CVE-2012-1971

CVE-2012-1971 concerns Mozilla Firefox (pre-15.0), Thunderbird (pre-15.0), and SeaMonkey (pre-2.12). The description identifies memory corruption and potential remote code execution or crashes related to garbage collection after certain MethodJIT execution, plus other unspecified vectors. Impact ...

CVE-2012-3983

CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...

CVE-2026-6753

CVE-2026-6753 : This is a memory/boundary-condition vulnerability in the WebRTC component. The initial report identifies the root cause as incorrect boundary conditions in the WebRTC component, with an impact profile of Confidentiality, Integrity, and Availability all rated Low, and an overall CV...

CVE-2026-6758

CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component. Affected: Firefox and Thunderbird; fixed in Firefox 150 and Thunderbird 150. CVSS v3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No explicit exploit details provided in the connected documents.

CVE-2004-0648

The CVE-2004-0648 issue affects Mozilla Suite <=1.7.0+1, Firefox <=0.9.1+1, and Thunderbird

CVE-2004-0906

CVE-2004-0906 is supported by multiple feeds: Mozilla’s XPInstall installer in Firefox (pre-Preview Release), Mozilla before 1.7.3, and Thunderbird before 0.8 sets insecure file permissions for files inside XPI packages. This can let a local user overwrite arbitrary files or execute code. Connect...

CVE-2005-0149

CVE-2005-0149 affects Thunderbird 0.6–0.9 and Mozilla 1.7–1.7.3: cookies in mail messages are not blocked by the network.cookie.disableCookieForMailNews preference, allowing a remote attacker to bypass the user’s cookie policy via HTTP content in emails. Connected advisories confirm multiple vend...

CVE-2011-2992

CVE-2011-2992 affects the Ogg reader in the browser engine of Mozilla Firefox (4.x–5) and SeaMonkey (2.x up to 2.3) and possibly other products, causing memory corruption and potential denial of service or arbitrary code execution via unspecified vectors. The root cause is memory safety issues in...

CVE-2012-5354

CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...

CVE-2017-5425

CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird

CVE-2025-4086

CVE-2025-4086 affects Thunderbird for Android and Firefox/ Thunderbird versions earlier than 138. The issue is triggered by a filename containing a large number of encoded newline characters that can obscure the file extension in the download dialog, potentially misleading users about the downloa...

CVE-2026-12291

CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...

CVE-2004-0764

CVE-2004-0764 affects Mozilla-based browsers (Mozilla before 1.7; Firefox before 0.9; Thunderbird before 0.7) where the chrome flag and XML User Interface Language (XUL) files allow remote websites to hijack the browser UI. The vulnerability arises from XUL/UI manipulation that lets a site contro...

CVE-2005-0142

Vulnerability CVE-2005-0142 affects Firefox 0.9, Thunderbird 0.6 and older Mozilla line up to Mozilla 1.7.x prior to 1.7.5. The root cause described across connected advisories is that temporary files are saved with world-readable permissions, enabling a local user to read web content or attachme...

CVE-2005-2602

Technical details about CVE-2005-2602 are not publicly provided in the supplied documents. Monitor for updates from vendors and vulnerability trackers.

CVE-2009-4630

Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...

CVE-2011-3649

CVE-2011-3649 affects Mozilla Firefox 7.0 and Thunderbird 7.0 on Windows when using Direct2D with the Azure graphics backend, allowing cross-origin image data to be read via a manipulated canvas (Same Origin Policy bypass). The issue stems from a regression introduced by CVE-2011-2986. According ...

CVE-2012-4218

CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey

CVE-2026-16350

CVE-2026-16350 affects Mozilla Firefox and Firefox ESR (Audio/Video: cubeb). The issue is caused by incorrect boundary conditions in cubeb, with a remediation by upgrading to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13. Public CVSS 3.1 vector indicates NETWORK attack, no user interacti...

CVE-2026-6750

CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...

CVE-2026-6761

CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...

CVE-2026-6759

CVE-2026-6759 is a use-after-free in the Mozilla Widget: Cocoa component. Affected products include Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. This is confirmed across multiple connected advisories and CVE l...

CVE-2026-16368

CVE-2026-16368: Affects Firefox JavaScript/WebAssembly component due to incorrect boundary conditions. Root cause described as boundary-condition flaw with all three security properties potentially impacted (high confidentiality, integrity, availability). Public fixed versions: Firefox 153 and Fi...

CVE-2026-6762

CVE-2026-6762 is a spoofing issue in the DOM: Core & HTML component. Connected advisories confirm it affects Firefox/Thunderbird stacks and was fixed in Firefox 150, ESR 115.35, ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS 3.1 base score is 6.3 (MEDIUM) with NETWORK attack vector...

CVE-2004-0762

CVE-2004-0762 affects Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7. An attacker could lure a remote web site to trigger interaction events to manipulate the XPInstall Security dialog, allowing installation of arbitrary extensions. The vulnerability is documented with a high ...

CVE-2011-3671

The CVE-2011-3671 entry describes a use-after-free vulnerability in Mozilla’s nsHTMLSelectElement.cpp (nsHTMLSelectElement) affecting Firefox 4.x–8.0, Thunderbird 5.0–8.0, and SeaMonkey

CVE-2026-12329

CVE-2026-12329 is a memory-safety bug fixed in Thunderbird ESR 140.12 (and Firefox ESR 140.12). Affected products include Thunderbird/Firefox ESR 140.12; CVSSv3.1 base score 7.5 (HIGH) with NETWORK attack vector, high confidentiality/integrity/availability impact, user interaction required. Remed...

CVE-2026-16361

CVE-2026-16361 affects Firefox ESR 115.37 and 140.12, described as memory safety bugs with evidence of memory corruption. The advisory notes these could have been exploited to run arbitrary code, and fixes are applied in Firefox ESR 115.38 and 140.13. Affected components/roots are not detailed be...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...

CVE-2026-8959

CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...

CVE-2010-5074

CVE-2010-5074 affects Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability stems from the layout engine comparing visited vs. unvisited links while processing CSS token sequences, causing a timing-based information disclosure. An attacker could rem...

CVE-2011-3665

CVE-2011-3665 affects Mozilla Firefox (4.x–8.0), Thunderbird (5.0–8.0), and SeaMonkey before 2.6. The issue is an improper handling of an Ogg VIDEO element after scaling, which can cause a crash or potentially other impact. Connected advisories corroborate MFSA2011-58 and related fixes across ope...

CVE-2014-2018

CVE-2014-2018 is an XSS issue in Mozilla Thunderbird 17.x–17.0.8, Thunderbird ESR 17.x–17.0.10, and SeaMonkey

CVE-2026-16360

Memory safety bugs found in Mozilla Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152, with evidence of memory corruption and potential remote code execution. The issues were fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected product family: Mozilla Firefox ESR (olde...

CVE-2026-16391

Information disclosure in Firefox’s Storage: IndexedDB component (CVE-2026-16391) is addressed in Firefox 153 and Firefox ESR 140.13. The CVSSv3.1 vector indicates an unaltered scope, network attack vector, high confidentiality impact with no impact to integrity/availability, and no user interact...

CVE-2026-6763

CVE-2026-6763 is a mitigation bypass in the File Handling component that was fixed in Firefox 150 and Firefox ESR 140.10, and in Thunderbird 150 and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:15892, ALSA-2… etc.) corroborate that Thunderbird/firefo...

CVE-2002-2437

The CVE-2002-2437 entry describes an information-disclosure flaw in the JavaScript implementation of Mozilla Firefox (before 4.0), Thunderbird (before 3.3), and SeaMonkey (before 2.1). The vulnerability arises from improper restrictions on the values returned by getComputedStyle, enabling remote ...

CVE-2004-0909

Mozilla Firefox prior to the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 are affected by CVE-2004-0909. The issue allows remote attackers to trick users into performing unintended actions, including software installation, via signed scripts that request enhanced abilities us...

CVE-2006-0299

CVE-2006-0299 affects Mozilla Firefox up to 1.5.0.1, Thunderbird 1.5 (when JavaScript runs in mail), and SeaMonkey before 1.0. The issue arises from the E4X implementation exposing the internal AnyName object to external interfaces, allowing multiple cooperating domains to exchange information an...

CVE-2026-12296

CVE-2026-12296 describes a sandbox escape in the Security: Process Sandboxing component. Affected products include Mozilla Firefox and Firefox ESR, and Mozilla Thunderbird with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The description does not ...

CVE-2011-2987

The connected documents confirm CVE-2011-2987 is a heap overflow in the ANGLE library used by Mozilla’s WebGL implementation (Firefox/SeaMonkey/related) that could allow remote code execution. The issue is tied to the ANGLE heap overflow in WebGL code paths; exploitation would be via remote attac...

CVE-2011-2991

CVE-2011-2991 affects the Mozilla browser engine in Firefox 4.x–5, SeaMonkey 2.x prior to 2.3, and Thunderbird prior to 6. The issue arises from improper JavaScript handling, enabling remote attackers to trigger memory corruption and cause a crash, with potential arbitrary code execution via unsp...

CVE-2011-3652

CVE-2011-3652 affects Mozilla Firefox and Thunderbird prior to version 8.0 due to a browser engine memory allocation bug. This can cause memory corruption and application crashes, with potential for remote arbitrary code execution via unspecified vectors. Remediation is to upgrade to Firefox/Thun...

CVE-2011-3653

CVE-2011-3653 affects Mozilla Firefox < 8.0 and Thunderbird

CVE-2026-12290

A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...

CVE-2026-12312

Memory safety bug CVE-2026-12312 is fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Debians DSA-6350-1 notes firefox-esr is updated to 140.12.0esr-1~deb13u1 and lists CVE-2026-12312 among affected issues. Fedora advisory FEDORA-2026-5eeadd9b1b also instructs upg...

CVE-2004-0907

CVE-2004-0907 affects Linux installs of Mozilla Firefox (pre-Preview Release), Mozilla (pre-1.7.3), and Thunderbird (pre-0.8). The root cause is insecure permissions on files created during the installation tarball extraction, which could let local users overwrite files and execute arbitrary code...

CVE-2005-3402

CVE-2005-3402 affects Mozilla Thunderbird SMTP client (notably 1.0.5 BETA and 1.0.7). The issue is that Thunderbird does not notify users when it cannot establish a secure channel with the SMTP server, enabling a MITM to obtain authentication information by bypassing TLS or downgrading CRAM-MD5 t...

CVE-2025-10536

Mode C: CVE-2025-10536 is an Information disclosure in the Networking: Cache component affecting Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird

CVE-2025-8044

CVE-2025-8044 corresponds to memory safety bugs found in Firefox 140 and Thunderbird 140, with memory corruption evidence and a potential to allow arbitrary code execution. Affected products are Firefox and Thunderbird versions earlier than 141. The consolidated sources indicate the issues are me...