mozilla Firefox and Mozilla Thunderbird versions prior to 144.0 are vulnerable to a security bypass where links in a sandboxed iframe can open external apps on Android without the required "allow-" permission. This flaw allows attackers to bypass security restrictions. Remediation involves updati...

CVE-2025-13018

Mozilla Firefox and Thunderbird are affected by a mitigation bypass in the DOM: Security component. This vulnerability allows attackers to circumvent existing security restrictions remotely due to flaws in data protection mechanisms. The issue impacts Firefox versions prior to 145, Firefox ESR ve...

CVE-2025-14329

The Netmonitor component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a privilege escalation flaw due to insecure management of privileges. An attacker could exploit this vulnerability to remotely enhance their privileges. This issue is fixed in Firefox 146 , Firefox ESR 14...

CVE-2025-14330

CVE-2025-14330 describes a JIT miscompilation bug in the JavaScript Engine's JIT component. Affected: Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, Thunderbird ESR

CVE-2025-54143

A security bypass vulnerability exists in Mozilla Firefox for iOS prior to version 141 . The flaw resides in the sandboxed iframe technology, where a sandboxed iframe could potentially allow downloads to the device by bypassing the sandbox restrictions declared on the parent page. Exploitation al...

CVE-2026-0891

Mozilla Firefox and Thunderbird products are affected by memory safety bugs that can lead to memory corruption. If exploited, these vulnerabilities could allow an attacker to execute arbitrary code on the system. This issue impacts Firefox ESR 140.6 , Thunderbird ESR 140.6 , Firefox 146 , and Thu...

CVE-2026-2772

CVE-2026-2772 is a Firefox/Thunderbird memory-safety issue described as a use-after-free in the Audio/Video: Playback component. The vulnerability affects Firefox-related products and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Connecte...

CVE-2026-4687

A sandbox escape vulnerability exists in the Telemetry component of Mozilla products due to incorrect boundary conditions . This flaw allows a malicious actor to break out of the sandbox, potentially leading to service failure or other unintended consequences. The vulnerability affects Firefox (v...

CVE-2026-4707

CVE-2026-4707 is a vulnerability in the Graphics: Canvas2D component caused by incorrect boundary conditions. It affects Firefox (pre-149), Firefox ESR (pre-115.34 and pre-140.9) and is also listed similarly in related advisories. The issue is fixed in Firefox 149 and Firefox ESR 115.34/140.9. If...

CVE-2026-4715

CVE-2026-4715 involves uninitialized memory in the Graphics: Canvas2D component. Affected products are Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 140.9. The connected records (NVD and CVE/CVE List entries) confirm the vulnerability and its scope but do not provide deta...

CVE-2026-4725

CVE-2026-4725 describes a sandbox escape due to a use-after-free in the Graphics: Canvas2D component, affecting Firefox versions older than 149. The vulnerability impact is described in public CVE records; no exploitation details are provided in the connected documents. Affected software: Firefox...

CVE-2026-4726

CVE-2026-4726 is a denial-of-service vulnerability in the XML component of Mozilla’s Firefox and Thunderbird. The root cause is an error in the XML parser that can be triggered remotely to exhaust resources. Affected products: Firefox and Thunderbird before version 149. Impact: Denial of service ...

CVE-2026-92070

CVE-2026-92070 involves an information disclosure vulnerability in the Networking component of Mozilla products. The issue is addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the exact root cause is not specified in the provided documents, other repor...

CVE-2013-5594

CVE-2013-5594 affects Mozilla Firefox prior to version 25. The issue allows modification of anonymous content in the binding of pluginProblem.xml, indicating an integrity-related vulnerability with no confidentiality or availability impact stated in the provided documents; exploitation details ar...

CVE-2017-7770

CVE-2017-7770 describes a spoofing vulnerability in Firefox for Android: when a new tab is loaded via JavaScript events and fullscreen is entered, the address bar may not be rendered, allowing a malicious site to spoof the displayed URL. Affected: Firefox for Android, Firefox

CVE-2025-13021

Mozilla Firefox and the Thunderbird email client are affected by a buffer overflow vulnerability in the Graphics: WebGPU component. The root cause is an incorrect boundary condition and incorrect handling of exceptional states. An attacker can exploit this vulnerability to execute arbitrary code ...

CVE-2025-14323

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability in the DOM: Notifications component. The root cause involves the execution of operations outside the buffer while processing DOM objects, which could allow an attacker to increase their privileges remotely. Affec...

CVE-2025-14328

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by a privilege escalation vulnerability in the Netmonitor component. The root cause is attributed to the insecure management of privileges, which could allow an attacker to enhance their privileges remotely. This issue ...

CVE-2025-55029

The Mozilla Firefox for iOS browser is vulnerable to a flaw where malicious scripts can bypass the popup blocker to spam new tabs. This behavior can lead to denial of service (DoS) attacks by preventing user interaction. The vulnerability affects versions prior to 142 . This issue has been resolv...

CVE-2025-8364

Mozilla Firefox for Android versions prior to 141 are vulnerable to a flaw where a crafted URL using a blob: URI can hide the true origin of a page. This allows an attacker to perform a spoofing attack by falsely representing information to the user interface. The issue is specific to the Android...

CVE-2026-0882

A use-after-free vulnerability exists in the IPC component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . Exploiting this flaw could allow an attacker to execute arbitrary code on a system or interfere with the confidentiality, integrity, and accessibility of protected i...

CVE-2026-100809

A Same-origin policy bypass exists in the DevTools component of the Mozilla Firefox web browser and Mozilla Thunderbird mail client. This vulnerability is fixed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . Exploitation details are not provided in the documents. P...

CVE-2026-4693

CVE-2026-4693: Affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR

CVE-2025-10530

A spoofing vulnerability exists in the WebAuthn component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an error in the authentication process, specifically the incorrect display of the domain name in the address bar. This allows a remote attacker to perform spear-phishing attack...

CVE-2025-10534

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a spoofing vulnerability in the Site Permissions component. The root cause is related to a lack of measures to protect the structure of web pages, which can be exploited by a malicious actor to perform cross-site scr...

CVE-2025-11152

Mozilla Firefox versions prior to 143.0.3 are vulnerable to a sandbox escape caused by an integer overflow in the Graphics:Canvas2D component. This vulnerability is also described as a security bypass related to deficiencies in access control within isolated environments, potentially allowing a m...

CVE-2025-55028

Mozilla Firefox for iOS is affected by a denial of service vulnerability prior to version 142 . Malicious scripts utilizing repetitive JavaScript alerts can prevent client user interaction in certain scenarios, potentially leading to a service failure. This issue was addressed in version 142 . Ex...

CVE-2026-0881

A sandbox escape vulnerability exists in the Messaging System component of Mozilla Firefox and the Thunderbird email client. The flaw originates from a weakness in data protection mechanisms , which could allow an attacker to bypass security restrictions and execute arbitrary code remotely . This...

CVE-2026-100779

Firefox is impacted by a use-after-free vulnerability in the XSLT component . This flaw was addressed in several versions, including Firefox ESR 153.4 , Firefox 157 , Firefox ESR 115.42 , and Firefox ESR 140.17 . No specific exploit details or direct links to exploitation are provided in the docu...

CVE-2026-4699

CVE-2026-4699: Incorrect boundary conditions in Firefox/Thunderbird Layout: Text and Fonts. Affected products include Firefox (pre-149, ESR 115.34/140.9) and Thunderbird (pre-149/140.9). A fix is available in Firefox 149, ESR 115.34, 140.9 and Thunderbird 149, 140.9. Upgrade to the patched releas...