CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...

CVE-2008-4070

The provided documents confirm CVE-2008-4070 is a heap-based buffer overflow in Thunderbird (before 2.0.0.17) and SeaMonkey (before 1.1.12) triggered by a long header in a news article when canceling a newsgroup message. Impact stated: remote code execution risk or application crash (denial of se...

CVE-2010-3181

CVE-2010-3181 pertains to an untrusted search path (DLL loading) vulnerability in Mozilla Firefox (pre-3.5.14), Firefox 3.6.x (pre-3.6.11), Thunderbird (pre-3.0.9 and pre-3.1.5), and SeaMonkey (pre-2.0.9) on Windows. The root cause is Trojan horse DLLs loaded from the current working directory, e...

CVE-2025-9180

CVE-2025-9180 describes a same-origin policy bypass in the Graphics: Canvas2D component affecting Firefox and Thunderbird. Affected versions include Firefox and Thunderbird before 142, and ESR channels before 115.27, 128.14, or 140.2. Several connected advisories confirm the same issue and provid...

CVE-2004-0757

CVE-2004-0757 describes a heap-based buffer overflow in the POP3 SendUidl capability of Mozilla < 1.7, Firefox < 0.9, and Thunderbird

CVE-2009-3982

The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...

CVE-2012-0443

CVE-2012-0443 affects Mozilla Firefox (4.x–9.0), Thunderbird (5.0–9.0) and SeaMonkey prior to 2.7. The browser engine vulnerabilities allow remote attackers to cause memory corruption, crash the application, or potentially execute arbitrary code via unknown vectors; several advisories reference t...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2017-7765

CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird

CVE-2025-4089

CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...

CVE-2008-2806

CVE-2008-2806 affects Mozilla Firefox <= 2.0.0.15 and SeaMonkey

CVE-2010-0167

CVE-2010-0167 affects Mozilla Firefox and related Mozilla products (Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; SeaMonkey before 2.0.3). The issue is a remote memory corruption vulnerability in the browser engine, tied to layout/nsBlockFrame.cpp ...

CVE-2010-1201

CVE-2010-1201 affects Mozilla Firefox 3.5.x before 3.5.10, Thunderbird before 3.0.5, and SeaMonkey before 2.0.5. The vulnerability is described as an unspecified memory corruption in the browser engine that could allow a remote attacker to cause a denial of service or potentially execute arbitrar...

CVE-2017-7755

CVE-2017-7755 affects Mozilla Firefox and Thunderbird installers on Windows. The Firefox installer can be made to load malicious DLLs stored in the same directory as the installer, enabling privilege escalation when the installer runs with elevated privileges. Affected products/versions include F...

CVE-2026-12289

CVE-2026-12289 describes a privilege-escalation vulnerability in the Graphics: WebRender component. The public description and connected advisories indicate this affects Mozilla Firefox and Thunderbird products, with fixes shipped in: Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbi...

CVE-2006-0295

CVE-2006-0295 affects Mozilla Firefox 1.5, Thunderbird 1.5 (when JavaScript is enabled in mail), and SeaMonkey older than 1.0. The vulnerability is a memory corruption caused by the QueryInterface method on built-in Location and Navigator objects, enabling remote code execution. Public references...

CVE-2006-1726

Technical details (affected product/versions, root cause, impact, remediation) for CVE-2006-1726 are not publicly provided in the supplied documents. Monitor for updates from vendors/security advisories.

CVE-2010-0163

CVE-2010-0163 affects SeaMonkey before 1.1.19 and Mozilla Thunderbird before 2.0.0.24. The issue stems from a mail-attachment parser that performs casts and line termination incorrectly, enabling a remote attacker to crash the application or potentially execute arbitrary code via a crafted messag...

CVE-2012-1964

CVE-2012-1964 corresponds to the certificate-warning clickjacking issue in Mozilla Firefox (4.x–12.0), Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–12.0, and SeaMonkey before 2.10. The vulnerability arises from improper handling of clickjacking on the about:certerror page, allowing a MITM atta...

CVE-2025-4088

CVE-2025-4088 describes a cross-origin CSRF issue in Thunderbird (and affected Firefox) where malicious sites could exploit Redirects via the Storage Access API to send credentialed requests to arbitrary endpoints. Affected products: Firefox < 138 and Thunderbird

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2006-1529

CVE-2006-1529 affects Firefox and Thunderbird up to versions prior to 1.5.0.2 and SeaMonkey up to 1.0.1, with exploitation possible via DHTML. The entry notes no public details as of 2006-04-13, and exact attack vectors, root cause, and fix status are not fully disclosed in the provided documents...

CVE-2011-2980

CVE-2011-2980 is described as a binary planting vulnerability in ThinkPadSensor::Startup that could be exploited to load a malicious DLL into the running Firefox/Thunderbird process. The issue is documented as a potential local attack vector requiring write access to an unspecified directory to p...

CVE-2011-2997

CVE-2011-2997 affects Mozilla Firefox (browser engine) versions on Windows/Linux/macOS as Firefox 6, Thunderbird before 7.0, and SeaMonkey before 2.4. Root cause: memory corruption in the browser engine that can cause denial of service or potentially allow arbitrary code execution via unknown vec...

CVE-2011-3001

CVE-2011-3001 affects Mozilla Firefox 4.x–6, Thunderbird before 7.0, and SeaMonkey before 2.4. The issue allows a user-assisted remote bypass of access restrictions by triggering an internal error on a crafted site that triggers adding a browser extension through a holding Enter key sequence. The...

CVE-2012-3105

Affected software: Mozilla Firefox (WebGL glBufferData path) and related Mozilla components (Firefox 4.x–12.0, ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, SeaMonkey before 2.10). Vulnerability and root cause: The description states a flaw in an NVIDIA driver allows remote attackers to trigger m...

CVE-2014-1586

CVE-2014-1586 affects Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2. The issue is that the code path in content/base/src/nsDocument.cpp does not consider whether WebRTC video sharing is occurring, allowing a remote attacker to obtain sensitive informa...

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2025-9182

CVE-2025-9182 denotes a denial-of-service caused by an out-of-memory condition in the Graphics: WebRender component. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird

CVE-2026-6746

This CVE (CVE-2026-6746) is a use-after-free in the DOM: Core & HTML component. The Initial document states it was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected documents also reference Mozilla advisories tying this CVE to Firefox...

CVE-2026-6773

The vulnerability CVE-2026-6773 is a denial-of-service caused by an integer overflow in the Graphics: WebGPU component. Affected products identified in the provided sources include Firefox and Thunderbird; the issue was fixed in Firefox 150 and Thunderbird 150. The CVE’s impact is documented as h...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2008-5052

Mozilla Firefox 2.x (pre-2.0.0.18), Thunderbird 2.x (pre-2.0.0.18), and SeaMonkey 1.x (pre-1.1.13) are affected by CVE-2008-5052. The vulnerability arises in AppendAttributeValue in the JavaScript engine and is described as memory corruption that can cause a remote crash (Denial of Service) via u...

CVE-2013-0797

CVE-2013-0797 affects Mozilla Updater components in Mozilla Firefox (pre-20.0), Firefox ESR (<17.0.5), Thunderbird (<17.0.5, ESR), and SeaMonkey (

CVE-2025-5272

CVE-2025-5272 arises from memory-safety bugs in Mozilla Firefox 138 and Thunderbird 138, with some bugs showing memory corruption that could potentially allow arbitrary code execution. The affected products are Firefox versions prior to 139 and Thunderbird versions prior to 139. The issue is addr...

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2009-2535

CVE-2009-2535 affects Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird, enabling remote attackers to trigger memory consumption and a crash (DoS) by supplying a large integer as the length property of a Select element. Root cause and exploit details are not expande...

CVE-2010-1212

CVE-2010-1212 affects Mozilla Firefox 3.6.x (before 3.6.7) and Thunderbird 3.1.x (before 3.1.1). The issue arises from memory-safety defects in the browser engine’s tracing/recording paths, specifically in TraceRecorder::record_JSOP_BINDNAME, depth handling in TraceRecorder::record_JSOP_GETELEM, ...

CVE-2011-3666

Based on the Connected documents, CVE-2011-3666 is tied to Mozilla Firefox and Thunderbird on Mac OS X where a fix for CVE-2011-2372 was incorrectly applied, allowing a user-assisted bypass related to executable handling of .jar-like files via crafted web content. The Nessus/OpenSSH-related advis...

CVE-2013-5591

CVE-2013-5591 affects Mozilla Firefox before 25.0 (and ESR 24.x before 24.1), Thunderbird before 24.1, and SeaMonkey before 2.22, due to an unspecified browser‑engine vulnerability that could allow a remote attacker to cause memory corruption and an application crash, or possibly execute arbitrar...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-6764

CVE-2026-6764 is an issue described as incorrect boundary conditions in the DOM: Device Interfaces component, affecting Firefox/Thunderbird. Public references in the connected advisories show fixes for this CVE in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and Thunderbird 140.10). The root...

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2013-0777

CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...

CVE-2025-8039

The CVE-2025-8039 entry concerns a vulnerability where search terms persist in the URL bar after navigating away from a search page. Affected software and versions are Mozilla Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird

CVE-2026-6749

CVE-2026-6749 is an information disclosure vulnerability in the Graphics: Canvas2D component, caused by uninitialized memory. It affects Firefox and Thunderbird products; Mozilla advisories state fixes in Firefox 150, Firefox ESR 115.35 and 140.10, and Thunderbird 150 and 140.10. Amazon Linux 2 a...

CVE-2026-6760

Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...

CVE-2026-6768

CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...

CVE-2026-6769

CVE-2026-6769 is a privilege-escalation issue in the Firefox/Thunderbird Debugger component. The Initial Description states a fix in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:10757, Debian DLA/...