CVE-2022-45416

CVE-2022-45416 affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2017-7819

CVE-2017-7819 is a use-after-free in the design mode image resizing path that can crash the process if referenced objects have been freed. The vulnerability affects Thunderbird < 52.4 and, per the cited records, Firefox < 56 and Firefox ESR

CVE-2018-5103

CVE-2018-5103 is a use-after-free vulnerability that can occur during mouse event handling due to multiprocess-related issues, leading to potentially exploitable crashes. Affected products include Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox

CVE-2021-38510

CVE-2021-38510 describes a Mac‑OS specific flaw where the executable file warning was not shown when downloading .inetloc files, which can cause commands to run on a user’s computer. Affected products and versions from the provided documents: Mozilla Firefox (Mac) < 94, Thunderbird < 91.3, ...

CVE-2022-46881

CVE-2022-46881 is a memory safety issue in WebGL where an optimization could cause memory corruption and a potentially exploitable crash. Affected products per provided sources are Firefox releases before 106, Firefox ESR before 102.6, and Thunderbird before 102.6. The root cause is a WebGL optim...

CVE-2023-5732

CVE-2023-5732 affects Firefox (pre-117 and ESR pre-115.4) and Thunderbird (pre-115.4.1). An attacker could craft a link using bidirectional characters to spoof the displayed address in the address bar. Public details in connected advisories confirm this vulnerability and list affected products; r...

CVE-2025-3028

The Mozilla Firefox browser and Thunderbird email client are vulnerable to a use-after-free memory corruption issue. The vulnerability exists in the XSLTProcessor component, where JavaScript code running during document transformation can trigger the flaw. A remote attacker could potentially exec...

CVE-2017-5444

CVE-2017-5444 is a buffer overflow in parsing application/http-index-format data that enables an out-of-bounds read. Affected: Mozilla Thunderbird < 52.1, Firefox ESR < 45.9/52.1, and Firefox

CVE-2018-5102

CVE-2018-5102 is a use-after-free in HTML media element handling with media streams, affecting Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox

CVE-2022-46878

CVE-2022-46878 corresponds to memory-safety bugs reported in Thunderbird 102.5 with some cases involving memory corruption; affected products include Firefox < 108, Firefox ESR < 102.6, and Thunderbird

CVE-2026-16367

A sandbox escape vulnerability exists in the Disability Access APIs component due to an invalid pointer . This vulnerability affects Mozilla Firefox and Mozilla Thunderbird . The issue was addressed and fixed in Firefox 153 and Thunderbird 153 . No information regarding practical consequences, ex...

CVE-2014-1510

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 is vulnerable to remote code execution. An attacker can execute arbitrary JavaScript code with chrome privileges by utilizing an IDL fragment to trigger a wi...

CVE-2018-5099

CVE-2018-5099 is a use-after-free vulnerability in the widget listener that can crash or potentially allow code execution when references to freed browser objects are used. Affected products/versions include Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox

CVE-2022-38478

CVE-2022-38478 refers to memory-safety bugs reported by the Mozilla Fuzzing Team affecting Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12, with potential for memory corruption and, with sufficient effort, arbitrary code execution. Affected products include Thunderbird (versions older than ...

CVE-2017-5376

CVE-2017-5376 is a use-after-free in XSL processing of XSLT documents. Connected IBM advisories tie this CVE to Mozilla Firefox components shipped in IBM Storwize V7000 Unified and IBM SONAS; affected products include Thunderbird and Firefox binaries reported in the CVE. The IBM bulletins specify...

CVE-2017-7801

CVE-2017-7801 is a use-after-free in marquee layout during window resize that frees the updated style object while still in use, potentially allowing a crash or exploit. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2021-29950

Summary: CVE-2021-29950 affects Mozilla Thunderbird prior to 78.8.1. The issue occurs when OpenPGP keys are unprotected in memory before decryption, signing, or import tasks; if the task fails, the secret key may remain in memory in an unprotected state. Impact (as described): Potential exposure ...

CVE-2016-9900

CVE-2016-9900 describes that data: URLs used by SVG images can bypass security restrictions, enabling cross-domain data leakage. Affected products include Mozilla Firefox (non-ESR) prior to 50.1, Firefox ESR prior to 45.6, and Thunderbird prior to 45.6. Root cause is the handling of external reso...

CVE-2017-5396

CVE-2017-5396 describes a use-after-free vulnerability in the Media Decoder when handling media files, where certain events fire after the media elements are freed. The initial document indicates affected products include Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox

CVE-2018-5098

CVE-2018-5098 is a use-after-free in Thunderbird/Firefox related to manipulating form input elements, focus, and selections via script content, causing potential crashes. Affected: Thunderbird < 52.6, Firefox ESR < 52.6, Firefox

CVE-2020-15646

This CVE describes a credential theft flaw in Thunderbird: if an attacker can intercept Thunderbird’s initial automatic account setup via Microsoft Exchange autodiscovery and reply with crafted data, Thunderbird may send a username and password over HTTPS to the attacker-controlled server. Affect...

CVE-2021-43534

The CVE-2021-43534 entry concerns memory safety bugs in Mozilla Firefox 93 and Firefox ESR 91.2, with potential for memory corruption and possible arbitrary code execution. Affected products are Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2022-36319

CVE-2022-36319 involves a mouse position spoofing issue caused by combining CSS overflow and transform properties, affecting Firefox ESR and Thunderbird prior to certain fixed versions. Affected are Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thun...

CVE-2023-25728

The CVE-2023-25728 entry describes a CSP-Report-Only header issue where an attacker could leak a child iframe’s unredacted URI during a redirect, affecting Firefox < 110, Thunderbird < 102.8, and Firefox ESR

CVE-2023-25737

CVE-2023-25737 describes an invalid downcast from nsTextNode to SVGElement that could lead to undefined behavior. The vulnerability is observed in Mozilla Firefox (versions before 110), Thunderbird (versions before 102.8), and Firefox ESR (versions before 102.8). Connected advisories consistently...

CVE-2023-28162

CVE-2023-28162 affects Firefox <111, Firefox ESR <102.9, and Thunderbird

CVE-2022-36314

CVE-2022-36314 affects Firefox on Windows (Windows shortcut handling). A local attacker could induce a user to open a local .lnk that supplies a remote path, causing the OS to make unexpected network requests. Affected: Firefox for Windows; Firefox ESR < 102.1; Firefox < 103; Thunderbird

CVE-2023-25732

CVE-2023-25732 involves an out-of-bounds memory write caused by incorrect calculation of the input size when encoding data from inputStream in xpcom. The vulnerability affects Firefox before 110, Thunderbird before 102.8, and Firefox ESR before 102.8. Connected advisories corroborate the issue an...

CVE-2023-6204

CVE-2023-6204 describes an out-of-bounds read that can leak memory data into images created on the canvas element. The issue affects Firefox versions older than 120, Firefox ESR older than 115.5.0, and Thunderbird older than 115.5.0. The available connected advisories corroborate the vulnerabilit...

CVE-2021-43535

CVE-2021-43535 is a memory-safety vulnerability in Mozilla browsers where an HTTP2 session object could be released on a different thread, causing use-after-free, memory corruption, and a potentially exploitable crash. The consolidated information across sources indicates the issue affects Firefo...

CVE-2023-5726

The CVE-2023-5726 issue is a macOS-only browser UI vulnerability where an obscured fullscreen notification could be exposed via the file-open dialog, potentially enabling spoofing or user confusion. Affected products/versions are Firefox older than 119, Firefox ESR older than 115.4, and Thunderbi...

CVE-2018-5154

CVE-2018-5154 is a use-after-free in the enumeration of attributes during SVG animations with clip paths, causing a potentially exploitable crash. Affected: Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, Firefox ESR

CVE-2022-3034

CVE-2022-3034 describes a vulnerability in Mozilla Thunderbird where receiving an HTML email that requests loading an iframe from a remote location causes the browser to fetch the remote document, even though Thunderbird does not display it. The issue affects Thunderbird versions prior to 102.2.1...

CVE-2023-1945

CVE-2023-1945 is a vulnerability in Mozilla code paths related to the Safe Browsing API. The initial data from the Safe Browsing API could lead to memory corruption and a potentially exploitable crash. Affected products per the connected data: Thunderbird and Firefox ESR, affected when using vers...

CVE-2017-7814

This CVE (CVE-2017-7814) affects Mozilla products (Firefox < 56, Firefox ESR < 52.4, Thunderbird

CVE-2022-38472

The CVE-2022-38472 issue is a cross-origin spoofing vulnerability where XSLT error handling could allow attacker‑controlled content to be displayed as a different origin in the address bar, potentially tricking users into submitting data to a spoofed site. Affected products/versions (as stated in...

CVE-2023-29535

CVE-2023-29535: The vulnerability arises from a garbage collector compaction issue in Firefox/related products where a weak map could be accessed before proper tracing, leading to memory corruption and a potentially exploitable crash. Affected software per documents includes Firefox (and derivati...

CVE-2023-6208

CVE-2023-6208 is a Firefox/Thunderbird issue limited to X11: text selected via the Selection API is copied into the primary selection. Affected: Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird

CVE-2025-5268

Memory safety bugs exist in Firefox 138 , Thunderbird 138 , Firefox ESR 128.10 , and Thunderbird 128.10 . These flaws involve a lack of data cleaning at the management level, which can result in memory corruption. With sufficient effort, these vulnerabilities could be exploited by a remote attack...

CVE-2018-12361

CVE-2018-12361 is an integer overflow in the SwizzleData code during buffer-size calculation that can lead to a potentially exploitable crash when inputs aren’t sanitized. Affected products include Mozilla Thunderbird before 60 and Firefox family before 61 (Firefox ESR before 60.1). Public remedi...

CVE-2018-5168

CVE-2018-5168 is a vulnerability in Thunderbird and Firefox where an attacker can bypass permission checks by manipulating the baseURI of the theme element, enabling a user interaction-free installation of a theme that could contain offensive images. Affected products and versions per the records...

CVE-2023-32215

CVE-2023-32215 refers to memory-safety bugs in Mozilla Firefox and Firefox ESR (112/ESR 102.10) with potential for arbitrary code execution. Affected are Firefox < 113, Firefox ESR < 102.11, and Thunderbird

CVE-2017-5373

Summary (CVE-2017-5373) Memory-safety bugs were reported in Firefox 50.1/ESR 45.6 and affect Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox

CVE-2017-7807

CVE-2017-7807 describes a domain URL hijack via AppCache fallback, resolved by requiring fallback files to be inside the manifest directory. Affected products include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2018-12389

CVE-2018-12389 relates to memory safety bugs in Mozilla Firefox ESR 60.x affecting Firefox ESR < 60.3 and Thunderbird

CVE-2022-38477

CVE-2022-38477 concerns memory safety bugs reported by Mozilla’s Fuzzing Team in Firefox 103 and Firefox ESR 102.1. The entry notes evidence of memory corruption and a presumption that, with sufficient effort, some bugs could be exploited to execute arbitrary code. Affected products explicitly li...

CVE-2016-9904

CVE-2016-9904 describes a timing-attack vulnerability in JavaScript Map/Set usage that can leak information across websites. Affected products include Firefox versions before 50.1, Firefox ESR before 45.6, and Thunderbird before 45.6. The issue enables an attacker to determine if an atom is used ...

CVE-2017-5383

CVE-2017-5383 describes spoofing via specific Unicode glyphs used to alter the location bar content. The initial entry notes impact on Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox

CVE-2017-5402

CVE-2017-5402 is a use-after-free in FontFace event handling that can crash Firefox/Thunderbird when a FontFace object is destroyed but events are fired. Affected products and versions include Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird

CVE-2023-25729

CVE-2023-25729 involves a permissions prompt issue for external schemes that was only shown for ContentPrincipals, allowing extensions using ExpandedPrincipals to open them without user interaction. This could enable actions like downloading files or interacting with installed software. Affected:...