CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2024-11159

CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...

CVE-2025-1943

CVE-2025-1943 covers memory-safety bugs in Mozilla Firefox 135 and Thunderbird 135, affecting Firefox < 136 and Thunderbird

CVE-2025-26696

CVE-2025-26696 affects Mozilla Thunderbird and is triggered by certain crafted MIME messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message, causing the UI to mis-display the content as encrypted. Public references in connected documents corrobor...

CVE-2026-12289

CVE-2026-12289 describes a privilege-escalation vulnerability in the Graphics: WebRender component. The public description and connected advisories indicate this affects Mozilla Firefox and Thunderbird products, with fixes shipped in: Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbi...

CVE-2026-12291

CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2025-8030

CVE-2025-8030 is publicly known and tied to an insufficent escaping in the “Copy as cURL” feature that could lead to code execution. The connected Astra Linux and Amazon/Linux advisories confirm the issue affects Firefox and Thunderbird across multiple tracks (e.g., Firefox < 141, Firefox ESR ...

CVE-2026-0818

CVE-2026-0818 concerns Thunderbird where decrypting an inline OpenPGP message embedded in HTML/CSS could render in a context with outer email CSS, potentially enabling exfiltration of secret content if remote content is allowed. Affected versions: Thunderbird < 147.0.1 and Thunderbird

CVE-2026-6747

CVE-2026-6747 is a use-after-free vulnerability in the WebRTC component. Technical details across connected advisories show this affects Firefox/Firefox ESR and Thunderbird suites, with fixes applied in Firefox 150 and ESR 140.10, and in Thunderbird 150 (also 140.10). Remediation per the linked a...

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2025-4092

The CVE-2025-4092 entry concerns memory safety bugs in Mozilla Firefox 137/Thunderbird 137 that reportedly could be exploited to execute arbitrary code. Affected products are Firefox and Thunderbird versions before 138. Root cause is memory safety/memory corruption in the browser components; Mozi...

CVE-2026-6770

CVE-2026-6770 concerns an issue in the Storage: IndexedDB component affecting Firefox and Thunderbird. The initial entry notes an “Other issue in the Storage: IndexedDB component” and states it was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected adviso...

CVE-2026-6772

CVE-2026-6772 affects the NSS Libraries component, specifically an incorrect boundary condition in NSS Libraries. The vulnerability is exploitable via network access with no user interaction and no privileges required, with a CVSS v3.1 base score of 7.5 (High). Affected products/contexts include ...

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2017-7847

Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...

CVE-2025-8035

CVE-2025-8035 affects Mozilla Firefox and Thunderbird desktop clients (Firefox/Firefox ESR and Thunderbird up to versions around 140.x/141.x). The connected sources describe memory-safety bugs in Firefox ESR 128.12, 140.0, and Firefox/Thunderbird 140, plus similar issues in Thunderbird ESR lines,...

CVE-2026-6749

CVE-2026-6749 is an information disclosure vulnerability in the Graphics: Canvas2D component, caused by uninitialized memory. It affects Firefox and Thunderbird products; Mozilla advisories state fixes in Firefox 150, Firefox ESR 115.35 and 140.10, and Thunderbird 150 and 140.10. Amazon Linux 2 a...

CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2017-7845

CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox

CVE-2025-14321

The CVE-2025-14321 entry documents a Use-after-free in the WebRTC: Signaling component affecting Firefox before 146 and Firefox ESR before 140.6, and Thunderbird before 146/140.6. Public advisories (ALAS and Debian S/DLA notes) indicate memory-safety/allocations issues are part of the Firefox/Thu...

CVE-2017-7757

CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...

CVE-2026-16358

Summary: CVE-2026-16358 is a site-isolation issue in the Graphics: WebRender component of Mozilla Firefox/Firefox ESR. The underlying problem is within WebRender's handling of cross-origin/site isolation, and it has been fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected p...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2012-4182

CVE-2012-4182 is a Use-after-free in Mozilla Firefox’s nsTextEditRules::WillInsert, affecting Firefox <= 16.0 and Firefox ESR <= 10.x <= 10.0.8, Thunderbird <= 16.0 and ESR 10.x <= 10.0.8, and SeaMonkey

CVE-2012-5840

CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...

CVE-2018-18513

CVE-2018-18513 is a Firefox/Thunderbird vulnerability where a crash can occur while processing a crafted S/MIME message or an XPI package with a crafted signature, allowing a denial-of-service attack as Thunderbird reopens the last seen message on restart and re-triggers the crash. Affected produ...

CVE-2025-3034

CVE-2025-3034 corresponds to memory-safety bugs in Firefox 136 and Thunderbird 136. Some flaws show memory corruption and could be exploitable with enough effort to run arbitrary code. Affected products are Firefox < 137 and Thunderbird

CVE-2025-9180

CVE-2025-9180 describes a same-origin policy bypass in the Graphics: Canvas2D component affecting Firefox and Thunderbird. Affected versions include Firefox and Thunderbird before 142, and ESR channels before 115.27, 128.14, or 140.2. Several connected advisories confirm the same issue and provid...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2006-6503

CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...

CVE-2018-18512

CVE-2018-18512 is a use-after-free vulnerability in Thunderbird triggered while playing a sound notification. The memory holding the sound data is freed while playback continues asynchronously, enabling potential crashes. Affected products: Thunderbird versions prior to 60.5. Root cause: use-afte...

CVE-2026-12324

CVE-2026-12324 concerns an issue in the Graphics: CanvasWebGL component caused by incorrect boundary conditions. Public sources indicate the vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The available documents do not provide exploit vectors ...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2009-3981

CVE-2009-3981 affects Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird. The issue is an unspecified remote vulnerability in the browser engine that can cause memory corruption, leading to a crash or potentially arbitrary code execution via unknown vectors, and can result in ...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2025-8033

The CVE-2025-8033 issue is a memory-safety bug in Mozilla’s JavaScript engine where closing generators could be resumed, causing a null pointer dereference. Affected products include Firefox and Thunderbird forks across multiple release lines (Firefox < 141, ESR tracks <115.26, <128.13, ...

CVE-2025-8034

CVE-2025-8034 involves memory safety bugs in Mozilla Firefox/Thunderbird across multiple releases (Firefox ESR 115.25, 128.12; Firefox/Thunderbird 140.x; ESR 115.26, 128.13, 140.1). Some bugs show memory corruption and could potentially be exploited to run arbitrary code. Affected products list i...

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2025-3033

CVE-2025-3033 affects Firefox on Windows (Thunderbird also affected per the entry), with exploitation involving selecting a malicious Windows .url shortcut from the local file system to upload an unexpected file. Affected versions are Firefox < 137 and Thunderbird

CVE-2025-4082

CVE-2025-4082 affects Thunderbird for macOS. It describes memory corruption in WebGL shader attributes that can trigger an out-of-bounds read, with potential for privilege escalation when combined with other issues. The vulnerability applies to Thunderbird versions before 138 and 128.10 (and to F...

CVE-2025-8028

CVE-2025-8028 describes a vulnerability in Firefox and Thunderbird affecting arm64 WASM, where a br_table with many entries can cause the branch label to be miscomputed due to truncation. Affected are Firefox and Firefox ESR versions prior to 141/115.26/128.13/140.1 and Thunderbird versions prior...

CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2026-12304

CVE-2026-12304 involves a Same-origin policy bypass in the Networking: Cookies component affecting Mozilla products. The vulnerability is documented for Firefox and Thunderbird (including firefox-esr and Thunderbird ESR variants) with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderb...

CVE-2026-2797

CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...