CVE-2013-0776

CVE-2013-0776 affects Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16. The flaw allows a man-in-the-middle attacker to spoof the address bar by using a proxy server that returns a 407 HTTP status...

CVE-2013-1674

CVE-2013-1674 is a use-after-free vulnerability in Mozilla Firefox (and related Thunderbird components) that can be triggered by an onresize event during video playback, allowing remote code execution. Affected products include Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderb...

CVE-2013-1676

CVE-2013-1676 affects Mozilla Firefox prior to 21.0, Firefox ESR 17.x prior to 17.0.6, Thunderbird prior to 17.0.6, and Thunderbird ESR 17.x prior to 17.0.6. The flaw is in SelectionIterator::GetNextSegment and is exploitable via unspecified vectors to trigger remote code execution or a denial of...

CVE-2017-5451

CVE-2017-5451 describes an address bar spoofing vulnerability via the onblur event, enabling a script to affect text display and make the loaded site appear different from what’s in the address bar. The issue affects Mozilla products including Thunderbird < 52.1, Firefox ESR < 52.1, and Fir...

CVE-2025-3522

The Mozilla Thunderbird email client is vulnerable to an information disclosure flaw because it fails to properly validate or sanitize the X-Mozilla-External-Attachment-URL header. When opening an email, Thunderbird accesses the provided URL to determine file size and navigates to it upon a user ...

CVE-2006-0294

Affected software: Mozilla Firefox <1.5.0.1, Thunderbird 1.5, and SeaMonkey

CVE-2007-3734

CVE-2007-3734 is a memory corruption vulnerability in the Mozilla browser engine affecting Mozilla Firefox and SeaMonkey components (and related Thunderbird components) prior to version 2.0.0.5. The issue could cause a remote crash via unspecified vectors, with some connected advisories noting po...

CVE-2008-0412

The CVE-2008-0412 entry describes multiple remote-denial-of-service and potential memory corruption vulnerabilities in the browser engines of Mozilla Firefox <2.0.0.12, Thunderbird <2.0.0.12, and SeaMonkey

CVE-2012-1956

CVE-2012-1956 affects Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The issue is that Object.defineProperty can shadow the top-level location object (window.location), enabling cross-site scripting via plugin-imbued vectors. MiracleLinux advisories enumerate CVE-20...

CVE-2013-0793

CVE-2013-0793 affects Mozilla Firefox family (Firefox, Firefox ESR, Thunderbird, SeaMonkey) and related XUL/XPCOM runtimes where the address bar could be manipulated during history navigation, enabling cross-site scripting (XSS) or phishing by timing navigation. Affected products in scope include...

CVE-2017-5467

CVE-2017-5467 affects Mozilla Firefox and Thunderbird, with memory corruption when drawing Skia content outside the clipping region. Affected: Firefox (<53) and Thunderbird (

CVE-2023-37208

CVE-2023-37208 affects Firefox (<115), Firefox ESR (<102.13), and Thunderbird (

CVE-2010-0176

CVE-2010-0176 affects Mozilla Firefox (before 3.0.19; 3.5.x before 3.5.9; 3.6.x before 3.6.2), Thunderbird before 3.0.4, and SeaMonkey before 2.0.4. The issue is a reference-counting error for option elements in a XUL tree optgroup, described as a dangling pointer vulnerability that could allow r...

CVE-2010-1200

CVE-2010-1200 is reported across multiple advisories as part of Mozilla Firefox family vulnerabilities. Affected products include Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The issue is described as multiple unspecified vulnerabi...

CVE-2010-3168

CVE-2010-3168 affects Mozilla products (Firefox, Thunderbird, SeaMonkey) where XUL tree removal could be triggered by setting certain properties. Root cause: improper restriction of property changes in triggering XUL tree removal. Impact: remote attackers could cause a denial of service (deleted ...

CVE-2011-1187

CVE-2011-1187 affects Google Chrome prior to 10.0.648.127, allowing remote attackers to bypass the Same Origin Policy via an unspecified error-message leak vector. The vulnerability targets the browser’s SOP checks, enabling cross-origin access that should be restricted. Public sources within the...

CVE-2012-0449

CVE-2012-0449 affects Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7. Description: remote attackers can cause memory corruption and application crash, or possibly execute arbitrary code via a malformed XSLT stylesheet emb...

CVE-2012-4188

CVE-2012-4188 is a heap-based buffer overflow in Mozilla Firefox’s Convolve3x3 path, affecting Firefox before 16.0 (and ESR 10.x before 10.0.8), Thunderbird before 16.0 (and ESR 10.x before 10.0.8), and SeaMonkey before 2.13. The vulnerability allows remote code execution via unspecified vectors;...

CVE-2013-0761

CVE-2013-0761 is a use-after-free vulnerability in Firefox’s mozilla::TrackUnionStream::EndTrack that could allow remote code execution or a denial of service via heap memory corruption. Affected products include Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR...

CVE-2014-1592

CVE-2014-1592 is a use-after-free in Mozilla Firefox’s nsHtml5TreeOperation (xul.dll) that enables remote code execution by adding a second root element to an HTML5 document during parsing. Affected products/versions include Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird b...

CVE-2014-8634

CVE-2014-8634 affects Mozilla Firefox (and related Mozilla products) with memory-safety and implementation issues in the browser engine that could allow remote code execution or a crash. Public disclosures across multiple advisories confirm additional related CVEs (e.g., 8638, 8639, 8641, etc.) a...

CVE-2017-5419

CVE-2017-5419 is a denial-of-service vulnerability affecting Mozilla Firefox and Thunderbird prior to version 52. The issue arises when a malicious page repeatedly triggers a modal authentication prompt, causing the browser UI to become unresponsive. Public references describe this as a DOS condi...

CVE-2018-5144

CVE-2018-5144 describes an integer overflow during Unicode text conversion caused by an unchecked length parameter. Affected products: Firefox ESR and Thunderbird (pre-52.7). Root cause: overflow during Unicode conversion. Impact: potential remote code execution or memory issues as implied by the...

CVE-2014-1541

CVE-2014-1541 is a use-after-free in the RefreshDriverTimer::TickDriver function of the SMIL Animation Controller, affecting Mozilla Firefox before 30.0, Firefox ESR before 24.6, and Thunderbird before 24.6. Remote attackers could abuse crafted web content to execute arbitrary code or cause a den...

CVE-2015-0827

CVE-2015-0827 : A heap-based buffer overflow in mozilla::gfx::CopyRect within Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 could allow a remote attacker to read from uninitialized memory via a malformed SVG graphic, leading to possible information disclos...

CVE-2017-7758

CVE-2017-7758 describes an out-of-bounds read in the Opus encoder when the number of channels in an audio stream changes during encoding. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2018-5174

CVE-2018-5174 involves Windows Defender SmartScreen honoring the SEE_MASK_FLAG_NO_UI flag, allowing downloaded files to run without UI prompts on Windows 10 April 2018 Update and later. The issue, as documented in NVD and reflected in the connected Nessus/SUSE advisories, notes that Firefox and T...

CVE-2023-29545

CVE-2023-29545 describes a Windows Save As issue where Firefox/Thunderbird could resolve environment-variable-like names in suggested filenames to the current user context. Affected: Firefox and Thunderbird on Windows; versions affected per the entry are Firefox < 112, Firefox ESR < 102.10,...

CVE-2025-5986

The Mozilla Thunderbird email client is vulnerable to unsolicited file downloads , disk space exhaustion, and credential leakage due to insufficient validation of mailbox:/// links . A crafted HTML email can trigger automatic downloads of .pdf files to a user's desktop or home directory without p...

CVE-2026-16365

A privilege escalation vulnerability exists in the DOM: Workers component of Mozilla Firefox and Thunderbird . This flaw allows an attacker to bypass security restrictions. The vulnerability affects Mozilla Thunderbird ESR versions earlier than 140.15 and other Mozilla products including Firefox ...

CVE-2009-1308

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.0.9, Thunderbird, and SeaMonkey allows remote attackers to inject arbitrary web script or HTML via vectors involving XBL JavaScript bindings and remote stylesheets, as exploited in the wild by a March 2009 eBay listing.

CVE-2011-0083

CVE-2011-0083 is a use-after-free in the nsSVGPathSegList::ReplaceItem path in Mozilla Firefox (<3.6.18), Thunderbird (<3.1.11), and SeaMonkey (

CVE-2012-0471

CVE-2012-0471 is documented in multiple connected advisories as a Cross-site Scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9. The root cause is a vulnerabi...

CVE-2012-0473

CVE-2012-0473 : In Mozilla Firefox and related Mozilla products, the WebGLBuffer::FindMaxUshortElement function calls FindMaxElementInSubArray with incorrect template arguments, allowing remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. Affe...

CVE-2012-4207

CVE-2012-4207 affects Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 / ESR 10.x, and SeaMonkey before 2.14. The flaw in the HZ-GB-2312 charset implementation allows remote attackers to perform cross-site scripting (XSS) via a crafted document, due to imprope...

CVE-2013-5595

CVE-2013-5595 affects the Mozilla/XUL Firefox engine. The vulnerability arises from improper memory allocation in unspecified JavaScript functions, enabling remote attackers to trigger a buffer overflow via a crafted web page. Affected are Firefox before 25.0, Firefox ESR 17.x before 17.0.10, and...

CVE-2013-5597

CVE-2013-5597 is a use-after-free vulnerability in Mozilla Firefox (and affected Mozilla platforms) caused by improper handling in nsDocLoader::doStopDocumentLoad during an offline-cache update. The issue allows remote attackers to trigger arbitrary code execution or a denial of service via a sta...

CVE-2013-5618

CVE-2013-5618 is a use-after-free in Mozilla Firefox’s table-editing UI (nsNodeUtils::LastRelease). Affected: Firefox < 26.0, Firefox ESR < 24.2, Thunderbird < 24.2, SeaMonkey

CVE-2017-5421

CVE-2017-5421 is reported as a print preview spoofing issue affecting Mozilla Firefox and Mozilla Thunderbird when popup windows are enabled. The vulnerability description states that a malicious site could spoof the contents of the print preview window, causing user confusion about which site is...

CVE-2026-74944

CVE-2026-74944 is a use-after-free in Firefox/Thunderbird's DOM: Core & HTML component, rated Critical (CVSS 9.8, network-exploitable, no auth or user interaction required). It enables arbitrary code execution, privilege escalation, and information disclosure. Affected versions: Firefox <154, ...

CVE-2010-2765

CVE-2010-2765: Integer overflow in the FRAMESET cols attribute may allow remote code execution via a large number of columns. Affected products include Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7. Exploitation c...

CVE-2011-3062

CVE-2011-3062 : An off-by-one error in the OpenType Sanitizer used by Google Chrome prior to 18.0.1025.142 allows remote attackers to cause a denial of service or possibly other impact via a crafted OpenType file. The MiracleLinux/OpenSUSE/Oracle Solaris advisories reference this CVE as part of C...

CVE-2011-3648

CVE-2011-3648 is an XSS vulnerability in Mozilla Firefox prior to 3.6.24 and 4.x through 7.0 and in Thunderbird prior to 3.1.6 and 5.0 through 7.0. It allows remote attackers to inject arbitrary web script or HTML via crafted text encoded in Shift_JIS. Affected products include Firefox and Thunde...

CVE-2012-4202

CVE-2012-4202 describes a heap-based buffer overflow in Firefox’s image::RasterImage::DrawFrameTo, exploitable via a crafted GIF image to execute arbitrary code. Affected products include Mozilla Firefox before 17.0, Firefox ESR before 10.0.11 (10.x), Thunderbird before 17.0, Thunderbird ESR befo...

CVE-2013-0745

This CVE (CVE-2013-0745) affects Mozilla Firefox prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. It is caused by the AutoWrapperChanger not interacting correctly with garbage collection, enabling remote code ...

CVE-2013-0773

CVE-2013-0773 corresponds to a vulnerability in the Chrome Object Wrapper (COW) and System Only Wrapper (SOW) security wrappers in Mozilla-based products. The issue allowed modifications to a prototype, enabling a non-specified remote site to access chrome objects or potentially execute JavaScrip...

CVE-2013-5615

CVE-2013-5615 concerns GetElementIC typed array stubs being generated outside observed typesets in the Mozilla JavaScript engine. The connected vendor notes identify affected products as Mozilla Firefox (and related Firefox ESR/Thunderbird/SeaMonkey lines in the 2013 MFSA bundle) with fixes imple...

CVE-2014-1594

CVE-2014-1594 affects Mozilla Firefox (pre-34.0), Firefox ESR (pre-31.3), Thunderbird (pre-31.3), and SeaMonkey (pre-2.31). The underlying issue is a casting error: an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type. This can allow a remote attacker to exec...

CVE-2017-7749

This CVE-2017-7749 is a use-after-free in the docshell reload path that affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2012-0456

CVE-2012-0456 concerns the SVG Filters implementation in Mozilla Firefox (and related Mozilla products) that can allow remote attackers to obtain sensitive information from process memory via an out-of-bounds read. Affected products include Firefox versions prior to 3.6.28 and 4.x through 10.0, F...