CVE-2024-5693

The Offscreen Canvas component in Firefox and Thunderbird failed to properly track cross-origin tainting . This flaw could allow an attacker to access image data from another site, violating the same-origin policy . Affected versions include Firefox < 127 , Firefox ESR < 115.12 , and Thunde...

CVE-2018-18505

CVE-2018-18505 concerns an IPC privilege-escalation in Mozilla products where an authentication added during IPC process creation is not applied to channels created later, enabling potential sandbox escape through IPC channels. Public advisories tie this to Thunderbird and Firefox releases prior ...

CVE-2020-15683

CVE-2020-15683 : Mozilla Firefox and Thunderbird memory-safety issues reported affecting Firefox ESR < 78.4, Firefox < 82, and Thunderbird

CVE-2021-23984

The CVE-2021-23984 entry describes a vulnerability in which a malicious extension could open a popup window without an address bar, allowing spoofing of a site and credential theft. Affected products include Firefox ESR < 78.9, Firefox < 87, and Thunderbird

CVE-2024-11706

A null pointer dereference vulnerability exists in the pk12util component, specifically within the SEC_ASN1DecodeItem_Util function. This issue occurs when the software processes malformed or improperly formatted input files. The vulnerability impacts Firefox versions prior to 133 and Thunderbird...

CVE-2024-4777

CVE-2024-4777 concerns memory-safety bugs in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10, potentially allowing arbitrary code execution. Public sources in connected documents confirm affected products and versions: Firefox < 126, Firefox ESR < 115.11, and Thunderbird

CVE-2024-6610

The CVE-2024-6610 issue is disclosed across multiple sources as a UI vulnerability in Mozilla Firefox and Thunderbird prior to version 128, caused by form validation popups that can capture escape key presses and block exiting full-screen mode. Affected products: Firefox <128 and Thunderbird

CVE-2024-7520

CVE-2024-7520 is a type confusion vulnerability in WebAssembly that could enable code execution. The available documents confirm impact on Mozilla Firefox (pre-129 and ESR pre-128.1) and Mozilla Thunderbird (pre-128.1). The underlying issue is a WebAssembly type confusion, with several advisories...

CVE-2024-7527

The CVE-2024-7527 issue (use-after-free at the start of sweeping) affects Firefox <129 and Thunderbird

CVE-2025-0238

Mozilla Firefox and Thunderbird are affected by a use-after-free vulnerability triggered by a controlled failed memory allocation when breaking lines in text. This flaw could lead to a potentially exploitable crash or service interruption via a specially crafted web page. The vulnerability impact...

CVE-2019-11743

CVE-2019-11743 describes cross-origin access to unload event attributes, enabling timing-side-channel exposure of history in certain browsers. Connected docs confirm affected products and versions, with fixes noted in Thunderbird updates (e.g., Thunderbird 60.9.0) and Firefox/ESR advisories addre...

CVE-2021-24002

CVE-2021-24002 is a vulnerability observed in Firefox before 88 and Thunderbird before 78.10 where clicking an FTP URL containing encoded newline characters (%0A, %0D) could cause the server to interpret newlines and execute arbitrary commands. Affected products include Firefox ESR < 78.10, Fi...

CVE-2023-4579

CVE-2023-4579 affects Mozilla Firefox when the default search engine may render a well-formed URL from a query as the navigated URL, enabling potential spoofing. Connected advisories confirm the issue targets Firefox versions prior to 117 and involve the default search engine handling, across mul...

CVE-2024-10466

CVE-2024-10466: A specially crafted push message can hang the parent process, making the browser unresponsive. Affected: Firefox < 132, Firefox ESR < 128.4, Thunderbird

CVE-2025-0243

Mozilla Firefox and Thunderbird are affected by memory safety bugs in versions 133 and 128.5 (ESR). The root cause involves copying buffers without checking the size of the input data , which may lead to memory corruption . A remote attacker could potentially exploit these flaws to execute arbitr...

CVE-2019-11715

CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird

CVE-2021-29976

CVE-2021-29976 is a memory-safety issue affecting Mozilla code shared by Firefox and Thunderbird. The advisory details indicate memory-safety bugs that could be exploited to run arbitrary code, impacting Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox

CVE-2024-10467

Mozilla products including Firefox , Firefox ESR , and Thunderbird are affected by memory safety bugs including out-of-bounds write , out-of-bounds read , and buffer copy without checking size (CWE-787, CWE-125, CWE-120). The vulnerability impacts Firefox < 132 , Firefox ESR < 128.4 , Thund...

CVE-2024-11700

The SpiderMonkey JavaScript and WebAssembly engine, used in products like Firefox and Thunderbird , is susceptible to tapjacking via malicious websites. This flaw allows attackers to perform user intent confirmation , potentially tricking users into unknowingly approving the launch of external ap...

CVE-2024-5695

CVE-2024-5695 describes an out-of-memory condition in Mozilla Firefox’s probabilistic heap checker allocations that could trigger an assertion and, in rarer cases, memory corruption. Affected software: Firefox versions older than 127. The root cause is tied to the probabilistic heap checker alloc...

CVE-2024-6605

Firefox Android versions prior to 128 are vulnerable to a security flaw where the browser allowed immediate interaction with permission prompts. This flaw could be exploited by malicious websites to perform tapjacking attacks. No specific exploit links or technical remediation steps are provided ...

CVE-2024-9396

A memory corruption vulnerability exists in Firefox and Thunderbird due to a condition where the structured clone of certain objects occurs. This vulnerability affects Firefox < 131 , Firefox ESR < 128.3 , Thunderbird < 128.3 , and Thunderbird

CVE-2019-11693

CVE-2019-11693 describes a Linux-specific buffer overflow in WebGL’s bufferdata, affecting Thunderbird and Firefox (Thunderbird <60.7, Firefox <67, ESR

CVE-2023-23601

CVE-2023-23601 is a browser navigation/vulnerability caused by dragging a URL from a cross-origin iframe into the same tab, enabling potential spoofing. Public records confirm impact on Firefox (less than 109) and Firefox ESR (less than 102.7) and Thunderbird (less than 102.7). Multiple advisorie...

CVE-2024-11705

The NSC_DeriveKey function in Firefox and Thunderbird (versions prior to 133) contains a NULL pointer dereference vulnerability. The function incorrectly assumes that the phKey parameter is always non-NULL; however, when passed as NULL, it triggers a segmentation fault (SEGV) , leading to applica...

CVE-2024-7518

CVE-2024-7518 describes that select options could obscure the fullscreen notification dialog, enabling spoofing by a malicious site. Affected products and versions identified in connected docs include Mozilla Firefox (older builds: Firefox < 129 and Firefox ESR < 128.1) and Mozilla Thunderb...

CVE-2024-8384

CVE-2024-8384 describes a memory safety issue in the JavaScript engine’s garbage collector where cross-compartment objects could be mis-colored under certain OOM timing, leading to memory corruption. Affected products per connected sources include Firefox and Thunderbird up to specific versions: ...

CVE-2024-8385

CVE-2024-8385 is a WASM type confusion vulnerability caused by how StructFields and ArrayTypes are handled. Affects Firefox (versions before 130) and Firefox ESR (before 128.2) and Thunderbird (before 128.2). Exploitation could lead to high-impact outcomes per the CVE. Remediation in the public d...

CVE-2019-9813

CVE-2019-9813 describes an IonMonkey JIT type confusion caused by incorrect handling of proto mutations, enabling potential arbitrary memory read/write. Affected products include Firefox prior to 66.0.1, Firefox ESR prior to 60.6.1, and Thunderbird prior to 60.6.1. The underlying issue is a type-...

CVE-2020-6799

CVE-2020-6799 is a vulnerability in Mozilla Firefox where command line arguments could be injected during Firefox invocation when Firefox is the default handler for non-default filetypes and a downloaded file is opened by a third‑party application that does not sanitize URL data. The issue could ...

CVE-2024-10004

A vulnerability in Firefox for iOS (versions

CVE-2024-9397

CVE-2024-9397 is a concrete issue: a missing delay in the directory upload UI could enable clickjacking to trick users into granting permissions. Affected products include Firefox (versions prior to 131 and ESR prior to 128.3) and Thunderbird (prior to 131/128.3). Connected advisories (ALSA/ALAS)...

CVE-2025-0245

The Mozilla Firefox Focus browser for Android is vulnerable to an authentication bypass. Under certain circumstances, the user opt-in setting requiring authentication before use could be bypassed through an alternative path or channel . This flaw allows a malicious actor to circumvent screen lock...

CVE-2019-11746

CVE-2019-11746 is a use-after-free in video element handling that can cause a crash. Public sources in connected advisories confirm impact on Firefox versions below 69, Thunderbird <68.1 and <60.9 (and ESR branches

CVE-2019-17011

CVE-2019-17011 : A race condition in DocShell antitracking can cause a use-after-free and potentially crash the process. Affected: Thunderbird < 68.3, Firefox ESR < 68.3, Firefox

CVE-2020-26960

CVE-2020-26960 is a use-after-free vulnerability caused by reallocation during Compact() on nsTArray, affecting Firefox <83, Firefox ESR <78.5, and Thunderbird

CVE-2024-10463

CVE-2024-10463 identifies a vulnerability where video frames could have been leaked between origins in certain situations. This flaw affects Firefox versions < 132, Firefox ESR < 128.4 (and < 115.17), Thunderbird < 128.4, and Thunderbird

CVE-2024-10465

This vulnerability affects Firefox (versions < 132), Firefox ESR (versions < 128.4), Thunderbird (versions < 128.4 and

CVE-2024-6613

The frame iterator in Firefox and Thunderbird can become stuck in a loop when processing certain WebAssembly (WASM) frames. This flaw leads to the generation of incorrect stack traces . This vulnerability affects Firefox < 128 and Thunderbird

CVE-2024-9399

CVE-2024-9399 describes a denial-of-service in Firefox/Thunderbird caused by a website initiating a specially crafted WebTransport session that crashes the browser. Affected versions: Firefox before 131 and Firefox ESR before 128.3; Thunderbird before 128.3; Thunderbird before 131. The issue is t...

CVE-2024-9402

Mozilla products, specifically Firefox , Firefox ESR , and Thunderbird , are impacted by memory safety bugs (CWE-119). These vulnerabilities affect versions of Firefox prior to 131, Firefox ESR prior to 128.3, and Thunderbird prior to 128.3 or 131. The flaws may lead to memory corruption , which ...

CVE-2019-9795

CVE-2019-9795 describes a vulnerability in the IonMonkey JIT compiler where a type-confusion could be exploited by malicious JavaScript to trigger a crash. Public references indicate affected products include Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox

CVE-2024-7531

CVE-2024-7531 involves Mozilla Firefox and Firefox ESR. The connected documents confirm the underlying vulnerability: calling PK11_Encrypt() in NSS with CKM_CHACHA20 and using the same buffer for input and output can expose plaintext on Intel Sandy Bridge CPUs. In Firefox, the impact is limited t...

CVE-2025-0244

The Mozilla Firefox browser is vulnerable to an issue where a malicious actor can spoof the address bar by redirecting the user to an invalid protocol scheme . This vulnerability specifically affects Firefox on Android operating systems and is not present in other OS versions. The flaw is rooted ...

CVE-2019-11712

CVE-2019-11712 describes a vulnerability where NPAPI plugins (e.g., Flash) performing POST requests that follow a 308 redirect can bypass CORS, enabling CSRF. Affected products include Mozilla Firefox ESR < 60.8, Firefox < 68, and Thunderbird

CVE-2019-11717

CVE-2019-11717 affects Firefox ESR <60.8, Firefox <68, and Thunderbird

CVE-2024-7522

The editor component in Mozilla products is vulnerable to an out-of-bounds read because the code failed to properly validate an attribute value. This vulnerability affects Firefox versions < 129, Firefox ESR < 115.14 and < 128.1, Thunderbird < 128.1, and Thunderbird

CVE-2019-11733

CVE-2019-11733 affects Firefox before 68.0.2 (and ESR before 68.0.2). When a master password is set, stored passwords in the Saved Logins dialog could be copied to the clipboard via the copy password action without re-entering the master password in the same session, enabling potential theft of s...

CVE-2019-11742

CVE-2019-11742 describes a same-origin policy violation enabling theft of cross-origin images via a combination of SVG filters and a element, due to an error in how cached image content is treated. Affected: Firefox versions before 69, Thunderbird before 68.1 (and before 60.9 for ESR branches), ...

CVE-2019-17017

CVE-2019-17017 is a type confusion in Firefox/Thunderbird (XPCVariant.cpp) caused by a missing case handling object types, leading to a crash with potential for arbitrary code execution. Public disclosures in connected documents confirm impact on Thunderbird and Firefox ESR through versions befor...