CVE-2017-5408

CVE-2017-5408: Cross-origin reading of video captions in Mozilla products due to missing CORS header checks. Affected: Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, Thunderbird

CVE-2022-46875

CVE-2022-46875 concerns Mozilla Firefox/Thunderbird on Mac OS where the executable warning was not shown when downloading .atloc/.ftploc files, enabling potential command execution. Affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird

CVE-2024-0742

The CVE-2024-0742 entry is confirmed with concrete details in connected docs: an incorrect timestamp used to prevent input after page load can cause browser prompts and dialogs to be activated or dismissed unintentionally. Affected products are Firefox < 122, Firefox ESR < 115.7, and Thunde...

CVE-2025-5268

CVE-2025-5268 is a memory-safety vulnerability affecting Firefox and Thunderbird. The advisory notes memory-safety bugs in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10, with evidence of memory corruption. It is stated that some bugs could, with enough effort, be exploi...

CVE-2023-25752

CVE-2023-25752 affects Firefox and Thunderbird due to an out-of-bounds risk when accessing throttled streams. The bug stems from not validating the count of available bytes in the caller, allowing potential memory safety issues. Affected versions include Firefox <111, Firefox ESR <102.9, an...

CVE-2023-29535

CVE-2023-29535: The vulnerability arises from a garbage collector compaction issue in Firefox/related products where a weak map could be accessed before proper tracing, leading to memory corruption and a potentially exploitable crash. Affected software per documents includes Firefox (and derivati...

CVE-2017-5404

CVE-2017-5404 is a use-after-free in Firefox/Thunderbird when manipulating ranges in selections with one node inside a native anonymous tree and one node outside it, leading to a potentially exploitable crash. Affected: Firefox versions before 52 and Firefox ESR before 45.8; Thunderbird versions ...

CVE-2017-5432

CVE-2017-5432 is a use-after-free in Firefox < 53 that can trigger a potentially exploitable crash during certain text-input selection. The vulnerability also affects related Mozilla products in older ESR/thunderbird branches (e.g., Thunderbird < 52.1; ESR

CVE-2017-5440

CVE-2017-5440 is a use-after-free in XSLT processing caused by failure to propagate error conditions during matching while evaluating context, leading to use of freed objects and potentially a crash. Affected products include Mozilla Firefox (Firefox < 53) and Firefox ESR, and Mozilla Thunderb...

CVE-2023-29548

CVE-2023-29548 concerns a wrong lowering instruction in the ARM64 Ion compiler that yields an incorrect optimization result. The vulnerability affects Firefox (<112), Focus for Android (<112), Firefox ESR (<102.10), Firefox for Android (<112), and Thunderbird (

CVE-2016-5290

CVE-2016-5290: Memory safety bugs in Firefox 49 and Firefox ESR 45.4 (affecting Thunderbird <45.5, Firefox ESR <45.5, and Firefox

CVE-2018-5129

The CVE-2018-5129 entry relates to a memory-safety/IPC validation issue where a lack of parameter validation on IPC messages can cause an out-of-bounds write, potentially enabling sandbox escape. Affected products include Mozilla Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2023-25742

CVE-2023-25742 : When importing a SPKI RSA public key as ECDSA P-256, the key is handled incorrectly, causing the tab to crash. Affected products per provided docs: Firefox < 110, Thunderbird < 102.8, and Firefox ESR

CVE-2014-1505

CVE-2014-1505 affects Mozilla Firefox (and related Mozilla components) where SVG filter operations in feDisplacementMap could leak displacement-correlation data and potentially bypass Same Origin Policy via a timing attack, enabling partial information disclosure from a different domain. Affected...

CVE-2023-28163

CVE-2023-28163 is a Windows-specific Firefox/Thunderbird vulnerability where the Save As dialog incorrectly resolves environment variables in suggested filenames, causing context exposure to the current user. Affected products are Firefox on Windows (Firefox < 111 and ESR < 102.9) and Thund...

CVE-2023-6860

CVE-2023-6860: The VideoBridge channel allowed a content process to access textures from remote decoders, creating a potential sandbox escape in Firefox ESR <115.6, Thunderbird <115.6, and Firefox

CVE-2017-5433

CVE-2017-5433 is a use-after-free in SMIL animation functions. Affected software includes Mozilla Firefox builds before 53 and Thunderbird before 52.1 ESR; the underlying issue arises when pointers to animation elements in an array are dropped from the animation controller while still in use, lea...

CVE-2017-7753

CVE-2017-7753 is an out-of-bounds read in the rendering path when applying style rules to pseudo-elements (e.g., ::first-line) using cached style data. Affected products/versions include Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox

CVE-2022-2226

CVE-2022-2226 describes a vulnerability in Mozilla Thunderbird where an OpenPGP signature includes the signature date, which may differ from the email display date. If the dates don’t match, Thunderbird could still accept the signature; a replay attack (resenting an old email later) could mislead...

CVE-2022-45406

CVE-2022-45406 describes a memory-safety flaw in JavaScript: when an out-of-memory condition occurs during creation of a global, a JavaScript realm can be deleted while references linger in a BaseShape, leading to a use-after-free and potentially exploitable crash. Affected products include Firef...

CVE-2023-6206

CVE-2023-6206 is described across connected sources as a clickjacking-related issue tied to the fullscreen transition in Mozilla Firefox and Thunderbird. The vulnerability affects Firefox versions older than 120, Firefox ESR older than 115.5.0, and Thunderbird older than 115.5.0. The issue is dis...

CVE-2012-4186

CVE-2012-4186 : Heap-based buffer overflow in Mozilla Firefox’s nsWaveReader::DecodeAudioData. Affected products include Firefox before 16.0 (and Firefox ESR 10.x before 10.0.8), Thunderbird before 16.0, and SeaMonkey before 2.13. Vectors are unspecified in the provided docs, but exploitation wou...

CVE-2016-9897

CVE-2016-9897 affects Mozilla Firefox (versions < 50.1) and Firefox ESR (< 45.6) and Thunderbird (

CVE-2023-28164

CWE- style note: CVE-2023-28164 affects Firefox <111, Firefox ESR <102.9, and Thunderbird

CVE-2013-5609

CVE-2013-5609 is a set of memory-corruption/denial-of-service vulnerabilities in the Mozilla Firefox browser engine, affecting Firefox (including ESR 24.x) and related products prior to versions around 26.0 (per the referenced MiracleLinux AXSA advisories). The issues could allow remote attackers...

CVE-2014-1508

CVE-2014-1508 affects Mozilla Firefox family components (libxul) where libxul.so!gfxContext::Polygon can leak memory, cause out-of-bounds reads, or crash, with potential Same Origin Policy bypass via MathML polygon rendering. Affected: Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbir...

CVE-2017-5459

CVE-2017-5459 is a buffer overflow in the WebGL component triggerable by web content. Affected products include Mozilla Firefox (non-ESR) <53 and Thunderbird/Firefox ESR variants listed in the description (Thunderbird <52.1, Firefox ESR <45.9, Firefox ESR <52.1, Firefox

CVE-2024-0746

CVE-2024-0746 describes a crash triggered when a Linux user opens the print preview dialog in Mozilla components. Affected products include Firefox (versions before 122) and Firefox ESR (before 115.7) as well as Thunderbird (before 115.7). The issue is reported as a crash scenario in the print-pr...

CVE-2018-5127

The CVE-2018-5127 issue is a memory-safety buffer overflow in the SVG path handling (svg animatedPathSegList) triggered via script, allowing a potentially exploitable crash. Affected products and versions include Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox

CVE-2023-29533

CVE-2023-29533 affects Firefox (pre-112, ESR pre-102.10, Android-focused builds pre-112) and Thunderbird (

CVE-2023-50762

CVE-2023-50762 affects Thunderbird≤115.5 (specifically Thunderbird

CVE-2024-0747

CVE-2024-0747 describes a CSP bypass: when a parent page loads a child in an iframe with unsafe-inline, the parent CSP could override the child CSP. Affected: Firefox before 122, Firefox ESR before 115.7, and Thunderbird before 115.7. Practical impact: potential bypass of content security policie...

CVE-2013-0754

CVE-2013-0754 is a use-after-free in the ListenerManager of Mozilla Firefox (and related Firefox ESR, Thunderbird, SeaMonkey). According to the description, triggering garbage collection after memory allocation for listener objects can allow a remote attacker to execute arbitrary code. Affected p...

CVE-2017-5429

CVE-2017-5429 involves memory safety bugs in Mozilla Firefox (52 and ESR 45.8/52) and Thunderbird 52. Some bugs show memory corruption and could be exploited to run arbitrary code. Affected: Thunderbird < 52.1; Firefox ESR < 45.9, < 52.1; Firefox

CVE-2017-5446

Technical details about CVE-2017-5446 are not publicly available in the provided connected documents. Monitor for updates from vendors and security advisories to confirm affected products, impact, and fixes.

CVE-2022-38473

Concrete details for CVE-2022-38473: A cross-origin iframe referencing an XSLT document could inherit the parent domain’s permissions (e.g., microphone or camera) in Thunderbird and Firefox products. Affected: Thunderbird versions earlier than 102.2 and 91.13, Firefox ESR earlier than 91.13 and 1...

CVE-2022-45405

CVE-2022-45405 is a memory-safety use-after-free in the InputStream implementation caused by freeing arbitrary nsIInputStream on a different thread. Documents confirm impact on Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2023-32213

CVE-2023-32213 affects Mozilla Firefox and Thunderbird. The flaw arises when reading a file, where an uninitialized value could be used as the read limit. Affected versions are Firefox <113, Firefox ESR <102.11, and Thunderbird

CVE-2017-7779

CVE-2017-7779 is a set of memory-safety issues reported in Mozilla Thunderbird and Mozilla Firefox components prior to Firefox 55 and Thunderbird 52.3. The Arch Linux ASA-201708-18 and related advisories describe multiple flaws (memory corruption, use-after-free, out-of-bounds reads, and other me...

CVE-2023-32214

CVE-2023-32214 affects Mozilla Firefox and Thunderbird on Windows. The vulnerability involves protocol handlers ms-cxh and ms-cxh-full that could be leveraged to trigger a denial of service. Affected versions are Firefox < 113, Firefox ESR < 102.11, and Thunderbird

CVE-2023-6212

CVE-2023-6212 parks memory safety bugs in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4, with evidence of memory corruption and potential to exploit for arbitrary code. The issue affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird

CVE-2024-0751

CVE-2024-0751 : A malicious devtools extension could have been used to escalate privileges. Affected: Firefox < 122, Firefox ESR < 115.7, Thunderbird

CVE-2017-7818

Summary: CVE-2017-7818 is a use-after-free vulnerability in Thunderbird (and Firefox/ESR components) involving manipulation of ARIA element arrays via the DOM, leading to a potentially exploitable crash. The connected sources confirm the issue affects Thunderbird prior to 52.4.0 and related Mozil...

CVE-2022-45409

CVE-2022-45409 describes a use-after-free in the garbage collector: GCRuntime::finishCollection could be bypassed, allowing an abort of GC in multiple states/zones and potentially causing a crash that could be exploitable. Affected software includes Firefox ESR < 102.5, Thunderbird < 102.5,...

CVE-2023-25730

CVE-2023-25730 describes a browser vulnerability where a background script calling document.documentElement.requestFullscreen and then blocking the main thread can force fullscreen mode indefinitely, potentially causing user confusion or spoofing. The connected documents confirm affected products...

CVE-2023-6857

CVE-2023-6857 describes a race condition when resolving symlinks in Firefox on Unix-based OSes, where the buffer passed to readlink may be too small. Affects Firefox and Thunderbird components (Firefox ESR <115.6, Firefox <121, Thunderbird

CVE-2013-0750

CVE-2013-0750 is a high-severity vulnerability in Mozilla’s JavaScript engine where an integer overflow during string concatenation can lead to heap-based memory corruption and remote code execution. Affected products include Firefox prior to 18.0 (and ESR branches), Thunderbird prior to 17.0.2, ...

CVE-2017-5435

CVE-2017-5435 is a use-after-free in Firefox/Thunderbird during editor design-mode transaction processing, causing a potentially exploitable crash. Public details place affected products as Firefox/Firefox ESR and Thunderbird prior to certain fixed versions (e.g., Thunderbird < 52.1, Firefox E...

CVE-2017-5449

CVE-2017-5449 affects Mozilla Firefox (and Thunderbird) components where a crash can be triggered during layout/manipulation of bidirectional Unicode text in concert with CSS animations. Public records in connected advisories indicate affected versions: Thunderbird < 52.1, Firefox ESR < 52....

CVE-2017-5466

CVE-2017-5466 describes an origin-confusion bug triggered when a page loaded from an original site via a hyperlink redirects to a data:text/html URL, causing the reloaded page to have an incorrect origin. This enables a cross-site scripting (XSS) risk. Affected products include Mozilla Thunderbir...