CVE-2012-4181

CVE-2012-4181 is a use-after-free in Mozilla Firefox's nsSMILAnimationController::DoSample that can lead to remote code execution or a denial of service (heap memory corruption). Affected products include Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunde...

CVE-2017-5416

CVE-2017-5416 is a null dereference crash in HttpChannel caused by premature release of a networking event listener in certain Firefox/Thunderbird environments. Concrete details from connected docs show the issue as a memory-access crash stemming from a premature release, affecting Firefox/Firefo...

CVE-2021-4126

The CVE-2021-4126 issue affects Thunderbird: when receiving an OpenPGP/MIME signed email with an outer MIME layer (e.g., mailing list footer), Thunderbird incorrectly treated inner content as signed. The root cause is that the displayed signature status was based on the inner part; since 91.4.1, ...

CVE-2025-6436

Mozilla Firefox and Thunderbird versions prior to 140 are affected by memory safety bugs that can cause memory corruption . A remote attacker could potentially exploit these flaws to achieve arbitrary code execution . These vulnerabilities have been addressed in Firefox 140 and Thunderbird 140 . ...

CVE-2025-8032

XSLT document loading in Mozilla Firefox and Thunderbird failed to correctly propagate the source document, resulting in a Content Security Policy (CSP) bypass . This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 12...

CVE-2026-16350

The Audio/Video: cubeb component in Mozilla Firefox and Mozilla Thunderbird is vulnerable to incorrect boundary conditions . This flaw impacts several versions including Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . The vulnerability is assigne...

CVE-2026-16377

A mitigation bypass vulnerability exists in the PDF Viewer component of the Mozilla Firefox and Thunderbird browsers. This flaw could potentially lead to the execution of arbitrary code. The issue has been addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . ...

CVE-2026-74938

A mitigation bypass vulnerability exists in the JavaScript: GC component of Firefox and Thunderbird . This flaw impacts multiple versions and was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the vulnerability is identified, the documents do not pr...

CVE-2017-5413

CVE-2017-5413 : A segmentation fault can occur during bidirectional layout operations in Mozilla Firefox and Thunderbird. Affected products include Firefox and Thunderbird versions earlier than 52 (Firefox 52.x, Thunderbird 52.x) with the root cause described as a crash in bidirectional processin...

CVE-2018-12368

CVE-2018-12368 describes a policy bypass where Windows 10 does not warn before opening SettingContent-ms files, enabling a WebExtension with downloads.open to execute arbitrary code without user interaction. Connected advisories confirm the issue affects Windows 10 and Mozilla products (Thunderbi...

CVE-2018-5170

CVE-2018-5170 is a vulnerability in Mozilla Thunderbird (including ESR) where an attacker can spoof the filename of an attachment, causing a user to open a remote attachment with an arbitrary file type. Affected products include Thunderbird/Thunderbird ESR before version 52.8. The underlying issu...

CVE-2021-29949

CVE-2021-29949 concerns Thunderbird and the OTR protocol library loading. The issue: during startup, Thunderbird may load a shared OTR library using a filename not distributed by Thunderbird. If a system already hosts a malicious copy of that alternative filename and the library is on the executa...

CVE-2025-8027

On 64-bit platforms, CVE-2025-8027 is caused by a discrepancy where IonMonkey-JIT only writes 32 bits of the 64-bit return value space onto the stack, while Baseline-JIT reads the full 64 bits. This unvalidated return value vulnerability can allow attackers to compromise the confidentiality, inte...

CVE-2026-6747

A Use-after-free vulnerability exists in the WebRTC component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. This flaw allows a malicious actor to use memory after it has been freed, which could lead to a remote service failure or service interruptions. The vulnerability has...

CVE-2026-74937

A use-after-free vulnerability exists in the JavaScript: GC component of Firefox and Thunderbird . This memory corruption flaw can impact these applications and was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Technical details regarding exploitability ...

CVE-2026-74990

Mozilla Thunderbird versions 140.13 , 153.0 , and 153 are affected by internal bugs that may lead to memory corruption or other security-relevant defects. While some defects could potentially be exploited with sufficient effort, specific exploit details are not provided in the documents. The vuln...

CVE-2009-1309

CVE-2009-1309 affects Mozilla Firefox (pre-3.0.9) and its related Mozilla suite components (Thunderbird, SeaMonkey). The issue arises from improper Same Origin Policy handling for XMLHttpRequest (document principal mismatch) and XPCNativeWrapper.toString (incorrect proto scope), enabling cross-si...

CVE-2009-3984

CVE-2009-3984 affects Mozilla Firefox up to 3.0.16 and Firefox 3.5.x up to 3.5.6, as well as SeaMonkey up to 2.0.1. Root cause: spoofing of the SSL indicator by navigating a document.location to an HTTPS URL that serves a 204 No Content with an empty body, enabling a user-facing location-bar spoo...

CVE-2012-3984

CVE-2012-3984 affects Mozilla Firefox (<16.0), Mozilla Thunderbird (<16.0), and SeaMonkey (

CVE-2012-5842

CVE-2012-5842 is a Mozilla Firefox browser engine vulnerability described as multiple unspecified vulnerabilities that can cause memory corruption leading to a crash or possibly remote code execution. Affected products/versions per description: Mozilla Firefox before 17.0, Firefox ESR 10.x before...

CVE-2017-7752

CVE-2017-7752 is a use-after-free vulnerability triggered by specific user interactions with the input method editor (IME) in certain languages. The flaw is reported to affect Mozilla Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The impacted component is tied ...

CVE-2026-6749

The Graphics: Canvas2D component in Mozilla Firefox and the Thunderbird email client is vulnerable to an information disclosure due to the use of uninitialized memory . A malicious actor could remotely disclose sensitive information by exploiting this flaw. This vulnerability has been addressed i...

CVE-2012-4213

The CVE-2012-4213 issue is a concrete use-after-free vulnerability in Mozilla codepath: nsEditor::FindNextLeafNode affects Firefox and related products. Affected components per the initial description are Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, with remote...

CVE-2017-5406

CVE-2017-5406 is a memory/segmentation fault in the Skia graphics library triggered during certain canvas operations due to issues with mask/clip intersection and empty masks. Affected products include Mozilla Firefox and Mozilla Thunderbird (Firefox/Thunderbird versions earlier than 52). The roo...

CVE-2025-3932

Mozilla Thunderbird is vulnerable to a flaw where an attacker can craft an email displaying a tracking link as an attachment. When a user attempts to open this attachment, Thunderbird automatically accesses the link, bypassing the configuration designed to block remote content. The root cause inv...

CVE-2026-74961

A side-channel vulnerability exists in the Web Audio component of Firefox and Thunderbird . The flaw was addressed in the following versions: Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the technical root cause is not detailed in the provided documents beyond...

CVE-2026-8093

Memory safety bugs in Firefox version 150.0.1 and the Thunderbird email client allow for memory corruption. These vulnerabilities could be exploited by a remote attacker with sufficient effort to execute arbitrary code due to operations escaping the buffer in memory. These issues have been addres...

CVE-2012-3994

Mode C: CVE-2012-3994 affects Mozilla Firefox family and related Mozilla components (e.g., Firefox, Firefox ESR, Thunderbird, SeaMonkey). Root cause: use of Object.defineProperty to shadow the top object and interaction with top.location, enabling remote XSS via a binary plugin. Affected versions...

CVE-2012-5836

CVE-2012-5836 affects Mozilla Firefox (before 17.0), Mozilla Thunderbird (before 17.0), and SeaMonkey (before 2.14). The issue can allow remote code execution or an application crash when CSS properties are combined with SVG text, due to the root cause described by MFSA 2012-94. Public advisories...

CVE-2020-15685

CVE-2020-15685 affects Thunderbird prior to 78.7. During the plaintext phase of STARTTLS, protocol commands could be injected and evaluated within the encrypted session. Affected product: Thunderbird (before 78.7). Root cause: insufficient validation during STARTTLS plaintext phase. Impact: poten...

CVE-2025-14321

The CVE-2025-14321 entry documents a Use-after-free in the WebRTC: Signaling component affecting Firefox before 146 and Firefox ESR before 140.6, and Thunderbird before 146/140.6. Public advisories (ALAS and Debian S/DLA notes) indicate memory-safety/allocations issues are part of the Firefox/Thu...

CVE-2015-0797

CVE-2015-0797 affects GStreamer up to 1.4.4 (GStreamer 1.4.x) when used by Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux. The flaw is a buffer over-read in H.264 video data processing in the GStreamer pipeline (m4v files) that can cause a denial o...

CVE-2026-16368

The JavaScript: WebAssembly component in the Firefox browser and Thunderbird mail client is vulnerable to incorrect boundary conditions . This flaw can lead to security issues, including the potential for arbitrary code execution or sandbox escapes . The vulnerability has been patched in Firefox ...

CVE-2026-74987

Mozilla Thunderbird and Firefox are affected by internally found bugs that may lead to memory corruption or other security-relevant defects. These issues were identified in Thunderbird ESR 140.13 , Thunderbird ESR 153.0 , and Thunderbird 153 . While the exact root cause is not detailed, the repor...

CVE-2026-12293

CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...

CVE-2026-16389

The Libraries component in NSS contains an integer overflow due to incorrect boundary conditions . This vulnerability was addressed in Firefox 153 and Thunderbird 153 . Specific details regarding the impact or exploitative vectors are not provided in the documents.

CVE-2012-5830

CVE-2012-5830 is a use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X that allows remote attackers to execute arbitrary code via an HTML document. The con...

CVE-2013-0752

Technical details for CVE-2013-0752 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2013-0756

CVE-2013-0756 corresponds to a use-after-free in Mozilla Firefox’s obj_toSource path that can be triggered by a crafted web page referencing JavaScript Proxy objects, allowing remote code execution via standard web-visit attack vectors. Affected products include Firefox (pre-18.0), Firefox ESR 17...

CVE-2017-5418

CVE-2017-5418 is an out-of-bounds read error in parsing HTTP digest authorization responses, leading to information leakage. Affected products are Mozilla Firefox and Thunderbird prior to version 52.0. The issue is fixed in Firefox 52.0+ (and related Thunderbird updates per advisories), with reme...

CVE-2017-7750

CVE-2017-7750 describes a use-after-free in video control operations when a element holds a reference to an older window that has been replaced in the DOM, leading to a potentially exploitable crash. Affected products and versions from the connected records include Mozilla Firefox < 54, Firef...

CVE-2017-7804

CVE-2017-7804 involves the WindowsDllDetourPatcher destructor, which can be repurposed by malicious code in conjunction with other flaws to write arbitrary data to memory under attacker control on Windows. Public advisories for Mozilla Thunderbird and Firefox (MFSA 2017-18/19, MFSA 2017-20) descr...

CVE-2022-3155

CVE-2022-3155 affects Mozilla Thunderbird and is described as: when saving or opening a mail attachment on macOS, Thunderbird failed to set the com.apple.quarantine attribute on the received file. If the file was an application, opening it could launch the application immediately without user con...

CVE-2025-8034

Mozilla Firefox and Thunderbird are affected by memory safety bugs that may lead to memory corruption. If successfully exploited, an attacker could execute arbitrary code or cause a denial of service (service failure) on the vulnerable system. Affected Versions include Firefox < 141, Firefox E...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2026-74935

A privilege escalation vulnerability exists in the DOM: Networking component of the Mozilla Firefox and Thunderbird browsers. The flaw allows for unauthorized privilege escalation within the networking component. This issue has been addressed in the following versions: Firefox 154 , Firefox ESR 1...

CVE-2012-3988

CVE-2012-3988 is a use-after-free vulnerability in Mozilla Firefox (pre-16.0), Firefox ESR (pre-10.0.8), Thunderbird (pre-16.0), Thunderbird ESR (pre-10.0.8), and SeaMonkey (pre-2.13). It can be triggered via mozRequestFullScreen with full-screen mode and navigation via history.back, potentially ...

CVE-2017-5422

CVE-2017-5422 describes a denial-of-service crash triggered by repeatedly using the view-source: protocol within a single hyperlink. The issue affects Mozilla Firefox and Thunderbird prior to version 52. The root cause is tied to how the view-source: protocol was handled in a chained hyperlink, a...

CVE-2018-5161

The CVE-2018-5161 issue affects Mozilla Thunderbird (including ESR branches) and is caused by crafted message headers that can cause the Thunderbird process to hang when receiving a message. Public records identify affected versions as Thunderbird ESR < 52.8 and Thunderbird

CVE-2025-3523

The Mozilla Thunderbird email client is vulnerable to a User Interface (UI) Misrepresentation issue. When an email contains multiple attachments with external links provided via the X-Mozilla-External-Attachment-URL header, the client only displays the last link in the hover text for any of the a...