CVE-2024-5698

CVE-2024-5698 affects Mozilla Firefox prior to version 127, where manipulating the fullscreen feature when opening a data-list could overlay a text box on the address bar, enabling user confusion and potential spoofing. The issue is confirmed across multiple sources (Mozilla advisories and vendor...

CVE-2020-26965

CVE-2020-26965 is a browser/password-input issue affecting Firefox (including ESR) versions older than 83/78.5 and Thunderbird older than 78.5. The problem arises when a user’s password is revealed via a “Show Password” control, and, in conjunction with a software keyboard that remembers input, t...

CVE-2024-11692

A flaw in Mozilla products allows an attacker to cause a select dropdown to be displayed over another tab. This issue could result in user confusion and potential spoofing attacks . The vulnerability affects Firefox versions prior to 133, Firefox ESR prior to 128.5, Thunderbird versions prior to ...

CVE-2024-5687

This vulnerability affects Firefox for Android versions earlier than 127 . The root cause is the incorrect processing of the Principal object when opening a new tab. This error can lead to the calculation of incorrect values for various headers, including Referer and Sec- * headers, potentially r...

CVE-2024-6603

The Firefox browser and Thunderbird email client are vulnerable to a memory corruption flaw during thread creation. The issue arises in out-of-memory scenarios where an allocation might fail, yet the application attempts to call free on the resulting pointer. This vulnerability affects Firefox ve...

CVE-2024-9401

Memory safety bugs in Firefox and Thunderbird may lead to memory corruption . With sufficient effort, these flaws could be exploited to achieve arbitrary code execution . The vulnerability affects Firefox < 131 , Firefox ESR < 128.3 , Firefox ESR < 115.16 , Thunderbird < 128.3 , and T...

CVE-2024-5692

Mozilla Firefox (versions < 127), Firefox ESR (versions < 115.12), and Thunderbird (versions

CVE-2024-6611

A nested iframe that triggers a cross-site navigation can cause SameSite=Strict or Lax cookies to be sent, potentially impacting security boundaries. This vulnerability affects Firefox versions prior to 128 and Thunderbird versions prior to 128 . No information regarding a specific remediation or...

CVE-2024-6614

This vulnerability affects Firefox < 128 and Thunderbird

CVE-2025-1016

CVE-2025-1016 corresponds to memory-safety bugs in Firefox 134/Thunderbird 134 (and ESR lines) that could allow arbitrary code execution. Affected: Firefox <135, Firefox ESR <115.20/128.7, Thunderbird

CVE-2019-9788

CVE-2019-9788 affects Mozilla Thunderbird and Firefox components via memory-safety bugs that could allow arbitrary code execution. The provided documents identify memory-corruption opportunities in Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox

CVE-2021-29985

CVE-2021-29985 is a use-after-free in media channels causing memory corruption, affecting Thunderbird (versions < 78.13 and < 91), Firefox ESR (<78.13) and Firefox (

CVE-2024-4768

A bug in the interaction between popup notifications and WebAuthn allows attackers to trick users into granting permissions. This vulnerability impacts Firefox < 126 , Firefox ESR < 115.11 , and Thunderbird

CVE-2024-6607

This vulnerability affects Firefox < 128 and Thunderbird < 128 . It allows an attacker to prevent a user from exiting pointerlock by pressing the escape key and to overlay customValidity notifications from a element over certain permission prompts. This could be used to confuse users into ...

CVE-2025-1011

A bug in WebAssembly code generation could lead to a crash in Mozilla Firefox , Firefox ESR , and Thunderbird (including Thunderbird ESR ). Attackers might leverage this vulnerability to achieve code execution . The issue has been addressed in Firefox 135 , Firefox ESR 128.7 , Thunderbird 128.7 ,...

CVE-2025-1014

CVE-2025-1014 describes that a certificate length check was not properly performed when adding certificates to a store, leading to exposure where processing could rely on untrusted data. The initial entry lists affected products as Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7,...

CVE-2021-23953

CVE-2021-23953 concerns an information-disclosure vulnerability in the PDF handling of Mozilla Firefox (before 85.0) and Thunderbird (before 78.7), plus Firefox ESR before 78.7. The issue arises when a user opens a specially crafted PDF, which could leak cross-origin data served as chunked data. ...

CVE-2024-6609

The CVE-2024-6609 entry concerns NSS memory management: when memory is nearly exhausted, an elliptic curve key that was never allocated could be freed again, potentially enabling memory corruption or related instability. Affected products cited in connected docs include Mozilla Firefox and Mozill...

CVE-2025-0239

The ALPN (Application-Layer Protocol Negotiation) component in Mozilla Firefox , Firefox ESR , and Thunderbird (including Thunderbird ESR ) is vulnerable to an Alt-Svc certificate validation failure. When a server redirects to an insecure site, the component fails to properly validate certificate...

CVE-2025-0240

A compartment mismatch occurs when parsing a JavaScript module as JSON , potentially leading to cross-compartment access and a use-after-free vulnerability. This affects Mozilla Firefox (versions prior to 134 and ESR 128.6) and Thunderbird (versions prior to 134 and 128.6). Exploitation of this v...

CVE-2025-1012

A race condition during concurrent delazification in Mozilla Firefox and Thunderbird could lead to a use-after-free vulnerability. This issue affects Firefox < 135 , Firefox ESR < 115.20 , Firefox ESR < 128.7 , Thunderbird < 128.7 , and Thunderbird

CVE-2024-5699

This vulnerability affects Firefox versions prior to 127 . It is caused by a violation of specifications where cookie prefixes, such as __Secure, were ignored if they were not correctly capitalized. According to the specification, these prefixes should be checked using a case-insensitive comparis...

CVE-2019-11692

CVE-2019-11692 is a use-after-free in the event listener manager that can occur when listeners are removed while still in use, causing a crash in Thunderbird <=60.6.x/60.7.0, Firefox <=66-67 (and ESR

CVE-2021-29988

The CVE-2021-29988 issue is a memory safety vulnerability in Mozilla code where Firefox incorrectly treated an inline list-item as a block element, leading to an out-of-bounds read or memory corruption and a potentially exploitable crash. Affected products and versions: Thunderbird < 78.13 and...

CVE-2021-43537

CVE-2021-43537: An incorrect type conversion of sizes from 64-bit to 32-bit integers causes a heap buffer overflow during structured cloning, leading to memory corruption and potentially exploitable crashes. Affected: Firefox before 95 and Thunderbird before 91.4.0. Remediation: upgrade to Firefo...

CVE-2019-11730

CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...

CVE-2024-11698

A flaw in handling fullscreen transitions can cause the application to become stuck in fullscreen mode when a modal dialog is opened during the transition. This issue specifically affects macOS and results in a disrupted browsing experience where users cannot exit fullscreen via standard actions ...

CVE-2024-8383

CVE-2024-8383 affects Mozilla Firefox and Firefox ESR. The issue arises when Firefox asks the OS to handle a scheme the browser doesn’t support and doesn’t prompt for confirmation for Usenet-related schemes (news: and snews:). This could allow a malicious webpage or downloaded application to regi...

CVE-2025-1018

The Mozilla Firefox browser and Thunderbird email client are affected by a vulnerability where the fullscreen notification is prematurely hidden when a user quickly re-requests fullscreen. This flaw, related to improper restrictions on user interface layers or frames, could be exploited by a remo...

CVE-2024-11696

This vulnerability affects Firefox versions < 133 , Firefox ESR < 128.5 , Thunderbird < 133 , and Thunderbird

CVE-2019-11698

CVE-2019-11698 concerns theft of browser history via drag-and-drop of crafted hyperlinks to bookmarks that are dragged into web content. Public documents confirm affected products and versions: Thunderbird < 60.7, Firefox < 67, and Firefox ESR

CVE-2021-29986

CVE-2021-29986 describes a race condition in getaddrinfo that can cause memory corruption and a potentially exploitable crash on Linux. Affected products include Thunderbird and Firefox variants: Thunderbird < 78.13 and < 91, Firefox ESR < 78.13, and Firefox

CVE-2024-11693

This vulnerability affects Firefox versions prior to 133, Firefox ESR prior to 128.5, Thunderbird versions prior to 133, and Thunderbird prior to 128.5. The issue is specifically restricted to Windows operating systems , where the executable file warning is not presented during the download of .l...

CVE-2021-29984

CVE-2021-29984 involves instruction reordering that allowed a GC-related object misevaluation, causing memory corruption and potentially exploitable crashes in Mozilla components. Affected products include Thunderbird and Firefox ESR/Firefox releases prior to 78.13/91; the exploit would require m...

CVE-2021-38508

CVE-2021-38508 is a vulnerability affecting Mozilla products where a form validity message shown in the same location as a permission prompt (e.g., geolocation) can obscure the prompt, potentially tricking users into granting permissions. Affected: Firefox < 94, Thunderbird < 91.3, and Fire...

CVE-2022-34478

Summary: CVE-2022-34478 affects Thunderbird on Windows, where the ms-msdt, search, and search-ms protocols could deliver content to Microsoft apps via prompts opened by user interaction. The underlying risk is exploitation of a prompt-based handling in these protocols that bypasses the browser. T...

CVE-2023-6209

CVE-2023-6209 corresponds to a parsing vulnerability where relative URLs starting with three slashes and a "/../" path could override the specified host, potentially enabling security issues on affected sites. The issue is documented for Firefox and Thunderbird, with affected versions cited as Fi...

CVE-2024-8382

The CVE-2024-8382 entry describes a vulnerability where privileged EventHandler interfaces were exposed to web content during execution of their listener callbacks. Affected software includes Firefox (less than 130; ESR <128.2 and ESR

CVE-2019-9796

CVE-2019-9796 is a use-after-free in the SMIL animation controller where double registration with the refresh driver leads to a dangling pointer after the controller is removed. Affected products include Thunderbird and Firefox (Firefox ESR < 60.6, Firefox

CVE-2020-12406

CVE-2020-12406 involves a missing type check during unboxed objects removal in Mozilla code, leading to a crash that could be exploited to run arbitrary code. Affected products/versions from the provided documents include Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR

CVE-2020-6806

CVE-2020-6806 is a memory-safety bug causing an out-of-bounds read during promise resolution that could lead to memory corruption and a potentially exploitable crash. The vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR

CVE-2024-7526

The ANGLE component in Firefox and Thunderbird fails to initialize parameters correctly, leading to a read from uninitialized memory . This vulnerability could be exploited to leak sensitive data from memory. Affected versions include Firefox < 129 , Firefox ESR < 115.14 , Firefox ESR < ...

CVE-2020-15664

The CVE-2020-15664 issue arises from a malicious page holding a reference to eval() from an about:blank window, allowing access to InstallTrigger and prompting users to install an extension. Affected products include Firefox < 80, Thunderbird < 78.2/68.12, Firefox ESR < 68.12/78.2, and F...

CVE-2020-6814

CVE-2020-6814 refers to memory-safety bugs in Mozilla Firefox and Thunderbird (68.5 timeframe) with potential to run arbitrary code. Affected products/versions: Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR

CVE-2020-6825

CVE-2020-6825 is a memory-safety issue in Mozilla Firefox/Thunderbird affecting Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox

CVE-2020-6831

CVE-2020-6831 is a bug described in Debian security advisories as a buffer overflow in the SCTP chunk input validation in the usrsctp library. The Debian entries explicitly tie this CVE to Firefox ESR (<68.8), Firefox (<76) and Thunderbird (

CVE-2021-23981

CVE-2021-23981 describes a memory-safety issue in WebGL where uploading a Texture into a Pixel Buffer Object could confuse WebGL and skip binding the buffer used to unpack it, leading to an out-of-bounds read and potential information leak or crash. Affected software includes Firefox ESR < 78....

CVE-2021-38504

The CVE-2021-38504 issue is a real vulnerability affecting Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2024-10460

The CVE-2024-10460 issue is a data: URL-based spoofing vulnerability in an iframe that obscures the origin of an external protocol handler prompt. Affected: Firefox <132, Firefox ESR <128.4, Thunderbird <128.4, and Thunderbird

CVE-2024-4769

This vulnerability exists in Firefox , Firefox ESR , and Thunderbird when importing resources via Web Workers . The underlying cause is that error messages distinguish between application/javascript responses and non-script responses, which could be abused to leak information cross-origin. Affect...