CVE-2026-74937

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74988

Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Fire...

CVE-2006-4571

CVE-2006-4571 is evidenced in multiple Firefox/Thunderbird/SeaMonkey advisories as causing crashes and memory corruption, with potential for remote code execution. Affected: Firefox before 1.5.0.7, Thunderbird before 1.5.0.7, SeaMonkey before 1.0.5. The issue is associated with JavaScript executi...

CVE-2008-5507

CVE-2008-5507 affects Mozilla products: Firefox 2.x before 2.0.0.19, Firefox 3.x before 3.0.5, SeaMonkey 1.x before 1.1.14, and Thunderbird 2.x before 2.0.0.19. Root cause: bypass of the same-origin policy via a JavaScript URL that redirects to a target resource, triggering an error if the target...

CVE-2010-1202

CVE-2010-1202 affects Mozilla Firefox 3.5.x before 3.5.10, Firefox 3.6.x before 3.6.4, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. It is part of a set of vulnerabilities in the JavaScript engine/browser engine where memory corruption may lead to a crash or, potentially, arbitrary code e...

CVE-2011-3661

CVE-2011-3661 affects Mozilla’s YARR library used by Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6. A crafted JavaScript input could crash the application or, possibly, allow code execution. Connected updates indicate fixes were applied in SeaMonkey 2.6 and related Firefox/Thunde...

CVE-2013-1685

CVE-2013-1685 is a use-after-free in nsIDocument::GetRootElement that affects Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7, allowing remote code execution or a heap memory corruption-based DoS via a crafted site. Co...

CVE-2025-3033

The Mozilla Firefox (prior to 137.0) and Mozilla Thunderbird (prior to 137.0) browsers/clients on Windows are vulnerable to a flaw where selecting a malicious Windows .url shortcut from the local filesystem can lead to an unexpected file upload . This issue is specific to the Windows operating sy...

CVE-2025-8028

On arm64 architecture, a WASM br_table instruction containing numerous entries can cause the label to be positioned too far from the instruction. This results in truncation and the incorrect computation of the branch address . This vulnerability affects Firefox versions prior to 141, Firefox ESR ...

CVE-2026-6771

The DOM: Security component in Mozilla Firefox , Firefox ESR , and Thunderbird contains a mitigation bypass vulnerability. A malicious actor could exploit this flaw to circumvent existing security restrictions remotely. The issue has been addressed in Firefox 150 , Firefox ESR 140.10 , Thunderbir...

CVE-2026-74938

A mitigation bypass vulnerability exists in the JavaScript: GC component of Firefox and Thunderbird . This flaw impacts multiple versions and was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the vulnerability is identified, the documents do not pr...

CVE-2006-2781

CVE-2006-2781 describes a double-free vulnerability in nsVCard.cpp that affects Mozilla Thunderbird prior to 1.5.0.4 and SeaMonkey prior to 1.0.2 . An attacker could craft a VCard containing invalid base64 characters to trigger a vulnerability, potentially causing a denial of service (hang) and, ...

CVE-2006-3811

CVE-2006-3811 is a memory corruption crash vulnerability within Mozilla Firefox components (notably the Firefox 1.5.x line around the 1.5.0.5 release) and related Mozilla projects (SeaMonkey/Thunderbird in affected bundles). The issue manifests as crashes and is described as memory corruption tha...

CVE-2007-5340

CVE-2007-5340 is part of multiple vulnerabilities in the Javascript engine of Mozilla Firefox (<2.0.0.8), Thunderbird (<2.0.0.8), and SeaMonkey (

CVE-2008-5506

CVE-2008-5506 affects Mozilla components (e.g., Firefox/Thunderbird/SeaMonkey) where an XMLHttpRequest to an attacker-controlled resource that performs a 302 redirect to a different domain can bypass same-origin policy, allowing reading of the redirected response. This can enable a remote attacke...

CVE-2012-0464

CVE-2012-0464 is a use-after-free vulnerability in the Mozilla Firefox browser engine. Affected products include Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, and SeaMonkey before 2.8. The issue can allow remote attacke...

CVE-2025-1942

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability in the String.toUpperCase() function. When this function results in a longer string, it can incorporate uninitialized memory into the output. This flaw originates from access to an uninitialized point...

CVE-2025-8029

Mozilla Thunderbird and Firefox (including ESR versions) are vulnerable to the execution of javascript: URLs when used within object and embed tags. This issue affects versions prior to Firefox 141 , Firefox ESR 128.13 , Firefox ESR 140.1 , Thunderbird 141 , Thunderbird 128.13 , and Thunderbird 1...

CVE-2026-16368

The JavaScript: WebAssembly component in the Firefox browser and Thunderbird mail client is vulnerable to incorrect boundary conditions . This flaw can lead to security issues, including the potential for arbitrary code execution or sandbox escapes . The vulnerability has been patched in Firefox ...

CVE-2026-16389

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-74987

Mozilla Thunderbird and Firefox are affected by internally found bugs that may lead to memory corruption or other security-relevant defects. These issues were identified in Thunderbird ESR 140.13 , Thunderbird ESR 153.0 , and Thunderbird 153 . While the exact root cause is not detailed, the repor...

CVE-2006-2786

CVE-2006-2786 is an HTTP response smuggling vulnerability affecting Mozilla Firefox and Thunderbird prior to 1.5.0.4. According to connected advisories, an attacker could craft responses that a proxy or header formatting could fool the client into treating as responses from two different sites, p...

CVE-2011-0075

CVE-2011-0075 is an unspecified vulnerability in the Mozilla Firefox browser engine affecting Firefox 3.5.x before 3.5.19, Firefox 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14. The issue can cause a denial of service via memory corruption and application crash, with...

CVE-2013-1677

CVE-2013-1677 corresponds to a vulnerability in Mozilla Firefox before 21.0 (and Thunderbird before 17.0.6) where gfxSkipCharsIterator::SetOffsets allows remote code execution or a denial of service via an out-of-bounds read. The connected MiracleLinux/openSUSE/NASL advisories confirm Firefox/xul...

CVE-2025-8031

The Mozilla Firefox , Firefox ESR , and Thunderbird email clients are vulnerable to a security flaw where the username:password portion of URLs was not correctly stripped from CSP reports . This oversight could potentially lead to the leakage of HTTP Basic Authentication credentials. The issue ha...

CVE-2026-12290

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird products. The vulnerability affected Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird 140.12 . No specific root cause or exploitation details are provided in the d...

CVE-2026-2796

CVE-2026-2796 describes a JIT miscompilation in the JavaScript: WebAssembly component that affects Firefox and Thunderbird prior to version 148. The root cause is a JIT miscompilation in the WebAssembly pathway within the JavaScript engine, leading to a high-severity impact (as reflected by the C...

CVE-2026-6784

Mozilla Firefox and Thunderbird versions 149 and earlier are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed and fixed in Firefox 150 and Thunderbird 150 . Evidenc...

CVE-2026-7324

Mozilla Firefox (version 150.0.0) and Thunderbird (version 150.0.0) are affected by memory safety bugs that result in memory corruption. These flaws could potentially be exploited to achieve arbitrary code execution . The issue was addressed in the release of Firefox 150.0.1 and Thunderbird 150.0...

CVE-2026-74961

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2006-3806

CVE-2006-3806 refers to multiple integer overflows in the JavaScript engine affecting Mozilla Firefox (pre-1.5.0.5), Thunderbird (pre-1.5.0.5), and SeaMonkey (pre-1.0.3). The primary issues involve long strings in Object/Array/String.toSource and related string function arguments, with the potent...

CVE-2006-3810

CVE-2006-3810 is an XSS vulnerability in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 that can be exploited via the XPCNativeWrapper(window).Function construct to inject arbitrary web script/HTML. The issue is triggered by cross-site scripting when a ...

CVE-2008-5503

CVE-2008-5503 affects Mozilla Firefox 2.x up to 2.0.0.19, Mozilla Thunderbird 2.x up to 2.0.0.19, and SeaMonkey 1.x up to 1.1.14. The vulnerability arises from the loadBindingDocument function failing to enforce same-domain policy checks, enabling remote attackers to read or access data from othe...

CVE-2010-3769

CVE-2010-3769 affects Mozilla Firefox (pre-3.5.16 and pre-3.6.13 on Windows), Thunderbird (pre-3.0.11 and pre-3.1.7), and SeaMonkey (pre-2.0.11) due to a flaw in line-breaking when handling very long strings. The root cause is a buffer over-read triggered by a crafted document.write call, enablin...

CVE-2010-3777

CVE-2010-3777 is an unspecified vulnerability in Mozilla Firefox 3.6.x before 3.6.13 and Thunderbird 3.1.x before 3.1.7 that allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Connected advisories ...

CVE-2012-3962

CVE-2012-3962 affects Mozilla Firefox before 15.0, Firefox ESR before 10.0.7, Thunderbird before 15.0, Thunderbird ESR before 10.0.7, and SeaMonkey before 2.12. The issue is a failure to properly iterate through characters in a text run, enabling remote code execution via a crafted document. The ...

CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2013-1686

CVE-2013-1686 is a use-after-free in the mozilla::ResetDir function affecting Firefox before 22.0 (and Thunderbird before 17.0.7; ESR 17.x before 17.0.7). The connected MiracleLinux advisories map the issue to Firefox/XUL components and list affected versions (Firefox/Thunderbird 17.x line with 1...

CVE-2017-7845

CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox

CVE-2026-6751

The Audio/Video: Web Codecs component in Mozilla Firefox , Firefox ESR , and the Thunderbird email client is vulnerable to uninitialized memory . This flaw could allow a remote attacker to induce service interruptions . The vulnerability has been addressed in Firefox 150 , Firefox ESR 140.10 , Th...

CVE-2006-2787

CVE-2006-2787 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The issue arises in EvalInSandbox, where JavaScript calling valueOf on objects created outside the sandbox can let remote attackers gain privileges. This is a sandbox-escape vulnerability with full confidentiality, integrity,...

CVE-2006-6503

CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...

CVE-2007-0776

Technical details for CVE-2007-0776 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2011-2362

CVE-2011-2362 affects Mozilla Firefox (before 3.6.18), Thunderbird (before 3.1.11), and SeaMonkey (through 2.0.14): they do not distinguish cookies for two domain names that differ only by a trailing dot, allowing remote servers to bypass the Same Origin Policy via Set-Cookie headers. The issue s...

CVE-2011-2984

CVE-2011-2984 affects Mozilla Firefox prior to 3.6.20, SeaMonkey 2.x, and Thunderbird 3.x prior to 3.1.12. The issue is a tab-dropping handling bug that lets a remote attacker load a content area, register for drop events, and execute arbitrary JavaScript with chrome privileges. Public summaries ...

CVE-2011-3660

CVE-2011-3660 concernsMozilla Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey before 2.6, where multiple vulnerabilities in the browser engine enable remote denial of service or possibly arbitrary code execution via vectors that trigger a compartment mismatch in nsDOMMessageEvent::GetData and...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2018-18512

CVE-2018-18512 is a use-after-free vulnerability in Thunderbird triggered while playing a sound notification. The memory holding the sound data is freed while playback continues asynchronously, enabling potential crashes. Affected products: Thunderbird versions prior to 60.5. Root cause: use-afte...