CVE-2019-9819

The CVE-2019-9819 issue is a JavaScript compartment mismatch involving the fetch API that can cause a crash. Affected products include Thunderbird (and Firefox components) with versions below 60.7 for Thunderbird and below 67 for Firefox/Firefox ESR; impact is described as potentially exploitable...

CVE-2023-23603

CVE-2023-23603 describes that Regular expressions used to filter forbidden properties/values from style directives in calls to console.log did not account for external URLs, enabling potential data exfiltration from the browser. Affected: Firefox <= 108/109 and Firefox ESR <= 102.7, Thunder...

CVE-2024-6612

CVE-2024-6612 describes a CSP violation leakage in devtools that caused DNS prefetching to reveal the CSP violation. Credible sources in the provided connected documents show impact on Mozilla Firefox and Thunderbird when running versions older than 128. The vulnerability is an information disclo...

CVE-2024-7522

Concrete details from connected documents show CVE-2024-7522: an editor component failed to check an attribute value, causing an out-of-bounds read. Affected products include Firefox (versions before 129) and Thunderbird (before 128.1/115.14 ESR). The issue is consistent with Mozilla advisories a...

CVE-2021-43539

CVE-2021-43539 is a Mozilla Firefox/Thunderbird memory safety issue: GC rooting failure when calling wasm instance methods can cause a use-after-free and potentially exploitable crash. Connected sources confirm the flaw affects Firefox up to 95 and Thunderbird up to 91.4.0, linked advisories show...

CVE-2025-0238

CVE-2025-0238 describes a memory-safety issue (use-after-free) caused by a controlled failed memory allocation, potentially leading to a crash in Firefox and Thunderbird before certain versions. Affected products/versions (per connected advisories): Firefox < 134; Firefox ESR < 128.6 (and &...

CVE-2019-11711

CVE-2019-11711 involves reuse of an inner window that neglects document.domain cross-origin protections, enabling script injection across subdomains. Affected software per connected docs: Firefox ESR < 60.8, Firefox < 68, and Thunderbird

CVE-2021-23978

CVE-2021-23978 affects Mozilla products (Firefox and Thunderbird/Firefox ESR). The connected documents confirm memory safety bugs in Firefox 85 and ESR 78.7, with potential memory corruption that could lead to arbitrary code execution. Impact is described for Firefox < 86, Thunderbird < 78....

CVE-2021-38509

CVE-2021-38509 describes an issue where, due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary contents could be displayed over an attacker’s chosen page. Affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2021-43538

CVE-2021-43538 is a race condition in the notification code that could allow spoofing by hiding fullscreen/pointer-lock notifications on affected Mozilla products. Affected: Thunderbird < 91.4.0, Firefox ESR < 91.4.0, Firefox

CVE-2024-10465

The CVE-2024-10465 issue is confirmed in connected advisories: a clipboard “paste” button could persist across browser tabs, enabling spoofing. Affected products/versions include Firefox <132, Firefox ESR <128.4, Thunderbird <128.4, and Thunderbird

CVE-2024-11705

The CVE-2024-11705 issue is due to NSC_DeriveKey assuming phKey is non-NULL; passing NULL leads to a segmentation fault (crash). Affected products reported across sources include Firefox and Thunderbird prior to version 133. The vulnerability description and linked advisories indicate this NULL d...

CVE-2024-11708

The CVE-2024-11708 entry concerns Firefox and Thunderbird: a missing thread synchronization primitive could cause a data race in the PlaybackParams structure, affecting Firefox < 133 and Thunderbird

CVE-2024-9399

CVE-2024-9399 describes a denial-of-service in Firefox/Thunderbird caused by a website initiating a specially crafted WebTransport session that crashes the browser. Affected versions: Firefox before 131 and Firefox ESR before 128.3; Thunderbird before 128.3; Thunderbird before 131. The issue is t...

CVE-2024-9402

CVE-2024-9402 concerns memory safety bugs in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2, with evidence of memory corruption that could potentially be exploited to run arbitrary code. Affected products and versions include Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3...

CVE-2019-9811

CVE-2019-9811 corresponds to a sandbox-escape vulnerability demonstrated in a Pwn2Own entry. The issue affects Mozilla products: Firefox ESR before 60.8, Firefox before 68, and Thunderbird before 60.8, with a malicious language-pack installation used to compromise the translation feature to escap...

CVE-2020-6822

CVE-2020-6822 is an out-of-bounds write in GMPDecodeData when processing images larger than 4 GB on 32-bit builds, potentially allowing arbitrary code execution. Affected products include Thunderbird and Firefox (Thunderbird < 68.7.0, Firefox ESR < 68.7, Firefox

CVE-2021-38507

CVE-2021-38507 describes a vulnerability in HTTP/2 Opportunistic Encryption (RFC 8164) where, if a second encrypted port on the same IP (e.g., 8443) did not opt in, a network attacker could forward 443 to 8443 and trick the browser into treating the content as same-origin with HTTP. The issue was...

CVE-2024-10467

Summary (CVE-2024-10467) Memory-safety bugs in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3 have shown memory corruption with potential for arbitrary code execution. Affected: Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird

CVE-2024-10468

CVE-2024-10468 describes potential race conditions in IndexedDB that could cause memory corruption, leading to a potentially exploitable crash. Affected products are Mozilla Firefox and Mozilla Thunderbird earlier than version 132. Multiple connected sources-confirm this same issue across distrib...

CVE-2024-6608

The CVE-2024-6608 issue affects Mozilla Firefox (and related Thunderbird components) where pointerlock can move the cursor from within an iframe to outside the viewport and even outside the Firefox window. Affected versions are Firefox < 128 and Thunderbird

CVE-2019-17012

Mozilla reported memory safety bugs in Firefox 70 and Firefox ESR 68.2, with potential to exploit for arbitrary code. Affected: Thunderbird < 68.3, Firefox ESR < 68.3, Firefox

CVE-2021-23960

CVE-2021-23960 is corroborated by connected documents: a memory-safety issue in Firefox/Thunderbird where garbage collection on re-declared JavaScript variables can cause a use-after-poison and potentially crash the process. Affected versions are Firefox < 85, Thunderbird < 78.7, and Firefo...

CVE-2024-11695

CVE-2024-11695 describes a spoofing vulnerability in Mozilla Firefox and Thunderbird where a crafted URL containing Arabic script and whitespace could hide the page’s true origin, enabling spoofing. Affected versions: Firefox < 133 and Firefox ESR < 128.5; Thunderbird < 133 and Thunderbird

CVE-2024-7521

CVE-2024-7521 is a Firefox/Thunderbird vulnerability caused by incomplete WebAssembly exception handling that could lead to a use-after-free and memory corruption. Affected: Firefox <129, ESR <115.14, ESR <128.1, Thunderbird <128.1, Thunderbird

CVE-2024-9398

CVE-2024-9398 affects Mozilla Firefox and Thunderbird: an attacker could enumerate external protocol handlers by exploiting a check of window.open results, effectively testing whether a protocol handler is installed. Affected: Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and ...

CVE-2019-17005

The CVE-2019-17005 issue is a memory safety vulnerability in Mozilla’s plain text serializer where a fixed-size array for the number of elements could overflow, causing memory corruption and a potentially exploitable crash. Affected products include Thunderbird, Firefox ESR, and Firefox (all ver...

CVE-2024-11700

The CVE-2024-11700 issue concerns Firefox and Thunderbird with versions earlier than 133, where tapjacking could let malicious sites synthesize user intent confirmations to launch external applications. This is described across multiple connected advisories (e.g., Gentoo GLSA references and Alpin...

CVE-2024-9394

CVE-2024-9394 describes a cross-origin information disclosure in Mozilla Firefox/Thunderbird via specially crafted multipart responses that can execute JavaScript under resource://devtools. Desktop Site Isolation limits cross-origin access, but Android versions may enable full cross-origin access...

CVE-2024-10462

CVE-2024-10462 describes a truncation of long URLs that could allow origin spoofing in a permission prompt for Mozilla Firefox and Thunderbird. The connected documents confirm affected products and versions: Firefox and Firefox ESR up to certain releases (Firefox < 132; ESR < 128.4), Thunde...

CVE-2018-18501

CVE-2018-18501 corresponds to multiple memory-safety issues in Mozilla products, affecting Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox

CVE-2020-26968

CVE-2020-26968 is a Mozilla Firefox/Thunderbird memory-safety issue. The provided documents indicate memory-safety bugs in Firefox 82 and ESR 78.4, with potential memory corruption that could allow running arbitrary code. Affected versions: Firefox < 83, Firefox ESR < 78.5, and Thunderbird

CVE-2024-10461

CVE-2024-10461: In multipart/x-mixed-replace responses, Content-Disposition: attachment header was not respected, enabling XSS. Affected: Firefox <132, Firefox ESR <128.4, Thunderbird <128.4, Thunderbird

CVE-2020-15656

CVE-2020-15656 involves a type confusion for special arguments in IonMonkey affecting Firefox ESR <78.1, Firefox <79, and Thunderbird

CVE-2020-26971

CVE-2020-26971 describes a heap buffer overflow caused by unconstained blit values in user input, affecting Mozilla Firefox (unspecified versions), Thunderbird < 78.6 and Firefox ESR

CVE-2024-11702

CVE-2024-11702 concerns Mozilla Firefox and Mozilla Thunderbird information disclosure due to insufficient clipboard protection in Android Private Browsing mode. Affected products: Firefox and Thunderbird with versions prior to 133. Root cause: clipboard data (sensitive data such as passwords) co...

CVE-2023-23602

CVE-2023-23602 describes a mishandled security check when creating a WebSocket in a WebWorker, causing the Content Security Policy connect-src header to be ignored. Affected products in the provided sources include Firefox (versions before 109), Firefox ESR (before 102.7), and Thunderbird (before...

CVE-2025-1019

CVE-2025-1019 affects Firefox and Thunderbird where the z-order of fullscreen notifications can be manipulated to hide the notification, enabling a potential spoofing attack. Affected versions are Firefox and Thunderbird prior to 135. The underlying issue is the fullscreen notification display or...

CVE-2020-15652

CVE-2020-15652 : The issue is a leak of the result of a cross-origin redirect observed from stack traces of JavaScript errors in web workers. Affected products include Firefox (and ESR branches) and Thunderbird before version 79/68.11–78.1 depending on branch. The root cause is described as a mem...

CVE-2021-38500

CVE-2021-38500 corresponds to memory-safety bugs in Firefox 92/ESR 91.1–93 and affects Thunderbird and Firefox ESR up to certain versions (Thunderbird <78.15, <91.2; Firefox ESR <91.2, <78.15; Firefox

CVE-2021-43541

CVE-2021-43541 is a vulnerability in how external protocol handler URLs are processed. In affected products (Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox

CVE-2022-46872

CVE-2022-46872 describes an attacker who compromised a Thunderbird content process on Linux could partially escape the sandbox and read arbitrary files via clipboard-related IPC messages. Publicly cited texts indicate the vulnerability affects Firefox <108, Firefox ESR <102.6, and Thunderbird

CVE-2024-11701

CVE-2024-11701 affects Mozilla Firefox and Mozilla Thunderbird. The issue is an incorrect domain being displayed in the address bar during interrupted navigation, which could enable spoofing attacks. Affected versions are Firefox < 133 and Thunderbird

CVE-2024-7529

CVE-2024-7529: The date picker can partially obscure security prompts in Mozilla Firefox and Thunderbird up to specific versions (Firefox < 129, ESR < 115.14/128.1; Thunderbird

CVE-2020-26959

CVE-2020-26959 is a use-after-free in the WebRequestService during browser shutdown, potentially enabling memory corruption and a crash in Firefox/Thunderbird prior to the fixed versions. Connected advisories confirm this affects Firefox <83, Firefox ESR <78.5, and Thunderbird

CVE-2021-29964

CVE-2021-29964 is a local, Windows-only vulnerability in Mozilla Firefox where a hostile WM_COPYDATA message could cause an out-of-bounds read while parsing the message. Affected products include Thunderbird < 78.11, Firefox < 89, and Firefox ESR

CVE-2024-11697

The CVE-2024-11697 entry concerns Mozilla Firefox and Thunderbird and involves improper handling of keypresses in the Executable File Confirmation dialog. Affected versions are Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird

CVE-2018-18492

CVE-2018-18492 is a use-after-free in the Firefox/ Thunderbird codebase: after deleting a selection element, a weak reference in the options collection can lead to a potentially exploitable crash. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox

CVE-2020-6807

CVE-2020-6807 describes a use-after-free in Thunderbird involving stream-reinit when a device/stream is modified as it is being destroyed. Affected products include Thunderbird

CVE-2019-11761

CVE-2019-11761 affects Thunderbird (and Firefox/Firefox ESR) via an unintended access to a privileged JSONView object that has been cloned into content. The root cause is exposure of this object through a form using a data: URI, enabling access to privileged content and bypassing defense-in-depth...