CVE-2014-1538

CVE-2014-1538 is a use-after-free in Mozilla Firefox's nsTextEditRules::CreateMozBR that can lead to remote code execution or a heap memory corruption condition. It affects Firefox before 30.0, ESR 24.x before 24.6, and Thunderbird before 24.6. Public advisories in connected docs show fixes: Fire...

CVE-2025-3034

Mozilla Firefox and Thunderbird versions prior to 137 are affected by multiple memory safety bugs . These vulnerabilities involve memory corruption issues, which could allow a remote attacker to execute arbitrary code by performing operations beyond buffer boundaries in memory. Remediation is pro...

CVE-2025-8033

The JavaScript engine in Mozilla Firefox and Thunderbird contains a vulnerability where it fails to correctly handle closed generators. This flaw allows an attacker to resume these generators, leading to a nullptr dereference . Affected versions include Firefox < 141, Firefox ESR < 115.26, ...

CVE-2026-16350

The Audio/Video: cubeb component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to incorrect boundary conditions . This flaw impacts several versions including Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . The vulnerability is assigne...

CVE-2026-16360

Mozilla released security updates to address memory safety bugs in Firefox ESR 115.37 , Firefox ESR 140.12 , and Firefox 152 . These vulnerabilities involve memory corruption issues that could potentially be exploited to execute arbitrary code with sufficient effort. The issues are also present i...

CVE-2026-84121

Mozilla Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by a use-after-free in the DOM: Security component . This security flaw could allow an attacker to escape the sandbox environment. The issue has been addressed in Firefox 155 , Firefox ESR 115.40 , Firefox ESR 1...

CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2008-5014

CVE-2008-5014 affects Mozilla firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: modifying window.proto .proto can lock a non-native object, triggering an OBJ_IS_NATIVE assertion. Impact: remote attacker could crash...

CVE-2012-1960

The CVE-2012-1960 entry affects Mozilla Firefox 4.x–13.0, Thunderbird 5.0–13.0, and SeaMonkey before 2.11. The qcms_transform_data_rgb_out_lut_sse2 function in the QCMS implementation may trigger an out-of-bounds read via a crafted color profile, allowing remote attackers to obtain sensitive info...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2013-1681

CVE-2013-1681 is a Use-after-Free vulnerability in Mozilla Firefox affecting nsContentUtils::RemoveScriptBlocker. It impacts Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6, enabling remote code execution or a Denial of Servic...

CVE-2014-1562

CVE-2014-1562 affects Mozilla Firefox before 32.0, Firefox ESR before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1. The vulnerability arises from memory-safety issues in the browser engine, allowing remote attackers to cause memory corruption, crashes, or possi...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2025-8034

Mozilla Firefox and Thunderbird are affected by memory safety bugs that may lead to memory corruption. If successfully exploited, an attacker could execute arbitrary code or cause a denial of service (service failure) on the vulnerable system. Affected Versions include Firefox < 141, Firefox E...

CVE-2025-8037

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability where setting a nameless cookie with an equals sign in its value can shadow other cookies. This occurs even if the nameless cookie is transmitted over HTTP and the targeted shadowed cookie includes the Secure attribut...

CVE-2026-12293

CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...

CVE-2026-74990

Mozilla Thunderbird versions 140.13 , 153.0 , and 153 are affected by internal bugs that may lead to memory corruption or other security-relevant defects. While some defects could potentially be exploited with sufficient effort, specific exploit details are not provided in the documents. The vuln...

CVE-2006-0748

CVE-2006-0748 affects Mozilla Firefox/Thunderbird 1.x before 1.5.0.2 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. The vulnerability arises from an invalid and non-sensical ordering of table-related tags that results in a negative array index, enabling remote ar...

CVE-2006-1742

CVE-2006-1742 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The issue stems from improper handling of temporary variables that are not garbage collected, which could allow remote attackers to access freed memo...

CVE-2006-3809

CVE-2006-3809: Firefox <=1.5.0.4/Thunderbird <=1.5.0.4/SeaMonkey

CVE-2008-0416

CVE-2008-0416 describes multiple XSS vulnerabilities in Mozilla Firefox before 2.0.0.12, Thunderbird before 2.0.0.12, and SeaMonkey before 1.1.8. The issue allows remote attackers to inject arbitrary web script or HTML via certain character encodings, specifically: (1) a backspace character treat...

CVE-2008-5021

The CVE-2008-5021 vulnerability affects Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. It is caused by modifying properties of a file input element while it is still initializing, followed by using blur to access un...

CVE-2009-1836

CVE-2009-1836: The vulnerability arises from how Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17) use the HTTP Host header to determine the document context in a non-200 CONNECT response from a proxy. This can enable a man-in-the-middle attacker to modify the C...

CVE-2012-0452

Technical details about CVE-2012-0452 are not publicly provided in the connected documents. The initial description lists the vulnerability and affected products, but no further technical specifics or patch information are included here. Monitor for updates.

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2026-0818

Mozilla Thunderbird versions prior to 147.0.1 and 140.7.1 are vulnerable to a CSS-based exfiltration of content from partially encrypted emails. When a user requests to decrypt an inline OpenPGP message embedded within an HTML-formatted email, the decrypted content is rendered while the outer mes...

CVE-2026-2797

CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...

CVE-2026-6754

A Use-after-free vulnerability exists in the JavaScript Engine component of Mozilla Firefox and the Thunderbird email client. This flaw allows an attacker to compromise the accessibility of protected information . The vulnerability has been addressed in Firefox 150 , Firefox ESR 115.35 , Firefox ...

CVE-2006-6497

CVE-2006-6497 affects Mozilla Firefox 2.x (before 2.0.0.1) and Firefox 1.5.x (before 1.5.0.9), SeaMonkey before 1.0.7, and Thunderbird before 1.5.0.9. The issue, along with related flaws (CVE-2006-6498, CVE-2006-6499, CVE-2006-6501–CVE-2006-6505), enables memory corruption and crashes and can pot...

CVE-2008-2798

CVE-2008-2798 and related CVEs affected Mozilla Firefox (before 2.0.0.15), SeaMonkey (before 1.1.10), and Thunderbird (before 2.0.0.14), with issues in the layout/JavaScript processing that could crash the application and potentially allow arbitrary code execution via crafted content. The base vu...

CVE-2010-0179

CVE-2010-0179 affects Mozilla Firefox (pre-3.0.19 and pre-3.5.8 in the 3.x line) and SeaMonkey (pre-2.0.3), where the Firebug add-on’s XMLHttpRequestSpy module can improperly interact with chrome-privileged objects. This leads to arbitrary JavaScript execution via a crafted HTTP response due to t...

CVE-2011-0072

CVE-2011-0072 refers to an unspecified vulnerability in the browser engine affecting Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14, allowing remote attackers to cause memory corruption and application crashes or possibly execut...

CVE-2012-3970

CVE-2012-3970 is a Use-After-Free in Mozilla Firefox’s nsTArray_base::Length function. Affects Firefox < 15.0, Firefox ESR < 10.0.7, Thunderbird < 15.0 (and ESR 10.x < 10.0.7), and SeaMonkey

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2017-7847

Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...

CVE-2024-11159

CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...

CVE-2026-74956

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-8091

The Audio/Video: Playback component in Firefox , Firefox ESR , and Thunderbird is vulnerable to incorrect boundary conditions due to insufficient checking of unusual or exceptional states. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibi...

CVE-2006-1730

CVE-2006-1730 is a heap-based buffer overflow vulnerability caused by an integer overflow in the CSS letter-spacing handling, allowing remote code execution. Affected products and versions include Mozilla Firefox and Thunderbird 1.x before 1.5.0.2, and 1.0.x before 1.0.8; Mozilla Suite before 1.7...

CVE-2006-1739

CVE-2006-1739 is a memory-corruption flaw in the CSS border rendering path used by Mozilla Firefox/Thunderbird/SeaMonkey. The issue could crash the browser or potentially allow arbitrary code execution via crafted CSS (out-of-bounds writes/buffer overflow). Affected products include Firefox/Thund...

CVE-2006-4567

CVE-2006-4567 affects Firefox < 1.5.0.7 and Thunderbird

CVE-2006-5464

CVE-2006-5464 affects Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6. The issue, tied to the layout/processing path, allows remote attackers to cause a denial of service (crash) via unspecified vectors. Public advisories (Oracle/Linux/OpenVAS records) corroborate t...

CVE-2009-1833

CVE-2009-1833 affects Mozilla Firefox <= 3.0.10 (before 3.0.11), Mozilla Thunderbird <= 2.0.0.21 (before 2.0.0.22), and SeaMonkey

CVE-2009-2466

The CVE-2009-2466 issue affects Mozilla Firefox (and Thunderbird) up to version prior to 3.0.12, where the JavaScript engine can be abused to cause memory corruption, a crash, or potentially arbitrary code execution. The described vectors involve the engine internals in nsDOMClassInfo.cpp, JS_Has...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...