CVE-2026-74941

A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component. This flaw affects the Firefox web browser and the Thunderbird mail client. The issue has been addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderb...

CVE-2026-74949

The Graphics: Canvas2D component in Firefox and Thunderbird is vulnerable to privilege escalation due to a use-after-free condition. This flaw has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbir...

CVE-2026-74986

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-84119

Mozilla Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by a use-after-free in the DOM: Navigation component . This security issue can lead to the execution of arbitrary code or privilege escalation. Remediation includes updating to Firefox 155 , Firefox ESR 115.40 ,...

CVE-2026-84128

A privilege escalation vulnerability exists in the WebDriver BiDi component of Firefox and Thunderbird . This issue was addressed in versions 155 of both products. While the exact root cause is not detailed, the vulnerability allows for elevated privileges. Exploitation details are not provided i...

CVE-2004-0765

The CVE-2004-0765 entry affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, where cert_TestHostName only validates the hostname portion of a certificate when the URI hostname is not an FQDN. This allows remote attackers to spoof trusted certificates. Root cause: certificat...

CVE-2006-1723

CVE-2006-1723 affects Firefox and Thunderbird prior to 1.5.0.2, and SeaMonkey prior to 1.0.1. The issue is described as an unspecified vulnerability that can cause a remote denial of service (crash) and possibly arbitrary code execution via unknown DHTML attack vectors. The initial document does ...

CVE-2006-2780

The CVE-2006-2780 entry affects Mozilla Firefox and Thunderbird prior to 1.5.0.4. The issue is an integer overflow in the jsstr tagify path, leading to memory corruption that can cause a remote denial of service (crash) and possibly arbitrary code execution. The vulnerability is assessed with a h...

CVE-2007-2867

CVE-2007-2867 involves multiple Mozilla components (Firefox 1.5.x before 1.5.0.12 and Firefox 2.x before 2.0.0.4, Thunderbird 1.5.x before 1.5.0.12 and 2.x before 2.0.0.4, SeaMonkey 1.0.9 and 1.1.2). The issue is described as memory-related vulnerabilities (dangling pointers, heap corruption, sig...

CVE-2009-0353

CVE-2009-0353 affects Mozilla components: Firefox 3.x before 3.0.6, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15. The vulnerability is related to the JavaScript engine and can allow a remote attacker to cause memory corruption and an application crash, potentially leading to arbitrary...

CVE-2012-1942

CVE-2012-1942 affects Mozilla Firefox 12.0, Thunderbird 12.0 and SeaMonkey 2.9 on Windows. The root cause is the Mozilla/Windows Updater Service loading a DLL in a privileged context, enabling a local user to gain privileges by placing a malicious DLL in a privileged path before updater execution...

CVE-2026-12298

A memory safety bug was identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability impacts Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described as a memory safety issue, specific details regarding the underlying m...

CVE-2026-12299

CVE-2026-12299 involves a JIT miscompilation vulnerability within the DOM: Core & HTML component . This issue impacts the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird...

CVE-2026-6765

The Form Autofill component in Mozilla Firefox and the Thunderbird email client is vulnerable to an information disclosure flaw. This vulnerability stems from deficiencies in access control for personal information, which could allow a malicious actor to gain unauthorized access to protected data...

CVE-2026-84142

CVE-2026-84142 covers internally discovered bugs in Thunderbird 154 that showed evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with sufficient effort. The fix ships in Thunderbird 155 , Firefox 155 , and corresponding ESR releases...

CVE-2005-0255

CVE-2005-0255 affects Mozilla Suite 1.7.3, Firefox 1.0, and Thunderbird before 1.0.2. The flaw is in string handling (nsTSubstring_CharT::Replace) where return values of functions that resize strings are not properly checked, which can lead to a reallocation failure and a pointer to a fixed addre...

CVE-2005-0399

CVE-2005-0399 describes a heap-based buffer overflow in GIF2.cpp used by Firefox (before 1.0.2), Mozilla (before 1.7.6), Thunderbird (before 1.0.2), and other apps sharing the same library. The vulnerability is triggered by a crafted GIF image containing a Netscape extension 2 block, allowing rem...

CVE-2006-1724

CVE-2006-1724 affects Firefox and Thunderbird before 1.5.0.2, 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0.1. It is an unspecified vulnerability related to DHTML that can cause a denial of service (crash) and possibly remote code execution. The initial document does n...

CVE-2006-2783

Technical details for CVE-2006-2783 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2006-3804

The CVE-2006-3804 entry describes a heap-based buffer overflow in Mozilla Thunderbird prior to 1.5.0.5 and SeaMonkey prior to 1.0.3 triggered by a VCard attachment with a malformed base64 field, due to an integer underflow, leading to a remote denial of service (crash). The vulnerability affects ...

CVE-2008-1235

CVE-2008-1235 affects Mozilla Firefox <2.0.0.13, Thunderbird <2.0.0.13, and SeaMonkey

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2008-4070

The provided documents confirm CVE-2008-4070 is a heap-based buffer overflow in Thunderbird (before 2.0.0.17) and SeaMonkey (before 1.1.12) triggered by a long header in a news article when canceling a newsgroup message. Impact stated: remote code execution risk or application crash (denial of se...

CVE-2009-2464

The CVE-2009-2464 issue affects Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird, where nsXULTemplateQueryProcessorRDF::CheckIsSeparator can be exploited via loading multiple RDF files in a XUL tree to cause memory corruption and potential code execution, leading to DoS or crash...

CVE-2010-3778

The CVE-2010-3778 issue affects Mozilla Firefox 3.5.x before 3.5.16 , Thunderbird before 3.0.11 , and SeaMonkey before 2.0.11 . It is described as an unspecified vulnerability allowing remote attackers to cause memory corruption and an application crash, potentially enabling arbitrary code execut...

CVE-2012-1953

CVE-2012-1953 affects Mozilla Firefox 4.x–13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0–13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11. The ElementAnimations::EnsureStyleRuleFor function can cause denial of service (buffer over-read, incorrect pointer dereference, hea...

CVE-2013-1726

CVE-2013-1726 affects Mozilla Updater in Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21. The issue is failure to ensure exclusive access to a MAR file, allowing a local attacker to gain privileges by plac...

CVE-2025-9184

The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...

CVE-2026-12312

A memory safety bug has been identified in Firefox and Thunderbird . The vulnerability is present in several versions, including Firefox 152 , Firefox ESR 140.12 , and Thunderbird 152 and Thunderbird 140.12 . This bug has been addressed in the aforementioned versions. No specific root cause detai...

CVE-2026-6761

A privilege escalation vulnerability exists in the Networking component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. The flaw is caused by deficiencies in access control , which could allow a malicious actor to remotely enhance their privileges. The issue has been addresse...

CVE-2026-74954

Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVE-2026-8094

The WebRTC component in Mozilla Firefox ESR and the Thunderbird email client is vulnerable to a flaw caused by incorrect code generation . This vulnerability allows a remote attacker to achieve arbitrary code execution . Remediation is available in Firefox ESR 140.10.2 and Thunderbird 140.10.2 . ...

CVE-2026-8954

The Audio/Video component in Firefox and Thunderbird is vulnerable to an integer overflow caused by incorrect boundary conditions . This flaw allows attackers to perform operations beyond the buffer limits in memory, which can lead to the access of confidential data . Affected versions include Fi...

CVE-2006-1529

CVE-2006-1529 affects Firefox and Thunderbird up to versions prior to 1.5.0.2 and SeaMonkey up to 1.0.1, with exploitation possible via DHTML. The entry notes no public details as of 2006-04-13, and exact attack vectors, root cause, and fix status are not fully disclosed in the provided documents...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2006-6505

CVE-2006-6505 involves multiple heap-based buffer overflows in Mozilla Thunderbird (before 1.5.0.9) and SeaMonkey (before 1.0.7). The vulnerability stems from parsing mail headers: (1) external message modies with long Content-Type headers and (2) long RFC2047-encoded (MIME non-ASCII) headers, en...

CVE-2010-0167

CVE-2010-0167 affects Mozilla Firefox and related Mozilla products (Firefox 3.0.x before 3.0.18, 3.5.x before 3.5.8, 3.6.x before 3.6.2; Thunderbird before 3.0.2; SeaMonkey before 2.0.3). The issue is a remote memory corruption vulnerability in the browser engine, tied to layout/nsBlockFrame.cpp ...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2013-6674

CVE-2013-6674 is an XSS vulnerability in Mozilla Thunderbird 17.x up to 17.0.8, Thunderbird ESR 17.x up to 17.0.10, and SeaMonkey before 2.20. The issue is triggered by an email containing a data: URL inside an IFRAME, allowing a user‑assisted remote attacker to inject arbitrary web script/HTML. ...

CVE-2014-1551

CVE-2014-1551 is a concrete use-after-free vulnerability in Mozilla Firefox’s FontTableRec destructor that can be triggered by crafted fonts in MathML content. Root cause: improper handling of a DirectWrite font-face object, allowing remote attackers to execute arbitrary code. Affected products/v...

CVE-2025-5272

Mozilla Firefox and Thunderbird versions prior to 139 (specifically version 138) are affected by memory safety bugs . These vulnerabilities involve memory corruption, which could potentially allow an attacker to execute arbitrary code with sufficient effort. The issue is mitigated by updating to ...

CVE-2026-8955

A privilege escalation vulnerability exists in the DOM: Workers component of the Firefox web browser and Thunderbird email client. The flaw is caused by insecure management of privileges , which could allow a malicious actor to cause service interruptions or trigger service failures. This issue h...

CVE-2004-0903

CVE-2004-0903 describes a stack-based buffer overflow in the writeGroup function of nsVCardObj.cpp, affecting Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8. An attacker could remotely execute arbitrary code by processing malformed VCard attachments d...

CVE-2005-2353

CVE-2005-2353 affects Mozilla Thunderbird. The advisory notes that the script run-mozilla.sh, when Thunderbird is built with debugging enabled, can be exploited by local users to create or overwrite arbitrary files via a symlink attack on temporary files. Debian security notices (DSA-1046/DSA-105...

CVE-2006-1045

The CVE affects Mozilla Thunderbird 1.5. When Block loading of remote images in mail messages is enabled, Thunderbird’s HTML rendering engine does not fully block external images in inline HTML attachments. This could allow a remote attacker to obtain sensitive information (e.g., application vers...

CVE-2006-4566

CVE-2006-4566 is a heap corruption vulnerability in Mozilla family browsers caused by parsing a malformed JavaScript regular expression that ends with a backslash () in an unterminated character class (e.g., []). It affects Mozilla Firefox, Thunderbird, and SeaMonkey as listed in connected adviso...

CVE-2011-2985

CVE-2011-2985 affects Mozilla Firefox 4.x–5, Thunderbird before 6, and SeaMonkey 2.x before 2.3. The issue is described as memory corruption/memory safety hazards in the browser engine that could cause a crash or remote code execution via unspecified vectors. Connected documents corroborate invol...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2025-4088

A security vulnerability in Mozilla Firefox and the Thunderbird email client allows malicious websites to use redirects to send credentialed requests to arbitrary endpoints. This occurs on any site that has invoked the Storage Access API , enabling potential Cross-Site Request Forgery (CSRF) atta...