CVE-2009-0777

CVE-2009-0777 affects Mozilla Firefox (before 3.0.7), Mozilla Thunderbird (before 2.0.0.21), and SeaMonkey (before 1.1.15). The issue arises when decoding invisible characters displayed in the location bar, causing an incorrect address to be shown. This can enable remote attackers to spoof URLs a...

CVE-2011-3650

CVE-2011-3650 affects Mozilla Firefox versions prior to 3.6.24 and 4.x through 7.0, and Thunderbird prior to 3.1.6 and 5.0 through 7.0. The issue arises from how JavaScript files that contain many functions are handled when accessed via debugging APIs, enabling a user‑assisted attacker to trigger...

CVE-2014-1549

The CVE-2014-1549 vulnerability affects Mozilla Firefox (before 31.0) and Thunderbird (before 31.0). It arises in mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer where poor Web Audio buffer memory allocation enables remote code execution or a denial of service via crafted audio con...

CVE-2015-0815

CVE-2015-0815 affects Mozilla Firefox (pre-37.0), Firefox ESR (31.x before 31.6), and Thunderbird (before 31.6). The underlying issue is memory safety bugs in the Firefox/browser engine, with exploitation scenarios described as remote code execution or denial of service via unknown vectors. Affec...

CVE-2015-2737

CVE-2015-2737 affects Mozilla Firefox before 39.0 (and ESR 31.x before 31.8, 38.x before 38.1) and Thunderbird before 38.1. It targets rx::d3d11::SetBufferData, which reads data from uninitialized memory locations. The description notes the impact and attack vectors are unspecified; no explicit f...

CVE-2025-14321

The CVE-2025-14321 entry documents a Use-after-free in the WebRTC: Signaling component affecting Firefox before 146 and Firefox ESR before 140.6, and Thunderbird before 146/140.6. Public advisories (ALAS and Debian S/DLA notes) indicate memory-safety/allocations issues are part of the Firefox/Thu...

CVE-2026-6767

The Libraries component in NSS is affected by a vulnerability where operations can be executed outside of the buffer in memory . This flaw can allow a remote attacker to disclose protected sensitive information . The issue affects Mozilla Firefox , Firefox ESR , and the Thunderbird email client. ...

CVE-2026-74939

A privilege escalation vulnerability exists in the DOM: Navigation component of Mozilla Firefox and Mozilla Thunderbird . The root cause is that the parent process fails to reject a content-set RemoteTypeOverride field when deserializing a nsDocShellLoadState from content→parent IPDL messages. Th...

CVE-2026-8092

Memory safety bugs exist in Mozilla Firefox (versions ESR 115.35.1, ESR 140.10.1, and 150.0.1) and Thunderbird (versions 140.10.1 and 150.0.1). These vulnerabilities involve memory corruption and could potentially be exploited by an attacker to execute arbitrary code . The issues were addressed i...

CVE-2008-0418

CVE-2008-0418 is a directory-traversal flaw in Chrome URL handling that could allow remote attackers to read local files (Javascript, images, stylesheets) and potentially exfiltrate session data. Affected: Mozilla Firefox <= 2.0.0.11/12, Thunderbird <= 2.0.0.11/12, SeaMonkey

CVE-2008-5018

CVE-2008-5018 affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: insufficient class checking in the Date class in the JavaScript engine, enabling remote crash (DoS). Remediation from the initial desc...

CVE-2012-3964

CVE-2012-3964 is a use-after-free in gfxTextRun::GetUserData in Mozilla Firefox before 15.0 (and similar affected components in Thunderbird/SeaMonkey) that allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Public/conne...

CVE-2012-4187

CVE-2012-4187 is listed in the MiracleLinux/Miracle Linux AXSA advisory as affecting Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. The vulnerability is described as an issue with managing a cert...

CVE-2013-0778

CVE-2013-0778 affects Mozilla Firefox (pre-19.0), Thunderbird (pre-17.0.3), and SeaMonkey (pre-2.16). The issue stems from use-after-free and out-of-bounds/read vulnerabilities in the browser components (notably flagged in MFSA 2013-28), enabling remote code execution or denial of service via uns...

CVE-2013-6671

CVE-2013-6671 affects Mozilla Firefox before 26.0 (and corresponding ESR/Thunderbird/SeaMonkey releases listed) where nsGfxScrollFrameInner::IsLTR can be abused by crafted JavaScript used with ordered list elements to trigger remote code execution. The vulnerability is a browser-engine issue that...

CVE-2013-6673

Technical details about CVE-2013-6673 are not publicly available in the provided connected documents; monitor for updates.

CVE-2014-1552

CVE-2014-1552 is referenced in a 2014 Mozilla/Firefox advisory set (SUSE-SU-2014:0960-1) and in MFSA2014-66, with openVAS entries tying Firefox-related advisories to this CVE. The SUSE advisory lists CVE-2014-1552 among fixed items for Mozilla products, and shows a high severity/impact context (c...

CVE-2017-7782

CVE-2017-7782 affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2017-7846

CVE-2017-7846 affects Mozilla Thunderbird. The issue arises in parsing RSS feeds when viewed via website or default feed format, allowing JavaScript execution from the parsed feed (feed origin mailbox://). Published mitigations indicate Thunderbird versions up to 52.5.2 are affected, with fixes i...

CVE-2026-12294

A sandbox escape vulnerability exists in the DOM: Workers component of Mozilla Firefox and Mozilla Thunderbird . This flaw allows an attacker to break out of the browser's sandbox environment. The issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 ...

CVE-2026-16390

A mitigation bypass exists in the Enterprise Policies component of Mozilla Firefox and Thunderbird . This vulnerability has been addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . For users on Amazon Linux 2 , the fix is available in firefox-140.13.0-1.amzn...

CVE-2006-1727

CVE-2006-1727 affects Mozilla-derived browsers: Mozilla Firefox and Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The issue allows remote attackers to gain chrome privileges through multiple attack vectors related to the use of XBL...

CVE-2006-4340

CVE-2006-4340 is a cryptographic flaw in Mozilla NSS prior to 3.11.3 (used in Firefox ≤1.5.0.7, Thunderbird ≤1.5.0.7, SeaMonkey ≤1.0.5) where RSA with exponent 3 can produce signature forgery due to improper handling of extra data in PKCS #1 v1.5 verification. This enables remote attackers to for...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2008-0591

CVE-2008-0591 concerns Mozilla Firefox (pre-2.0.0.12) and Thunderbird (pre-2.0.0.12). The issue arises from how a delay timer protecting security-sensitive dialogs is handled; an attacker could exploit window focus changes to bypass the timer and trick a user into confirming an unsafe action (pot...

CVE-2011-3658

The CVE-2011-3658 issue affects Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5, where the SVG implementation mishandles DOMAttrModified interactions, leading to out-of-bounds memory access when removing SVG elements. This can enable a remote attacker to cause a denial of service or poten...

CVE-2012-1946

CVE-2012-1946 is a Use-after-free in Mozilla’s browser engine (nsINode::ReplaceOrInsertBefore) affecting Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0 and ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The connected docs confirm this is a remote code-execution risk vi...

CVE-2013-0767

CVE-2013-0767 affects Mozilla Firefox (and related Mozilla components) with the nsSVGPathElement::GetPathLengthScale path handling. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read, reported for Firefox before 18.0, ESR 10....

CVE-2017-5399

CVE-2017-5399 is a memory-safety vulnerability affecting Firefox and Thunderbird prior to version 52. Several connected advisories (e.g., Arch Linux ASA-201703-3, DEBIAN CVE tracker, MFSA2017-09) describe memory-safety bugs that could lead to arbitrary code execution or crashes. The documented re...

CVE-2021-4127

CVE-2021-4127 concerns an out-of-date Angle graphics library used by Mozilla Thunderbird and Firefox ESR, affecting Thunderbird < 78.9 and Firefox ESR

CVE-2025-8030

Insufficient escaping in the "Copy as cURL" feature in Mozilla Firefox and Thunderbird could be used to trick users into executing unexpected code. This vulnerability affects Firefox versions prior to 141, Firefox ESR versions prior to 128.13 and 140.1, and Thunderbird versions prior to 141, 128....

CVE-2026-16391

A vulnerability in the Storage: IndexedDB component of the Mozilla Firefox and Thunderbird browsers allows for information disclosure . This issue has been addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Exploitation details are not provided in the docum...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2011-0077

CVE-2011-0077 corresponds to an unspecified vulnerability in the Mozilla family browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue could lead to memory corruption and application crash, with possi...

CVE-2011-0085

CVE-2011-0085 is a use-after-free in the nsXULCommandDispatcher of Mozilla Firefox prior to 3.6.18, Thunderbird prior to 3.1.11, and SeaMonkey up to 2.0.14. The flaw allows remote attackers to execute arbitrary code by crafting an XUL document that dequeues the current command updater, enabling c...

CVE-2012-1937

CVE-2012-1937 affects Mozilla Firefox 4.x–12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10. The vulnerability arises from multiple unspecified memory-safety/behavioral issues in the browser engine that could cause memory cor...

CVE-2012-1954

CVE-2012-1954 is a use-after-free in Mozilla Firefox’s nsDocument::AdoptNode, affecting Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. Exploitation can cause a denial of service (heap memory corruption) or possibly remote code execution via vect...

CVE-2017-5426

CVE-2017-5426: On Linux, when seccomp-bpf is active as Gecko Media Plugin sandbox starts, the sandbox may fail to initialize, leaving code that would run in the sandbox only protected by a weaker filter. Affected products are Firefox < 52 and Thunderbird < 52 (Linux only). This can enable s...

CVE-2025-4092

Memory safety bugs in Mozilla Firefox and Thunderbird (versions prior to 138 ) can lead to memory corruption . A remote attacker could potentially exploit these vulnerabilities to execute arbitrary code . This issue was addressed and fixed in Firefox 138 and Thunderbird 138 . No specific exploit ...

CVE-2026-16387

A site isolation issue exists in the Networking component of the Firefox web browser and Thunderbird mail client. This vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153 (including Thunderbird 140.13 ). Exploitation details are not provided in the documentation....

CVE-2007-3845

CVE-2007-3845 affects Mozilla Firefox (before 2.0.0.6), Thunderbird (before 1.5.0.13 and 2.x before 2.0.0.6), and SeaMonkey (before 1.1.4). The issue allows remote code execution via a vector tied to launching a file handling program based on the file extension at the end of the URI, a variant of...

CVE-2008-2803

CVE-2008-2803 affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and SeaMonkey

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2014-1558

CVE-2014-1558 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. A crafted certificate that does not use UTF-8 in a required context can cause a denial of service via X.509 certificate parsing. The connected Gentoo GLSA notes multiple vulnerabilities and instructs upgrading Firefox/...

CVE-2026-6777

Mozilla Firefox and Thunderbird are vulnerable in versions prior to 150 due to an issue in the Networking: DNS component . The root cause involves insufficient validation of input data , which could allow an attacker to compromise the accessibility of protected information . The vulnerability has...

CVE-2026-84129

A site isolation issue exists in the DOM: Navigation component of Mozilla Firefox and Mozilla Thunderbird . This vulnerability affects the DOM and can impact the security boundaries between different web contents. The issue has been resolved in the following versions: Firefox 155 , Firefox ESR 15...

CVE-2006-1731

CVE-2006-1731 affects Mozilla Firefox/Thunderbird 1.x and related Mozilla suites; the flaw lets a remote attacker trigger XSS by valueOf.call/valueOf.apply with no args, returning the Object prototype instead of the global window. Impact is cross-site scripting; vendors released fixes in Firefox/...

CVE-2010-3776

CVE-2010-3776 affects Mozilla Firefox before 3.5.16 and Firefox 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11. The issue is described as memory safety/memory corruption in the browser engine, allowing a remote attacker to cause a denial of serv...