CVE-2025-1943

Mozilla Firefox and Thunderbird (versions prior to 136 ) are affected by memory safety bugs involving memory corruption . A buffer overflow in dynamic memory could allow a remote attacker to execute arbitrary code . Remediation is available in Firefox 136 and Thunderbird 136 . Exploitation detail...

CVE-2026-12296

A sandbox escape vulnerability exists in the Security: Process Sandboxing component of Mozilla products, including Firefox and Thunderbird . This issue was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause is not det...

CVE-2026-12315

A mitigation bypass exists in the DOM: Security component of the Firefox and Thunderbird applications. This vulnerability was addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . Exploitation details are not provided in the available documentation. For Amazon...

CVE-2026-16357

This vulnerability exists in the Graphics component of the Mozilla Firefox and Thunderbird browsers, caused by incorrect boundary conditions . It affects multiple versions, including Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Remediation is ...

CVE-2026-7324

Mozilla Firefox (version 150.0.0) and Thunderbird (version 150.0.0) are affected by memory safety bugs that result in memory corruption. These flaws could potentially be exploited to achieve arbitrary code execution . The issue was addressed in the release of Firefox 150.0.1 and Thunderbird 150.0...

CVE-2026-74955

A privilege escalation vulnerability exists in the Request Handling component of Firefox and Thunderbird. This flaw impacts Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . The issue was addressed in the aforementioned versions. Exploitation details and specific attack ...

CVE-2026-74957

A mitigation bypass exists in the Safe Browsing component of Mozilla Firefox and Thunderbird . This vulnerability affects multiple versions, including Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The issue has been addressed in th...

CVE-2026-84136

CVE-2026-84136 is a remote code execution vulnerability in the DOM: Navigation component of Mozilla products, affecting Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (before 153.2). Per Kaspersky, it can be exploited remotely to execute arbitrary ...

CVE-2007-0777

CVE-2007-0777 affects Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, as well as Thunderbird before 1.5.0.10 and SeaMonkey before 1.0.8. The issue is a memory corruption vulnerability in the JavaScript engine that can be triggered by crafted JavaScript, resulting in a crash and possibly a...

CVE-2025-4082

CVE-2025-4082 involves a memory corruption vulnerability in the WebGL Shader Attribute Handler component of Mozilla Firefox , Mozilla Firefox ESR , and the Mozilla Thunderbird email client. Modification of specific WebGL shader attributes can trigger an out-of-bounds read , which, when chained wi...

CVE-2025-8037

Mozilla Firefox , Firefox ESR , and Thunderbird are affected by a vulnerability where setting a nameless cookie with an equals sign in its value can shadow other cookies. This occurs even if the nameless cookie is transmitted over HTTP and the targeted shadowed cookie includes the Secure attribut...

CVE-2025-9185

CVE-2025-9185 is a memory-safety issue affecting Firefox and Thunderbird components across Firefox/Thunderbird releases up to version 142 (Firefox <142, ESR <115.27/128.14/140.2; Thunderbird

CVE-2026-74978

CVE-2026-74978 is a clickjacking vulnerability affecting the Widget component in Mozilla products. The issue has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . This vulnerability is categorized as a CWE-1021 (Improper Restriction of Rendered UI Layer...

CVE-2026-84133

A site isolation issue exists in the DOM: Push Subscriptions component of the Firefox and Thunderbird browsers. This vulnerability affects the following versions: Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . The issue has been addressed in these released versions. N...

CVE-2026-84140

CVE-2026-84140 is a site isolation issue in the DOM: Navigation component affecting Mozilla Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Per Kaspersky analysis, this vulnerability enables remote code execution when exploited, allowing arbitrary code to run on the target system. The...

CVE-2026-92005

A Use-after-free vulnerability exists in the Audio/Video: Web Codecs component of Mozilla Firefox and Thunderbird . This flaw was addressed in Firefox 156 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thunderbird 156 , Thunderbird 140.16 , and Thunderbird 153.3 . Exploitation details are not provide...

CVE-2008-4060

CVE-2008-4060 affects Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaw, exploitable via document.loadBindingDocument and XSLT processing, could allow remote attackers to execute arbitrary code with chrome privileges. Th...

CVE-2012-1975

CVE-2012-1975 is a Use-after-free vulnerability in PresShell::CompleteMove affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. It potentially allows remote code execution or a denial of serv...

CVE-2012-3985

CVE-2012-3985 is a vulnerability in Mozilla Firefox, Thunderbird, and SeaMonkey where the HTML5 Same Origin Policy could be violated, allowing initial-origin access after document.domain is set and potentially enabling cross-site scripting (XSS). Affected versions are Firefox/Thunderbird/SeaMonke...

CVE-2012-4205

CVE-2012-4205 affects Mozilla Firefox (prior to 17.0), Mozilla Thunderbird (prior to 17.0), and SeaMonkey (prior to 2.14). The root cause, per the description, is that XMLHttpRequest objects created in sandboxes are assigned the system principal rather than the sandbox principal, enabling CSRF ag...

CVE-2013-0766

CVE-2013-0766 is a use-after-free in the ~nsHTMLEditRules implementation affecting Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15. The vulnerabili...

CVE-2017-7756

CVE-2017-7756 is a use-after-free/use-after-scope vulnerability affecting Firefox <54, Firefox ESR <52.2, and Thunderbird

CVE-2017-7764

CVE-2017-7764 concerns a domain spoofing issue in the address bar caused by mixing Canadian Syllabics with Latin characters in IDN rendering. Affected products include Firefox before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The vulnerability arises from the Unicode handling that ...

CVE-2017-7848

CVE-2017-7848 affects Mozilla Thunderbird prior to 52.5.2. The issue allows RSS fields to inject new lines into the created email structure, altering the message body. Public entries and advisories confirm Thunderbird upgrades to 52.5.2 as the fix (e.g., CentOS/RHSA-2018:0061, Debian DSA-4075-1 a...

CVE-2025-26695

The Mozilla Thunderbird email client is vulnerable to an information leak when requesting an OpenPGP key from a WKD server . The root cause is the use of an incorrect padding size , which allows a network observer to determine the length of the requested email address. This vulnerability affects ...

CVE-2026-12311

A vulnerability in the Security: Process Sandboxing component of Mozilla Firefox and Mozilla Thunderbird allows for information disclosure and a sandbox escape . This issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . No specific exploit deta...

CVE-2026-16384

CVE-2026-16384 is an information disclosure vulnerability caused by uninitialized memory within the Graphics: WebGPU component. The issue affects Firefox and Thunderbird , with a fix provided in version 153 of both products. No specific exploit details or in-the-wild exploitation have been docume...

CVE-2026-2783

CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...

CVE-2026-6784

Mozilla Firefox and Thunderbird versions 149 and earlier are affected by memory safety bugs that can lead to memory corruption . If exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed and fixed in Firefox 150 and Thunderbird 150 . Evidenc...

CVE-2026-74941

A privilege escalation vulnerability exists in the Graphics: CanvasWebGL component. This flaw affects the Firefox web browser and the Thunderbird mail client. The issue has been addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderb...

CVE-2026-92018

A sandbox escape vulnerability exists in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird . This flaw allows an attacker to bypass the sandbox environment, potentially leading to a significant impact on the host system. Affected versions include Firefox 156 , Firefox ESR 115.41 ,...

CVE-2012-1973

CVE-2012-1973 is a use-after-free vulnerability in Mozilla Firefox family components. The issue arises in nsObjectLoadingContent::LoadObject, affecting Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Expl...

CVE-2013-0782

CVE-2013-0782 is a heap-based buffer overflow in Mozilla’s nsSaveAsCharset::DoCharsetConversion that affects Firefox before 19.0, ESR 17.x before 17.0.3, Thunderbird before 17.0.3, and SeaMonkey before 2.16. The connected documents confirm this vulnerability and show affected components include F...

CVE-2017-7825

The CVE-2017-7825 entry describes an OS X–specific issue where several fonts render Tibetan and Arabic characters as whitespace. When such characters appear in an IDN in the address bar, they enable domain name spoofing. Affected products include Mozilla Firefox versions earlier than 56 and Firef...

CVE-2017-7829

CVE-2017-7829 is a Thunderbird vulnerability in which the sender’s address can be spoofed. The real sender is hidden if a null character precedes the display string, causing the recipient to see an arbitrary address. Affected product is Mozilla Thunderbird prior to 52.5.2. The issue is described ...

CVE-2025-26696

The Mozilla Thunderbird email client is vulnerable to a flaw where certain crafted MIME email messages can be incorrectly displayed as encrypted. Specifically, messages that claim to contain an encrypted OpenPGP message but actually contain an OpenPGP signed message are wrongly shown as being enc...

CVE-2025-3033

The Mozilla Firefox (prior to 137.0) and Mozilla Thunderbird (prior to 137.0) browsers/clients on Windows are vulnerable to a flaw where selecting a malicious Windows .url shortcut from the local filesystem can lead to an unexpected file upload . This issue is specific to the Windows operating sy...

CVE-2025-3034

Mozilla Firefox and Thunderbird versions prior to 137 are affected by multiple memory safety bugs . These vulnerabilities involve memory corruption issues, which could allow a remote attacker to execute arbitrary code by performing operations beyond buffer boundaries in memory. Remediation is pro...

CVE-2025-8028

On arm64 architecture, a WASM br_table instruction containing numerous entries can cause the label to be positioned too far from the instruction. This results in truncation and the incorrect computation of the branch address . This vulnerability affects Firefox versions prior to 141, Firefox ESR ...

CVE-2026-74936

A use-after-free in the JavaScript: WebAssembly component of Firefox/Thunderbird can lead to memory corruption and arbitrary code execution. CVSS 9.8 (network, no auth required). Fixed in Firefox 154, ESR 140.14, ESR 153.1, Thunderbird 154, 140.14, and 153.1; Debian and Slackware packages updated...

CVE-2026-74949

The Graphics: Canvas2D component in Firefox and Thunderbird is vulnerable to privilege escalation due to a use-after-free condition. This flaw has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbir...

CVE-2026-74986

A site isolation issue exists in the CSS Parsing and Computation component of Mozilla Firefox and Thunderbird . This vulnerability is fixed in the following versions: Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific exploit information or practical consequen...

CVE-2012-3961

CVE-2012-3961 is a use-after-free in the RangeData implementation affecting Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0/ESR 10.x before 10.0.7, and SeaMonkey before 2.12. Exploitation could allow remote code execution or a denial of service via heap memory...

CVE-2013-0770

CVE-2013-0770 affects Mozilla Firefox (pre-18.0), Thunderbird (pre-17.0.2), and SeaMonkey (pre-2.15). The issue is described as multiple unspecified vulnerabilities in the browser engine that can cause memory corruption and application crashes, with potential for arbitrary code execution via unkn...

CVE-2014-1511

Mozilla Firefox versions before 28.0 , Firefox ESR 24.x before 24.4 , Thunderbird before 24.4 , and SeaMonkey before 2.25 are vulnerable to a security flaw that allows remote attackers to bypass the popup blocker via unspecified vectors. While specific technical root causes for this bypass are no...

CVE-2026-16363

A JIT miscompilation vulnerability exists in the JavaScript: WebAssembly component of the Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . While the vulnerability is documented as having a CRITICAL sever...

CVE-2026-2796

CVE-2026-2796 describes a JIT miscompilation in the JavaScript: WebAssembly component that affects Firefox and Thunderbird prior to version 148. The root cause is a JIT miscompilation in the WebAssembly pathway within the JavaScript engine, leading to a high-severity impact (as reflected by the C...

CVE-2026-8949

An integer overflow exists in the Widget: Win32 component across several Mozilla products, including Firefox , Firefox ESR , and Thunderbird . This input validation error can lead to multiple impacts, including Arbitrary Code Execution (ACE) , Denial of Service (DoS) , Security Bypass (SB) , and ...

CVE-2012-4191

Technical details about CVE-2012-4191 (affected products, root cause, impact, or fixes) are not provided in the connected documents. Please monitor for updates.

CVE-2025-8029

Mozilla Thunderbird and Firefox (including ESR versions) are vulnerable to the execution of javascript: URLs when used within object and embed tags. This issue affects versions prior to Firefox 141 , Firefox ESR 128.13 , Firefox ESR 140.1 , Thunderbird 141 , Thunderbird 128.13 , and Thunderbird 1...