CVE-2006-2776

CVE-2006-2776 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. Privileged UI code calls content-defined setters on an object prototype, enabling remote code execution at higher privileges. Impact is remote code execution with web content privileges; mitigation is upgrading Firefox/Thunde...

CVE-2006-3805

CVE-2006-3805 affects Mozilla Firefox (before 1.5.0.5), Thunderbird (before 1.5.0.5), and SeaMonkey (before 1.0.3). The issue stems from the JavaScript engine: a garbage-collection path could delete a temporary object still in use, potentially allowing arbitrary code execution. Public advisories ...

CVE-2006-3807

CVE-2006-3807 describes a privilege-escalation vulnerability in Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The issue arises when the standard Object() constructor is redefined by script, allowing named JavaScript functions to reference a privileged parent...

CVE-2006-5463

CVE-2006-5463 affects Mozilla Firefox (before 1.5.0.8), Thunderbird (before 1.5.0.8), and SeaMonkey (before 1.0.6). The vulnerability arises from modifying a Script object while it is executing, which could allow remote attackers to execute arbitrary JavaScript bytecode. Exploitation could enable...

CVE-2008-2799

CVE-2008-2799 pertains to multiple unpatched JavaScript engine flaws in Mozilla Firefox (pre-2.0.0.15), Thunderbird (pre-2.0.0.14 and earlier), and SeaMonkey (pre-1.1.10). The vulnerabilities allow a remote attacker to cause a crash and potentially execute arbitrary code via unknown vectors relat...

CVE-2008-2802

The CVE-2008-2802 entry affects Mozilla Firefox <= 2.0.0.14/2.0.0.15? and earlier Thunderbird 2.0.0.14 and SeaMonkey

CVE-2009-1841

CVE-2009-1841 affects Mozilla products: Firefox <3.0.11, Thunderbird <2.0.0.22, SeaMonkey

CVE-2011-2982

CVE-2011-2982 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x/3.x before 3.1.12, SeaMonkey 1.x/2.x, and possibly other Mozilla-based products. The issue stems from multiple unspecified browser‑engine vulnerabilities causing memory corruption and remote code execution or DoS via unknown vec...

CVE-2011-3670

CVE-2011-3670 affects Firefox prior to 3.6.26 and 4.x–6.0, Thunderbird prior to 3.1.18 and 5.0–6.0, and SeaMonkey prior to 2.4. The issue: improper enforcement of IPv6 literal address syntax, allowing remote attackers to cause information disclosure by reading error messages from XMLHttpRequest c...

CVE-2012-3958

CVE-2012-3958 describes a use-after-free in Mozilla’s browser components, specifically nsHTMLEditRules::DeleteNonTableElements. A remote attacker could exploit this to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Affected products include M...

CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2013-1686

CVE-2013-1686 is a use-after-free in the mozilla::ResetDir function affecting Firefox before 22.0 (and Thunderbird before 17.0.7; ESR 17.x before 17.0.7). The connected MiracleLinux advisories map the issue to Firefox/XUL components and list affected versions (Firefox/Thunderbird 17.x line with 1...

CVE-2026-6766

CVE-2026-6766 affects NSS Libraries component. The issue is incorrect boundary conditions in NSS, with fixes landed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Affected platforms include Firefox/Thunderbird releases; remediation is upgrading to the indicated versi...

CVE-2026-8091

CVE-2026-8091 affects Mozilla Audio/Video: Playback with an incorrect boundary condition in the component. It is fixed by updating to Firefox 150, Thunderbird 150, and Firefox ESR 140.10.1 (and 140.10.2 per ESR updates) as well as Firefox ESR 115.35.2. Connected disclosures corroborate this is a ...

CVE-2005-2261

CVE-2005-2261 affects multiple browsers: Firefox <1.0.5, Thunderbird <1.0.5, Mozilla

CVE-2006-1732

Technical details (affected products, root cause, and exploit specifics) for CVE-2006-1732 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2008-1234

This CVE-2008-1234 relates to an XSS vulnerability in Mozilla components: Firefox < 2.0.0.13, Thunderbird < 2.0.0.13, and SeaMonkey

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2011-2376

CVE-2011-2376 affects Mozilla Firefox before 3.6.18 and Thunderbird before 3.1.11. The vulnerability is in the browser engine, described as unspecified, with memory corruption that can cause a denial of service or an eventual arbitrary code execution via unknown vectors, potentially crashing the ...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2013-0771

CVE-2013-0771 describes a heap-based buffer overflow in Mozilla Firefox’s gfxTextRun::ShrinkToLigatureBoundaries, affecting Firefox before 18.0 (and ESR 17.x before 17.0.1), Thunderbird before 17.0.2 (and ESR 17.x before 17.0.1), and SeaMonkey before 2.15. Successful exploitation via a crafted do...

CVE-2006-4570

CVE-2006-4570 affects Mozilla Thunderbird and SeaMonkey. With Load Images enabled, a remote XBL file loaded when viewing/forwarding/replying to a message can bypass the user’s JavaScript-disabled settings, enabling remote JavaScript execution. Affected versions in public advisories are Thunderbir...

CVE-2008-4061

CVE-2008-4061: An integer overflow in the MathML component of Mozilla Firefox can be triggered by an mtd element with a large rowspan value. Affects Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12. Impact: remote memory corruption, denial of ...

CVE-2008-5016

CVE-2008-5016 affects Mozilla Firefox (3.x up to 3.0.4), Thunderbird (2.x up to 2.0.0.18), and SeaMonkey (1.x up to 1.1.13). The issue is triggered by the layout engine and can cause a remote denial of service (crash) via multiple vectors that lead to an assertion failure or other consequences. A...

CVE-2008-5022

CVE-2008-5022 affects multiple Mozilla-based browsers: nsXMLHttpRequest::NotifyEventListeners in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13. Root cause: bypass of the same-origin policy due to bypassed inner window check...

CVE-2008-5512

CVE-2008-5512 affects Mozilla Firefox 3.x before 3.0.5 and Firefox/Thunderbird/SeaMonkey lines older than the cited versions; severity details align with NFV advisories. The vulnerability arises from a flaw in how page content can pollute XPCNativeWrappers, permitting remote attackers to run arbi...

CVE-2012-3956

CVE-2012-3956 is a use-after-free in MediaStreamGraphThreadRunnable::Run in Mozilla Firefox before 15.0 (and similar affected versions for Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, SeaMonkey before 2.12). Successful exploitation could allow remote attackers t...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2025-8034

CVE-2025-8034 involves memory safety bugs in Mozilla Firefox/Thunderbird across multiple releases (Firefox ESR 115.25, 128.12; Firefox/Thunderbird 140.x; ESR 115.26, 128.13, 140.1). Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected products list i...

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2006-1738

CVE-2006-1738 affects Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0. The vulnerability allows a remote attacker to cause a crash (DoS) by altering the (1) -moz-grid and (2) -moz-grid-group display styles. Root cause is...

CVE-2006-2778

CVE-2006-2778 affects Mozilla Firefox and Thunderbird before 1.5.0.4. The crypto.signText function can be triggered by certain optional Certificate Authority name arguments, causing an invalid array index and a buffer overflow. This may allow remote code execution. The entry’s CVSS v2 base score ...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2025-3033

CVE-2025-3033 affects Firefox on Windows (Thunderbird also affected per the entry), with exploitation involving selecting a malicious Windows .url shortcut from the local file system to upload an unexpected file. Affected versions are Firefox < 137 and Thunderbird

CVE-2025-3034

CVE-2025-3034 corresponds to memory-safety bugs in Firefox 136 and Thunderbird 136. Some flaws show memory corruption and could be exploitable with enough effort to run arbitrary code. Affected products are Firefox < 137 and Thunderbird

CVE-2025-8033

The CVE-2025-8033 issue is a memory-safety bug in Mozilla’s JavaScript engine where closing generators could be resumed, causing a null pointer dereference. Affected products include Firefox and Thunderbird forks across multiple release lines (Firefox < 141, ESR tracks <115.26, <128.13, ...

CVE-2025-8035

CVE-2025-8035 affects Mozilla Firefox and Thunderbird desktop clients (Firefox/Firefox ESR and Thunderbird up to versions around 140.x/141.x). The connected sources describe memory-safety bugs in Firefox ESR 128.12, 140.0, and Firefox/Thunderbird 140, plus similar issues in Thunderbird ESR lines,...

CVE-2006-2779

CVE-2006-2779 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The vulnerability enables memory corruption leading to denial of service (crash) and potential remote code execution via multiple vectors (including nested tags in a select, DOMNodeRemoved mutation events, Content-implemente...

CVE-2007-3844

CVE-2007-3844 affects Mozilla Firefox 2.0.0.5, Thunderbird 2.0.0.5 and earlier (1.5.0.13), and SeaMonkey 1.1.3. The issue allows remote attackers to perform cross-context scripting (XSS) with chrome privileges by injecting a javascript: or data: link into an about:blank document loaded by chrome ...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2009-1838

CVE-2009-1838 affects Mozilla Firefox (pre-3.0.11), Thunderbird (pre-2.0.0.22), and SeaMonkey (pre-1.1.17). The garbage-collection implementation can set an element’s owner document to null under unspecified circumstances, due to an incorrect event-handler context. This allows remote attackers to...

CVE-2010-2763

CVE-2010-2763 concerns the XPCSafeJSObjectWrapper (SJOW) in Mozilla’s Firefox/XULRunner implementation. The connected documents confirm a logical error in the SJOW scripted function handling on the Mozilla 1.9.1 development branch, allowing a caller to execute a function in the context of another...

CVE-2010-3131

CVE-2010-3131 is an untrusted search path vulnerability in Firefox/SeaMonkey/Thunderbird where dwmapi.dll loaded from the current working directory can be exploited if a malicious HTML/EML file is opened. The issue occurs on Windows (not Linux per the sources) when the browser loads dwmapi.dll at...

CVE-2012-1940

CVE-2012-1940 is a use-after-free in Mozilla’s browser engines. Affects Firefox 4.x–12.0, ESR 10.x prior to 10.0.5, Thunderbird 5.0–12.0, ESR 10.x prior to 10.0.5, and SeaMonkey before 2.10. The flaw is in nsFrameList::FirstChild when a container of absolutely positioned elements in a column chan...

CVE-2025-9180

CVE-2025-9180 describes a same-origin policy bypass in the Graphics: Canvas2D component affecting Firefox and Thunderbird. Affected versions include Firefox and Thunderbird before 142, and ESR channels before 115.27, 128.14, or 140.2. Several connected advisories confirm the same issue and provid...

CVE-2026-6769

CVE-2026-6769 is a privilege-escalation issue in the Firefox/Thunderbird Debugger component. The Initial Description states a fix in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:10757, Debian DLA/...

CVE-2026-6786

CVE-2026-6786 refers to memory-safety bugs in Mozilla products (Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, Thunderbird 149) with evidence of memory corruption. The description notes that some bugs could be exploited to run arbitrary code, and the fixes are implemented in Firefox 150, ...