CVE-2025-14325

A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of the Mozilla Firefox browser and the Thunderbird email client. The flaw is caused by improper code generation management , which can allow an attacker to achieve remote arbitrary code execution . This vulnerabilit...

CVE-2026-0883

CVE-2026-0883 identifies an information disclosure vulnerability within the Networking component of Mozilla products. This flaw can allow a malicious actor to gain access to confidential data . The vulnerability impacts Firefox (versions prior to 147), Firefox ESR (versions prior to 140.7), Thund...

CVE-2026-100829

A mitigation bypass exists in the DOM: Security component of certain Mozilla products. This vulnerability has been addressed in Firefox ESR 153.4 , Thunderbird 157 , Thunderbird 153.4 , and Firefox 157 . While the vulnerability is confirmed through multiple sources, specific technical details reg...

CVE-2026-4697

CVE-2026-4697 concerns incorrect boundary conditions in the Audio/Video: Web Codecs component. Public advisories list affected products as Firefox (pre-149 and ESR 140.9), and Thunderbird alongside Firefox fixes. The issue is defined as a boundary-condition flaw in the WebCodecs path, with fixed ...

CVE-2026-4712

The CVE covers an information-disclosure vulnerability in the Widget: Cocoa component affecting Firefox before 149 and Firefox ESR before 140.9. Affected product/component: Firefox/Firefox ESR on Cocoa widgets; vulnerability details (root cause, exploitability) are not provided in the supplied do...

CVE-2026-4728

CVE-2026-4728 : A spoofing issue in the Privacy: Anti-Tracking component is documented for Mozilla Firefox and Mozilla Thunderbird. The connected documents consistently state the vulnerability and that it has been fixed in Firefox 149 and Thunderbird 149 . No additional technical details (root ca...

CVE-2025-10529

A same-origin policy bypass exists in the Layout component of Mozilla Firefox , Firefox ESR , and Thunderbird . The vulnerability is caused by the use of an untrusted intermediate policy file , which can allow a remote attacker to execute arbitrary code . Affected versions include Firefox < 14...

CVE-2025-11714

Mozilla Firefox and Thunderbird are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . Affected versions include Firefox ESR 115.28 , Firefox ESR 140.3 , Thunderbird ESR 140.3 , Firefox 143 , ...

CVE-2025-14332

CVE-2025-14332 is a memory-safety bug found in Firefox 145 and Thunderbird 145, with potential for arbitrary code execution. It affects Firefox and Thunderbird versions older than 146. The connected documents indicate remediation by upgrading to Firefox/Thunderbird 146. If upgrading is not possib...

CVE-2025-54144

Mozilla Firefox for iOS versions prior to 141 are vulnerable to a security bypass where the URL scheme used for searching text queries can be exploited. If a user is tricked into clicking a malicious link, an attacker could force the browser to open arbitrary website URLs or internal pages . This...

CVE-2026-4685

Summary: CVE-2026-4685 concerns the Graphics: Canvas2D component with incorrect boundary conditions. Affects Firefox versions below 149, Firefox ESR below 115.34, and Firefox ESR below 140.9. Root cause described as incorrect boundary conditions in the Canvas2D implementation. References include ...

CVE-2026-4700

CVE-2026-4700 affects Firefox and Thunderbird; mitigation bypass in the Networking: HTTP component was fixed in Firefox 149 / ESR 140.9 and Thunderbird 149 / 140.9. The CVSS 3.1 score is 9.8 (CRITICAL) with NETWORK attack vector and no user interaction. Remediation per provided docs: upgrade to F...

CVE-2026-4714

CVE-2026-4714 is an Audio/Video boundary-condition vulnerability present in Mozilla Firefox/Thunderbird stack. The initial entry states impact as high (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CVSS 3.1 base 7.5) with exploitation not described in the sources. Connected advisories confirm the issue af...

CVE-2026-4718

CVE-2026-4718 is an undefined behavior vulnerability in the WebRTC: Signaling component that affects Firefox and Thunderbird products. Public advisories indicate fixes in Firefox 149 and Firefox ESR 140.9, and Thunderbird 149 and Thunderbird 140.9. The connected sources also enumerate broader Moz...

CVE-2026-3847

The Mozilla Firefox browser is affected by memory safety bugs in versions prior to 148.0.2 . Specifically, the CSS analysis and calculation components are susceptible to memory corruption caused by executing operations beyond the buffer boundaries. If successfully exploited, a remote attacker cou...

CVE-2026-4727

CVE-2026-4727 is a denial-of-service vulnerability in the NSS Libraries component used by Firefox and Thunderbird. The issue targets the Libraries code and can cause an outage or service disruption, with Mozilla noting a fix implemented in Firefox 149 and Thunderbird 149. The CVE is linked to mul...

CVE-2009-4130

Mozilla Firefox vulnerability CVE-2009-4130 affects the MakeScriptDialogTitle function in nsGlobalWindow.cpp. A visual truncation flaw allows remote attackers to spoof the origin domain name of a script by providing an excessively long name, enabling spoofing of the script’s perceived origin. Roo...

CVE-2025-13016

Mozilla Firefox and Firefox ESR browsers are vulnerable to a buffer overflow flaw caused by incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability allows a remote attacker to trigger a service failure (application crash) or potentially execute arbitrary code on...

CVE-2025-54145

Mozilla Firefox for iOS versions prior to 141 are vulnerable to a security bypass where the QR scanner can be used to open arbitrary websites. The vulnerability occurs if a user is tricked into scanning a malicious link that leverages Firefox's open-text URL scheme . An attacker could exploit thi...

CVE-2026-100812

A Denial-of-Service vulnerability exists in the Graphics component of Firefox . This flaw allows for an attack that impacts the availability of the application. The issue has been addressed in Firefox ESR 153.4 and Firefox 157 . No specific exploit details or in-the-wild exploitation information ...

CVE-2026-4708

CVE-2026-4708 is an incorrect boundary conditions vulnerability in Mozilla Firefox’s Graphics component (Canvas2D) affecting Firefox < 149 and Firefox ESR

CVE-2025-13022

Mozilla Firefox and the Thunderbird email client are vulnerable to a buffer overflow due to incorrect boundary conditions in the Graphics: WebGPU component. This flaw can lead to an attacker executing arbitrary code on the system, causing an application crash, or compromising the confidentiality,...

CVE-2025-13025

The Graphics: WebGPU component in Mozilla Firefox and Thunderbird versions prior to 145 is affected by incorrect boundary conditions. While the root cause is attributed to these boundary condition errors, related documentation indicates the vulnerability may involve the improper use of standard r...

CVE-2026-4709

CVE-2026-4709 involves Firefox and Thunderbird components, specifically an incorrect boundary condition in the Audio/Video: GMP path. The vulnerability affects Firefox and Thunderbird releases prior to the fixes, with patches noted in Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149 and...

CVE-2026-4724

CVE-2026-4724 affects Mozilla Firefox and Mozilla Thunderbird. The root cause is undefined behavior in the Audio/Video component, leading to potential security bypass or other impacts as described in the connected records. The vulnerability is reported across multiple sources (CNVD EUVD entries) ...

CVE-2026-6781

A Denial-of-Service (DoS) vulnerability exists in the Audio/Video: Playback component of Mozilla Firefox and Mozilla Thunderbird . The root cause is an uncontrolled resource consumption issue within the playback functions, which could allow an attacker to trigger a service failure or service inte...

CVE-2025-13020

A use-after-free vulnerability exists in the WebRTC: Audio/Video component of Mozilla Firefox and Thunderbird . The issue is caused by the reuse of memory after it has been freed, which could allow a remote attacker to cause service interruptions or, in some cases, achieve arbitrary code executio...

CVE-2026-0889

The Mozilla Firefox web browser and Mozilla Thunderbird email client are vulnerable to a Denial-of-Service (DoS) attack. The root cause is an error in the DOM: Service Workers component involving uncontrolled resource consumption . A malicious actor can exploit this flaw to cause the browser to c...

CVE-2026-100760

A sandbox escape vulnerability exists in the Security: Process Sandboxing component of Mozilla products. This flaw allows an attacker to bypass security restrictions, potentially leading to significant impacts including arbitrary code execution , information disclosure , denial of service , and u...

CVE-2026-100817

The JavaScript: WebAssembly component contains an issue affecting Mozilla Thunderbird and Firefox . This vulnerability was addressed in both products starting with version 157 . No specific root cause or exploitation details are provided in the documents. Sighting data confirms the vulnerability ...

CVE-2026-4723

CVE-2026-4723 describes a use-after-free in the JavaScript Engine component affecting Firefox versions older than 149. The connected documents consistently identify the affected area as the JavaScript engine and indicate the vulnerability is limited to Firefox

CVE-2026-5732

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by an integer overflow and incorrect boundary conditions within the Graphics: Text component. This vulnerability could potentially allow an attacker to execute arbitrary code remotely . Impacted versions include Firefox < 149.0.2, Fi...

CVE-2026-5735

CVE-2026-5735 affects Mozilla Firefox and Thunderbird 149.0.1, with memory safety bugs that can cause memory corruption and, per sources, could be exploited to run arbitrary code. Affected components are within Firefox/Thunderbird rendering and memory management; the issue has been fixed in Firef...

CVE-2007-3827

Mozilla Firefox is affected by CVE-2007-3827: cookies can be set with a null domain (domainless cookies), enabling information to pass between arbitrary domains and potential user tracking via document.cookie in javascript:. window. The vulnerability stems from how cookies are handled with a null...

CVE-2025-11713

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a code execution flaw due to insufficient escaping in the "Copy as cURL" feature. On Windows , this issue could trick users into executing unexpected code. The vulnerability is mitigated by updating to Firefox...

CVE-2026-4717

CVE-2026-4717: Privilege escalation in the Netmonitor component. According to the provided advisories, Firefox and Firefox ESR are affected and the issue is fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability originated in the Netmonitor component an...

CVE-2026-6756

The Firefox for Android browser is affected by a mitigation bypass vulnerability. This issue has been addressed in Firefox version 150 . For users on Fedora distributions (42, 43, and 44), it is recommended to update to Firefox 150.0 and NSS to 3.122.1 to remediate this and related vulnerabilitie...

CVE-2026-92021

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox browser and Thunderbird mail client. This flaw was addressed in Firefox ESR 140.16 and Thunderbird 140.16 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CVE-2011-3656

CVE-2011-3656 affects Mozilla Firefox up to version 3.6.24 and 4.x through 7, with a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via HTTP 0.9 error handling, non-default ports, and content-sniffing. The provided documents consistently describe t...

CVE-2025-11718

CVE-2025-11718 affects Mozilla Firefox versions earlier than 144. The issue allows a malicious page to spoof the address bar by creating a fake bar in response to a visibilitychange event when the Android address bar is hidden after scrolling. Impact is spoofing UI and potential user deception; n...

CVE-2025-13026

A sandbox escape vulnerability exists in the Graphics: WebGPU component of the Mozilla Firefox browser and Thunderbird mail client. The root cause is incorrect boundary conditions and the improper handling of exceptional states . This flaw allows an attacker to bypass sandboxing protection mechan...

CVE-2025-55031

This vulnerability affects Firefox for iOS and Focus for iOS versions prior to 142 . Malicious pages can exploit the browser to pass FIDO: links to the OS, triggering the hybrid passkey transport . An attacker within Bluetooth range could leverage this to trick a user into using their passkey to ...

CVE-2026-5733

A buffer overflow vulnerability exists in the Graphics:WebGPU component of Mozilla Firefox and Mozilla Thunderbird . The flaw is caused by incorrect boundary conditions , which may allow a remote attacker to execute arbitrary code or cause the application to crash by performing operations beyond ...

CVE-2025-14744

The Firefox for iOS browser is vulnerable to a security flaw in its Downloads component due to the improper handling of Unicode RTLO (Right-to-Left Override) characters. This allows malicious websites to perform filename spoofing within the downloads UI, which could trick users into saving files ...

CVE-2025-9186

A spoofing issue exists in the Address Bar component of Firefox Focus for Android . This vulnerability allows for the misrepresentation of critical information to the user. The issue was addressed in Firefox 142 . Exploitation details are not provided in the documents.

CVE-2025-13023

The Mozilla Firefox web browser and Thunderbird email client are vulnerable to a sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. In some cases, this is also attributed to the improper handling of exceptional states within the WebGPU API interface. Successful...

CVE-2025-55030

Mozilla Firefox for iOS versions prior to 142 are vulnerable to a Cross-Site Scripting (XSS) vulnerability. The root cause is the improper handling of the Content-Disposition header ; specifically, the browser fails to respect the Attachment type, causing content to be displayed inline rather tha...

CVE-2026-100758

A sandbox escape vulnerability exists in the DOM: Navigation component affecting multiple versions of Firefox and Thunderbird . The flaw allows an attacker to escape the sandbox, with potential impacts involving high confidentiality, integrity, and availability. Remediation is available in Firefo...

CVE-2026-100763

Mozilla Firefox and Thunderbird versions earlier than 157 are vulnerable to a heap buffer overflow due to incorrect boundary conditions in the Graphics: WebGPU component. An attacker could exploit this by inducing a user to open an email with a size of 2GB or greater. This vulnerability can lead ...

CVE-2026-100788

A critical invalid pointer vulnerability exists in the JavaScript: WebAssembly component of several Mozilla products, including Firefox , Firefox ESR , and Thunderbird . Exploitation of this flaw can lead to remote code execution (ACE) , denial of service (DoS) , information disclosure (OSI) , an...