CVE-2019-9800

CVE-2019-9800 is supported by multiple connected advisories indicating memory safety bugs in Mozilla products (Thunderbird 60.x, Firefox ESR 60.x, Firefox 66–67 range) that could allow arbitrary code execution. The root cause is memory safety issues leading to memory corruption; affected versions...

CVE-2020-12417

CVE-2020-12417 is a memory-corruption issue in Firefox/Thunderbird affecting ARM64 JavaScript ValueTags, permitting a cross-boundary pass for ARM64 objects. Affected: Firefox ESR < 68.10, Firefox < 78, and Thunderbird

CVE-2024-10468

Potential race conditions in IndexedDB could lead to memory corruption , resulting in a potentially exploitable crash. This vulnerability affects Firefox versions earlier than 132 and Thunderbird versions earlier than 132 . No specific exploitation details or remediation steps are provided in the...

CVE-2024-11695

A flaw in Mozilla software allows a crafted URL containing Arabic script and whitespace characters to hide the true origin of a page, potentially enabling a spoofing attack . This vulnerability affects Firefox versions < 133, Firefox ESR < 128.5, Thunderbird versions < 133, and Thunderbird

CVE-2024-11708

Missing thread synchronization primitives could lead to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 and Thunderbird

CVE-2024-5694

The CVE-2024-5694 entry describes a use-after-free in the Firefox JavaScript engine that allows reading memory from the JavaScript string heap. Affected product: Mozilla Firefox earlier than 127. Impact: potential local memory read/unspecified escalation within the JS heap; exploitation guidance ...

CVE-2024-6612

This vulnerability affects Firefox < 128 and Thunderbird

CVE-2024-7529

The date picker in Firefox and Thunderbird can partially obscure security prompts. This vulnerability allows a malicious site to trick users into granting unauthorized permissions. Affected versions include Firefox < 129 , Firefox ESR < 115.14 and < 128.1 , Thunderbird < 128.1 , and T...

CVE-2020-12392

CVE-2020-12392 is a local vulnerability in Mozilla products where the “Copy as cURL” feature in DevTools network tab could improperly escape HTTP POST data, enabling potential arbitrary local file disclosure when the generated curl command is pasted and run. Affected are Firefox ESR < 68.8, Fi...

CVE-2020-6797

CVE-2020-6797 describes a macOS-specific issue where downloading a file with the .fileloc extension could cause a semi-privileged extension to launch an arbitrary application on the user’s Mac. The attacker is constrained by the ability to download only quarantined files and cannot pass command-l...

CVE-2021-38509

CVE-2021-38509 describes an issue where, due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary contents could be displayed over an attacker’s chosen page. Affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2019-17008

CVE-2019-17008 describes a use-after-free vulnerability that can occur during the destruction of nested workers, leading to a potentially exploitable crash. Affected products include Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox

CVE-2019-17016

CVE-2019-17016 describes a bypass of the CSS sanitizer for pasted rules, due to incorrect rewriting of a @namespace rule, enabling potential data exposure. Affected products include Thunderbird and Firefox releases prior to versions 68.4.1/72.x respectively (Thunderbird before 68.4.1; Firefox ES...

CVE-2021-23987

CVE-2021-23987 corresponds to memory safety bugs reported in Mozilla Firefox (including Firefox ESR 78.8 branch) that could allow memory corruption and potentially arbitrary code execution. The CVE is stated to affect Firefox ESR < 78.9, Firefox < 87, and Thunderbird

CVE-2021-23995

CVE-2021-23995 is a use-after-free vulnerability in Responsive Design Mode that could allow arbitrary code execution. Affected products: Firefox ESR <78.10, Thunderbird <78.10, and Firefox

CVE-2021-38496

CVE-2021-38496 describes a memory-safety issue: during MessageTask operations, a scheduled task could be removed, causing memory corruption and a potentially exploitable crash. Affected products include Thunderbird versions older than 78.15 and 91.2, Firefox ESR older than 91.2 and 78.15, and Fir...

CVE-2021-43539

CVE-2021-43539 is a Mozilla Firefox/Thunderbird memory safety issue: GC rooting failure when calling wasm instance methods can cause a use-after-free and potentially exploitable crash. Connected sources confirm the flaw affects Firefox up to 95 and Thunderbird up to 91.4.0, linked advisories show...

CVE-2024-11701

The Firefox browser (versions < 133) and Thunderbird (versions

CVE-2024-5689

Mozilla Firefox before 127 had multiple vulnerabilities including a UI spoofing issue where an overlay of the My Shots button could direct users to a phishing replica Firefox Screenshots page; this CVE-2024-5689 is identified in MFSA2024-25 as part of the fixes for Firefox 127. The affected produ...

CVE-2024-6608

The CVE-2024-6608 issue affects Mozilla Firefox (and related Thunderbird components) where pointerlock can move the cursor from within an iframe to outside the viewport and even outside the Firefox window. Affected versions are Firefox < 128 and Thunderbird

CVE-2025-1019

CVE-2025-1019 affects Firefox and Thunderbird where the z-order of fullscreen notifications can be manipulated to hide the notification, enabling a potential spoofing attack. Affected versions are Firefox and Thunderbird prior to 135. The underlying issue is the fullscreen notification display or...

CVE-2019-9817

CVE-2019-9817 describes cross-origin image access via canvas that can leak image data across domains. Publicly reported impact affects Mozilla products including Thunderbird and Firefox (non-ESR and ESR lines) prior to version thresholds: Thunderbird <60.7, Firefox <67, ESR

CVE-2021-43538

CVE-2021-43538 is a race condition in the notification code that could allow spoofing by hiding fullscreen/pointer-lock notifications on affected Mozilla products. Affected: Thunderbird < 91.4.0, Firefox ESR < 91.4.0, Firefox

CVE-2023-23603

CVE-2023-23603 describes that Regular expressions used to filter forbidden properties/values from style directives in calls to console.log did not account for external URLs, enabling potential data exfiltration from the browser. Affected: Firefox <= 108/109 and Firefox ESR <= 102.7, Thunder...

CVE-2024-10462

A truncation vulnerability exists in the way long URLs are handled, which could allow for origin spoofing in a permission prompt. This issue affects Firefox versions < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird

CVE-2024-8388

CVE-2024-8388 affects Mozilla Firefox for Android. A masked/overlapped notification sequence (Android Toast) used to announce fullscreen transition after the CVE-2023-6870 fix can be leveraged to spoof the browser UI. Root cause: prompts/panels from Firefox and Android OS obscuring the transition...

CVE-2024-9398

CVE-2024-9398 affects Mozilla Firefox and Thunderbird: an attacker could enumerate external protocol handlers by exploiting a check of window.open results, effectively testing whether a protocol handler is installed. Affected: Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and ...

CVE-2020-6812

CVE-2020-6812: Affected software includes Thunderbird

CVE-2021-38507

CVE-2021-38507 describes a vulnerability in HTTP/2 Opportunistic Encryption (RFC 8164) where, if a second encrypted port on the same IP (e.g., 8443) did not opt in, a network attacker could forward 443 to 8443 and trick the browser into treating the content as same-origin with HTTP. The issue was...

CVE-2024-11702

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may inadvertently store data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird

CVE-2020-12395

CVE-2020-12395 refers to memory-safety bugs reported in Mozilla Firefox and Thunderbird. Mozilla noted memory corruption in bugs affecting Firefox 75/ESR 68.7 and stated that with enough effort some bugs could be exploited to run arbitrary code. The vulnerability impacts Firefox ESR < 68.8, Fi...

CVE-2020-12400

CVE-2020-12400 is an NSS-related timing vulnerability affecting Firefox < 80 and Firefox for Android

CVE-2024-10461

CVE-2024-10461: In multipart/x-mixed-replace responses, Content-Disposition: attachment header was not respected, enabling XSS. Affected: Firefox <132, Firefox ESR <128.4, Thunderbird <128.4, Thunderbird

CVE-2024-9394

CVE-2024-9394 describes a cross-origin information disclosure in Mozilla Firefox/Thunderbird via specially crafted multipart responses that can execute JavaScript under resource://devtools. Desktop Site Isolation limits cross-origin access, but Android versions may enable full cross-origin access...

CVE-2025-0241

A memory corruption vulnerability exists in Mozilla Firefox and Thunderbird during the segmentation of specially crafted text. This flaw can lead to a potentially exploitable crash or service interruption due to data being transferred beyond the buffer in memory. The issue affects versions of Fir...

CVE-2020-26976

The CVE-2020-26976 entry describes a vulnerability in Firefox where, if a HTTPS page is embedded in HTTP and a service worker exists for the secure page, the service worker could intercept the secure page request despite the iframe not being in a secure context. Affected product: Firefox (version...

CVE-2024-7521

Incomplete WebAssembly exception handling in the Mozilla ecosystem could lead to a use-after-free vulnerability. This issue affects Firefox versions prior to 129, Firefox ESR versions prior to 115.14, 128.1, Thunderbird versions prior to 128.1, and Thunderbird versions prior to 115.14. While the ...

CVE-2018-18500

CVE-2018-18500 is a use-after-free in the HTML5 stream parser when handling custom HTML elements, causing the parser object to be freed while still in use. Affected products include Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox

CVE-2024-11697

A vulnerability in Firefox and Thunderbird allows an attacker to trick a user into bypassing the "Open Executable File?" confirmation dialog by manipulating how keypress events are handled. This flaw could lead to malicious code execution . Affected versions include Firefox < 133 , Firefox ESR...

CVE-2024-8386

CVE-2024-8386 : A spoofing vulnerability where, if a site has permission to open popup windows, Select elements can appear on top of another site. Affected: Firefox versions before 130, Firefox ESR before 128.2, and Thunderbird before 128.2. Impact is described in external advisories; no exploita...

CVE-2019-9819

The CVE-2019-9819 issue is a JavaScript compartment mismatch involving the fetch API that can cause a crash. Affected products include Thunderbird (and Firefox components) with versions below 60.7 for Thunderbird and below 67 for Firefox/Firefox ESR; impact is described as potentially exploitable...

CVE-2024-7524

CVE-2024-7524 affects Mozilla Firefox and Firefox ESR prior to 129/115.14-128.1. The issue arises when Firefox’s web-compatibility shims, used for blocked tracking scripts by Enhanced Tracking Protection, are injected on a site protected by CSP in strict-dynamic mode. An attacker who can inject a...

CVE-2024-11703

On Android , Firefox versions prior to 133 may have inadvertently allowed users to view saved passwords without the required device PIN authentication . This vulnerability is categorized under CWE-522 (Insufficiently Protected Credentials). The provided documents do not specify a direct fix for t...

CVE-2024-7525

A missing permission check when creating a StreamFilter allows a web extension with minimal permissions to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird

CVE-2024-7530

A use-after-free vulnerability exists in Firefox versions prior to 129 due to an incorrect garbage collection interaction . This flaw allows for potential exploitation of memory, with the CVSS v3.1 score indicating a High severity (8.8) or Critical severity (9.8) depending on the source. While sp...

CVE-2019-11711

CVE-2019-11711 involves reuse of an inner window that neglects document.domain cross-origin protections, enabling script injection across subdomains. Affected software per connected docs: Firefox ESR < 60.8, Firefox < 68, and Thunderbird

CVE-2020-6822

CVE-2020-6822 is an out-of-bounds write in GMPDecodeData when processing images larger than 4 GB on 32-bit builds, potentially allowing arbitrary code execution. Affected products include Thunderbird and Firefox (Thunderbird < 68.7.0, Firefox ESR < 68.7, Firefox

CVE-2021-23978

CVE-2021-23978 affects Mozilla products (Firefox and Thunderbird/Firefox ESR). The connected documents confirm memory safety bugs in Firefox 85 and ESR 78.7, with potential memory corruption that could lead to arbitrary code execution. Impact is described for Firefox < 86, Thunderbird < 78....

CVE-2025-0246

Mozilla Firefox versions earlier than 134 are vulnerable to an issue where an attacker can spoof the address bar when using an invalid protocol scheme . This vulnerability specifically affects the Android operating system; other operating systems are unaffected. The root cause is related to error...

CVE-2019-17005

The CVE-2019-17005 issue is a memory safety vulnerability in Mozilla’s plain text serializer where a fixed-size array for the number of elements could overflow, causing memory corruption and a potentially exploitable crash. Affected products include Thunderbird, Firefox ESR, and Firefox (all ver...