CVE-2006-2775

The CVE-2006-2775 issue affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. It arises from XUL attribute handling that can be associated with an incorrect URL under certain conditions, potentially letting a persisted string be linked to the wrong URL and thereby bypass restrictions. The fla...

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2008-5024

CVE-2008-5024 concerns Mozilla Firefox 3.x prior to 3.0.4, Firefox 2.x prior to 2.0.0.18, Thunderbird 2.x prior to 2.0.0.18, and SeaMonkey 1.x prior to 1.1.13. The issue arises from improper escaping of quote characters in XML processing via E4X (default namespace), enabling remote XML injection....

CVE-2009-1304

CVE-2009-1304 affects the JavaScript engine in Mozilla Firefox 3.x prior to 3.0.9, Thunderbird prior to 2.0.0.22, and SeaMonkey prior to 1.1.16. The vulnerability arises from the engine’s handling of (1) js_FindPropertyHelper (related to Math and Date) and (2) js_CheckRedeclaration, enabling remo...

CVE-2009-2210

CVE-2009-2210 affects Mozilla Thunderbird before 2.0.0.22 and SeaMonkey before 1.1.17. It allows a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code via a multipart/alternative e‑mail message containing a text/enhanced part that triggers access...

CVE-2010-3131

CVE-2010-3131 is an untrusted search path vulnerability in Firefox/SeaMonkey/Thunderbird where dwmapi.dll loaded from the current working directory can be exploited if a malicious HTML/EML file is opened. The issue occurs on Windows (not Linux per the sources) when the browser loads dwmapi.dll at...

CVE-2011-0062

This CVE (CVE-2011-0062) affects Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8, per the Initial Description. It arises from multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crash (DoS) or potentially allow arbitra...

CVE-2011-2375

CVE-2011-2375 is a set of multiple unspecified vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox before 5.0 and Thunderbird through 3.1.11 . Exploitation could cause memory corruption and a crash, with a possible remote code execution via unknown vectors. The connected Mira...

CVE-2012-1948

CVE-2012-1948 is a member of a set of vulnerabilities in the Mozilla browser engine affecting Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The issue enables remote attackers to cause a denial of serv...

CVE-2025-3031

The Mozilla Firefox browser and Mozilla Thunderbird email client are vulnerable to an information disclosure flaw. An attacker could read 32 bits of values spilled onto the stack within a JIT compiled function . This vulnerability could allow a malicious actor to compromise the confidentiality an...

CVE-2025-4085

The Firefox web browser and Thunderbird email client are affected by a vulnerability involving insecure management of privileges. An attacker who gains control over a content process can leverage the privileged UITour actor to leak sensitive information or escalate privileges. This flaw impacts v...

CVE-2025-4089

Mozilla Firefox and Thunderbird are vulnerable to local code execution due to insufficient escaping of special characters in the "copy as cURL" feature. An attacker could trick a user into executing a manipulated command, potentially leading to the execution of arbitrary code on the user's system...

CVE-2026-16357

This vulnerability exists in the Graphics component of the Mozilla Firefox and Thunderbird browsers, caused by incorrect boundary conditions . It affects multiple versions, including Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Remediation is ...

CVE-2026-6748

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a flaw in the Audio/Video: Web Codecs component due to uninitialized memory . In certain instances, this vulnerability can be exploited by a remote attacker to execute arbitrary code . The issue has been addressed ...

CVE-2026-6750

A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla Firefox and the Thunderbird email client. The root cause is attributed to deficiencies in access control , which could allow an attacker to enhance their privileges remotely. This vulnerability has been ad...

CVE-2026-74952

CVE-2026-74952 is a privilege escalation vulnerability affecting the Application Update component of Mozilla Thunderbird ESR and Mozilla Firefox . The flaw allows attackers to bypass security restrictions. Remediation is available in Thunderbird 153.2 , Firefox 154 , Firefox ESR 153.2 , and Thund...

CVE-2006-1736

Technical details (affected product/version/root cause/impact) are not publicly provided in the connected documents. Monitor for updates.

CVE-2006-2779

CVE-2006-2779 affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The vulnerability enables memory corruption leading to denial of service (crash) and potential remote code execution via multiple vectors (including nested tags in a select, DOMNodeRemoved mutation events, Content-implemente...

CVE-2012-0457

CVE-2012-0457 is a use-after-free in the Firefox DOM/SVG handling: the nsSMILTimeValueSpec::ConvertBetweenTimeContainer path can be triggered via SVG animations to allow remote code execution. Affected products and versions per sources include Mozilla Firefox before 3.6.28 and 4.x through 10.0, F...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2026-6758

The Firefox web browser and Thunderbird email client are affected by a use-after-free vulnerability in the JavaScript: WebAssembly component . This flaw occurs when the software attempts to use memory after it has been freed, which could allow a remote attacker to trigger a service failure . The ...

CVE-2026-74955

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-74957

A mitigation bypass exists in the Safe Browsing component of Mozilla Firefox and Thunderbird . This vulnerability affects multiple versions, including Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The issue has been addressed in th...

CVE-2006-3113

CVE-2006-3113 affects Mozilla Firefox

CVE-2008-1236

CVE-2008-1236 affects Mozilla Firefox (before 2.0.0.13), Mozilla Thunderbird (before 2.0.0.13), and SeaMonkey (before 1.1.9). The issue stems from memory-related vulnerabilities in the layout/web content processing, described as memory corruption via layout-engine interactions, allowing a remote ...

CVE-2008-1237

CVE-2008-1237 affects SeaMonkey before 1.1.9 (and related Mozilla components) per the description: multiple vulnerabilities in the JavaScript engine could allow a remote attacker to cause a crash and potentially execute arbitrary code. Connected Nessus/NASA text confirms SeaMonkey, Firefox, and T...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2011-0061

CVE-2011-0061 affects Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12. The vulnerability is a buffer overflow triggered by a crafted JPEG image, enabling remote attackers to execute arbitrary code or cause a denial of service (application crash). MITRE/O...

CVE-2011-2983

CVE-2011-2983 affects Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x. Root cause: improper handling of RegExp.input, which can bypass the Same Origin Policy and allow reading data from a different domain via a crafted page (potential use-after-free). E...

CVE-2025-6435

Mozilla Firefox and Thunderbird versions prior to 140 are affected by a vulnerability where saving a response from the Network tab in Devtools via the Save As context menu may fail to append the .download file extension. This lack of extension sanitization could lead to a user inadvertently runni...

CVE-2025-9187

CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird

CVE-2026-16363

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . While the vulnerability is documented as having a CRITICAL sever...

CVE-2026-16384

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVE-2026-6753

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a flaw involving incorrect boundary conditions in the WebRTC component . In some environments, this vulnerability is also associated with the execution of operations outside of the buffer in memory. Exploiting this...

CVE-2026-74936

A use-after-free in the JavaScript: WebAssembly component of Firefox/Thunderbird can lead to memory corruption and arbitrary code execution. CVSS 9.8 (network, no auth required). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, and 153.1; Debian and Slackware packages updated...

CVE-2026-74978

Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-8959

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. This input validation error allows for potential sandbox escapes in affected versions. The vulnerability has been addres...

CVE-2004-0902

The CVE-2004-0902 entry refers to multiple heap-based buffer overflows in Mozilla Firefox and Mozilla suite components (Firefox before the Preview Release, Mozilla before 1.7.3, Thunderbird before 0.8). The issues allow remote attackers to cause an application crash (DoS) or execute arbitrary cod...

CVE-2006-0884

CVE-2006-0884 affects Mozilla Thunderbird’s WYSIWYG editor (the rich mail composer) where an e-mail containing a JavaScript URI in the SRC attribute of an IFRAME can be executed when the user edits the message. The vulnerability enables user-assisted attackers to bypass JavaScript security settin...

CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...

CVE-2011-3647

CVE-2011-3647 affects Mozilla Firefox pre-3.6.24 and Thunderbird pre-3.1.6. The vulnerability arises from how the JSSubScriptLoader handles XPCNativeWrappers when calling loadSubScript in add-ons, enabling privilege escalation via a crafted web site that exploits unwrapping behavior. Related to C...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2013-1707

CVE-2013-1707 is a stack-based buffer overflow in Mozilla Updater used by Mozilla Maintenance Service, enabling local privilege escalation via a long pathname on the command line. Affected products/versions include Mozilla Firefox up to version 23.0 (and ESR), Thunderbird up to 17.0.8, with corre...

CVE-2013-5600

CVE-2013-5600 is a use-after-free in Mozilla projects where the nsIOService::NewChannelFromURIWithProxyFlags function can be exploited via blob: URLs to execute arbitrary code. Affected packages/versions include Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbir...

CVE-2025-4090

A vulnerability in Thunderbird for Android allows potentially sensitive library locations to be leaked via Logcat logs. This issue also impacts Firefox versions prior to 138 . The root cause involves the improper logging of internal paths, which could potentially provide information to an attacke...

CVE-2025-8040

Mozilla Firefox and Thunderbird are affected by memory safety bugs involving memory corruption. The vulnerability arises from the execution of operations outside of the buffer in memory , which could allow a remote attacker to cause a service failure or potentially execute arbitrary code with suf...