CVE-2026-6753

CVE-2026-6753 : This is a memory/boundary-condition vulnerability in the WebRTC component. The initial report identifies the root cause as incorrect boundary conditions in the WebRTC component, with an impact profile of Confidentiality, Integrity, and Availability all rated Low, and an overall CV...

CVE-2026-6761

CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...

CVE-2026-6765

CVE-2026-6765 affects Firefox and Thunderbird. The vulnerability is an information disclosure in the Form Autofill component. Root cause details are not provided beyond disclosure, but the issue is mitigated by fixes in Firefox 150 , Firefox ESR 140.10 , Thunderbird 150 , and Thunderbird 140.10 ....

CVE-2026-74939

Mozilla Firefox's DOM: Navigation component contains a privilege escalation flaw (CVSS 8.8 HIGH). Exploitation requires a network-based attacker to lure a user into visiting a crafted page. Affected versions must be upgraded to Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 1...

CVE-2009-2535

CVE-2009-2535 affects Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird, enabling remote attackers to trigger memory consumption and a crash (DoS) by supplying a large integer as the length property of a Select element. Root cause and exploit details are not expande...

CVE-2012-3105

Affected software: Mozilla Firefox (WebGL glBufferData path) and related Mozilla components (Firefox 4.x–12.0, ESR 10.x before 10.0.5, Thunderbird 5.0–12.0, SeaMonkey before 2.10). Vulnerability and root cause: The description states a flaw in an NVIDIA driver allows remote attackers to trigger m...

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2026-12311

CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...

CVE-2004-0761

CVE-2004-0761 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. The vulnerability allows remote attackers to use certain redirect sequences to spoof the security lock icon, making a web page appear encrypted. This is documented with a CVSS base score of 5.0 (Network atta...

CVE-2005-0590

CVE-2005-0590 affects Firefox <1.0.1, Thunderbird <1.0.1, and Mozilla

CVE-2012-1971

CVE-2012-1971 concerns Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The description identifies memory corruption and potential remote code execution or crashes related to garbage collection after certain MethodJIT execution, plus other unspecified vectors. Impact ...

CVE-2012-4212

Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.

CVE-2017-5411

CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2026-8959

CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...

CVE-2004-0908

CVE-2004-0908 affects Mozilla Firefox (before the Preview Release), Mozilla (before 1.7.3), and Thunderbird (before 0.8). The issue allows untrusted JavaScript to read and write to the clipboard via script-generated events (e.g., Ctrl-Ins), potentially exposing sensitive information. The connecte...

CVE-2008-6961

CVE-2008-6961 affects mailnews in Mozilla Thunderbird (before 2.0.0.18) and SeaMonkey (before 1.1.13). When JavaScript is enabled in mail, a malicious script can read DOM properties (documentURI, textContent) to disclose sensitive recipient information or comments in forwarded mail. This is a cli...

CVE-2011-2987

The connected documents confirm CVE-2011-2987 is a heap overflow in the ANGLE library used by Mozilla’s WebGL implementation (Firefox/SeaMonkey/related) that could allow remote code execution. The issue is tied to the ANGLE heap overflow in WebGL code paths; exploitation would be via remote attac...

CVE-2014-1595

Affected software: Mozilla Firefox (non-ESR) < 34.0 and Firefox ESR < 31.3, plus Mozilla Thunderbird

CVE-2025-4086

CVE-2025-4086 affects Thunderbird for Android and Firefox/ Thunderbird versions earlier than 138. The issue is triggered by a filename containing a large number of encoded newline characters that can obscure the file extension in the download dialog, potentially misleading users about the downloa...

CVE-2026-6750

CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...

CVE-2026-74990

CVE-2026-74990 affects Thunderbird ESR 140.13, ESR 153.0, and Thunderbird 153, where internally found bugs showed evidence of memory corruption or security-relevant defects. Mozilla assesses that, with enough effort, some could have been exploitable, scoring it Critical (CVSS 9.8). The vulnerabil...

CVE-2002-2436

CVE-2002-2436 affects Mozilla's CSS :visited handling in Firefox (pre-4.0), Thunderbird (pre-3.3), and SeaMonkey (pre-2.1). The flaw allows a crafted HTML document to trigger information disclosure about visited pages, constituting a partial confidentiality impact. The vulnerability is described ...

CVE-2004-0906

CVE-2004-0906 is supported by multiple feeds: Mozilla’s XPInstall installer in Firefox (pre-Preview Release), Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure file permissions for files inside XPI packages. This can let a local user overwrite arbitrary files or execute code. Connect...

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2010-0161

CVE-2010-0161 affects Thunderbird (before 2.0.0.24) and SeaMonkey (before 1.1.19) on Windows, where the nsAuthSSPI::Unwrap function in extensions/auth/nsAuthSSPI.cpp can be triggered by data from a remote SMTP/IMAP/POP server using SSPI. This may cause heap memory corruption and application crash...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2014-1560

CVE-2014-1560 affects Mozilla Firefox before 31.0 and Thunderbird before 31.0. The issue is in parsing X.509 certificates: a crafted certificate that does not use ASCII character encoding in a required context can trigger a denial of service. The vulnerability is triggered during certificate pars...

CVE-2026-16360

Memory safety bugs found in Mozilla Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152, with evidence of memory corruption and potential remote code execution. The issues were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected product family: Mozilla Firefox ESR (olde...

CVE-2026-6755

CVE-2026-6755 describes a mitigation bypass in the DOM: postMessage component. Affected products reference Mozilla Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 6.5 (Network attack vector, Low attack complexity, Privileges requ...

CVE-2026-6759

CVE-2026-6759 is a use-after-free in the Mozilla Widget: Cocoa component. Affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This is confirmed across multiple connected advisories and CVE l...

CVE-2026-75874

A critical (CVSS 10.0) sandbox escape in Firefox and Thunderbird's Remote Settings Client component allows remote, unauthenticated attackers to break out of the application sandbox and achieve full system compromise. No exploitation has been reported, but the flaw affects any Firefox/Thunderbird ...

CVE-2009-3980

CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....

CVE-2010-2770

CVE-2010-2770 affects Mozilla-based products on Mac OS X: Mozilla Firefox (before 3.5.12 and 3.6.x before 3.6.9), Thunderbird (before 3.0.7 and 3.1.x before 3.1.3), and SeaMonkey (before 2.0.7). The vulnerability arises from a crafted font in a data: URL that can trigger memory corruption, leadin...

CVE-2012-0454

CVE-2012-0454 describes a use-after-free in Mozilla Firefox (including Firefox 4.x–10.0 and ESR 10.x before 10.0.3), Thunderbird 5.0–10.0, and SeaMonkey before 2.8 on 32-bit Windows 7. The issue arises when using the file-open dialog in a child window, related to IUnknown_QueryService in shlwapi....

CVE-2026-12315

The CVE-2026-12315 issue is a mitigation bypass in the DOM: Security component affecting Firefox and Thunderbird. According to the sources, it is fixed in Firefox 152 and Firefox ESR 140.12, as well as Thunderbird 152 and Thunderbird 140.12. The Debian/Red Hat/OSV/NVD entries corroborate a broad ...

CVE-2026-16387

CVE-2026-16387 is a site isolation issue in the Mozilla Firefox Networking component. The vulnerability is fixed in Firefox 153 and Firefox ESR 140.13. The available documents do not specify the exact vulnerable versions beyond the fix, nor do they provide exploitation details. Affected software ...

CVE-2026-8946

The CVE-2026-8946 entry concerns the Audio/Video: Web Codecs component and its boundary-condition handling. Affected software is Firefox (and ESR releases) where the vulnerability was addressed by fixes in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11. The underlying issue is described ...

CVE-2004-0648

The CVE-2004-0648 issue affects Mozilla Suite <=1.7.0+1, Firefox <=0.9.1+1, and Thunderbird

CVE-2011-2992

CVE-2011-2992 affects the Ogg reader in the browser engine of Mozilla Firefox (4.x–5) and SeaMonkey (2.x up to 2.3) and possibly other products, causing memory corruption and potential denial of service or arbitrary code execution via unspecified vectors. The root cause is memory safety issues in...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2026-12329

CVE-2026-12329 is a memory-safety bug fixed in Thunderbird ESR 140.12 (and Firefox ESR 140.12). Affected products include Thunderbird/Firefox ESR 140.12; CVSSv3.1 base score 7.5 (HIGH) with NETWORK attack vector, high confidentiality/integrity/availability impact, user interaction required. Remed...

CVE-2026-16381

CVE-2026-16381 affects Mozilla Firefox (Networking: DNS component). It is a same-origin policy bypass vulnerability with a CVSS v3.1 base score of 9.1 (CRITICAL). The description indicates the issue was fixed in Firefox 153 and Firefox ESR 140.13. The connected sources confirm the fix versions; n...

CVE-2026-6763

CVE-2026-6763 is a mitigation bypass in the File Handling component that was fixed in Firefox 150 and Firefox ESR 140.10, and in Thunderbird 150 and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:15892, ALSA-2… etc.) corroborate that Thunderbird/firefo...

CVE-2004-0764

CVE-2004-0764 affects Mozilla-based browsers (Mozilla before 1.7; Firefox before 0.9; Thunderbird before 0.7) where the chrome flag and XML User Interface Language (XUL) files allow remote websites to hijack the browser UI. The vulnerability arises from XUL/UI manipulation that lets a site contro...

CVE-2005-0149

CVE-2005-0149 affects Thunderbird 0.6–0.9 and Mozilla 1.7–1.7.3: cookies in mail messages are not blocked by the network.cookie.disableCookieForMailNews preference, allowing a remote attacker to bypass the user’s cookie policy via HTTP content in emails. Connected advisories confirm multiple vend...

CVE-2026-16389

CVE-2026-16389 affects the Libraries component of NSS. The root cause is described as incorrect boundary conditions that lead to an integer overflow. The vulnerability is rated high (CVSS v3.1 base score 9.8; CRITICAL; network attack vector, no privileges, no user interaction) and would impact sy...

CVE-2026-2761

CVE-2026-2761 is a sandbox-escape vulnerability in the Graphics: WebRender component of Mozilla Firefox/Thunderbird. The issue is fixed in Firefox 148, Firefox ESR 115.33 and 140.8, as well as Thunderbird 148 and Thunderbird 140.8 per the provided advisories. Connected documents confirm this exac...

CVE-2026-8954

CVE-2026-8954 affects Mozilla Firefox’s Audio/Video component. The issue is described as incorrect boundary conditions and an integer overflow, with a fix implemented in Firefox 151 and Firefox ESR 140.11. The available sources do not provide additional technical specifics such as the exact vulne...