CVE-2012-4196

CVE-2012-4196 affects Mozilla Firefox (and related Mozilla components) where a prototype property-injection attack on the Location object (window.location) bypassed Same Origin Policy. Affected are Firefox prior to 16.0.2, Firefox ESR 10.x prior to 10.0.10, Thunderbird prior to 16.0.2, Thunderbir...

CVE-2026-6776

CVE-2026-6776 is a boundary-condition vulnerability in the WebRTC: Networking component that affected Firefox/Thunderbird, fixed in Firefox 150 (and ESR 140.10) and Thunderbird 150 (and ESR 140.10). The explicit issue is an incorrect boundary handling in the WebRTC Networking path, with CVSSv3.1 ...

CVE-2006-6499

The CVE-2006-6499 entry concerns Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The vulnerability is a memory overwrite that occurs when floating-point precision is reduced, rather than exiting safely. This can allow remot...

CVE-2025-4082

CVE-2025-4082 affects Thunderbird for macOS. It describes memory corruption in WebGL shader attributes that can trigger an out-of-bounds read, with potential for privilege escalation when combined with other issues. The vulnerability applies to Thunderbird versions before 138 and 128.10 (and to F...

CVE-2025-5262

CVE-2025-5262: A double-free in vpx_codec_enc_init_multi after a failed allocation during WebRTC encoder initialization can cause memory corruption and a potentially exploitable crash. Affected: Thunderbird < 139 and Thunderbird

CVE-2026-0818

CVE-2026-0818 concerns Thunderbird where decrypting an inline OpenPGP message embedded in HTML/CSS could render in a context with outer email CSS, potentially enabling exfiltration of secret content if remote content is allowed. Affected versions: Thunderbird < 147.0.1 and Thunderbird

CVE-2026-6770

CVE-2026-6770 concerns an issue in the Storage: IndexedDB component affecting Firefox and Thunderbird. The initial entry notes an “Other issue in the Storage: IndexedDB component” and states it was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected adviso...

CVE-2026-6777

CVE-2026-6777 is a general description of an issue in the Networking: DNS component, without explicit exploitation details. The connected advisories indicate a fix in Firefox 150 and Thunderbird 150, and Fedora advisories recommend updating NSS to 3.122.1 along with Firefox to 150.0. The ENISA/EU...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2025-8031

CVE-2025-8031 concerns a vulnerability where the username:password portion is not correctly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. The CVE’s context across connected documents shows affected software including Firefox and Thunderbird variants...

CVE-2025-8037

CVE-2025-8037 affects Mozilla Firefox (and Thunderbird) browsers when a nameless cookie value contains an equals sign, shadowing other cookies. Affected: Firefox <141, Firefox ESR <140.1, Thunderbird <141, Thunderbird

CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2026-6769

CVE-2026-6769 is a privilege-escalation issue in the Firefox/Thunderbird Debugger component. The Initial Description states a fix in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories (ALAS2FIREFOX-2026-058, ALSA-2026:19348, ALSA-2026:10757, Debian DLA/...

CVE-2008-4065

CVE-2008-4065 affects Mozilla Firefox (≤2.0.0.16, and ≤3.0.1/3.0.x before 3.0.2), Thunderbird (≤2.0.0.16), and SeaMonkey (≤1.1.11) with a BOM-based stripping issue that can bypass cross‑site scripting (XSS) protections. The root cause is removal of Stripped BOM characters from JavaScript code pri...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2012-4184

CVE-2012-4184 affects Mozilla's COW in Firefox (and related Mozilla products) prior to version 16.0 (Firefox), ESR 10.x prior to 10.0.8, Thunderbird prior to 16.0, Thunderbird ESR 10.x prior to 10.0.8, and SeaMonkey prior to 2.13. The issue allows a crafted web site to bypass restrictions and acc...

CVE-2018-18512

CVE-2018-18512 is a use-after-free vulnerability in Thunderbird triggered while playing a sound notification. The memory holding the sound data is freed while playback continues asynchronously, enabling potential crashes. Affected products: Thunderbird versions prior to 60.5. Root cause: use-afte...

CVE-2025-8039

The CVE-2025-8039 entry concerns a vulnerability where search terms persist in the URL bar after navigating away from a search page. Affected software and versions are Mozilla Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird

CVE-2025-9181

CVE-2025-9181: Uninitialized memory in the JavaScript Engine is confirmed in connected documents affecting Firefox and Thunderbird branches prior to version 142 (and ESR branches prior to 128.14, 140.2 for ESR). The issue is a memory-safety bug in the JS engine; no exploitation details are provid...

CVE-2026-6773

The vulnerability CVE-2026-6773 is a denial-of-service caused by an integer overflow in the Graphics: WebGPU component. Affected products identified in the provided sources include Firefox and Thunderbird; the issue was fixed in Firefox 150 and Thunderbird 150. The CVE’s impact is documented as h...

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2025-8028

CVE-2025-8028 describes a vulnerability in Firefox and Thunderbird affecting arm64 WASM, where a br_table with many entries can cause the branch label to be miscomputed due to truncation. Affected are Firefox and Firefox ESR versions prior to 141/115.26/128.13/140.1 and Thunderbird versions prior...

CVE-2026-2781

CVE-2026-2781 is an integer overflow in the AES-GCM implementation of the Mozilla Network Security Service libraries (NSS) affecting Firefox/Thunderbird suites. Connected advisories confirm the NSS overflow can lead to memory safety concerns, with fixes delivered in Firefox 148 and corresponding ...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2025-9182

CVE-2025-9182 denotes a denial-of-service caused by an out-of-memory condition in the Graphics: WebRender component. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderbird < 142, and Thunderbird

CVE-2026-6754

CVE-2026-6754 is a memory-safety issue (Use-after-free) in the JavaScript Engine component that was fixed in Firefox 150 and related ESR branches, as well as Thunderbird 150/140.x lines. Public advisories confirm the flaw in the JavaScript engine leads to a potentially exploitable memory corrupti...

CVE-2026-8093

CVE-2026-8093 concerns memory-safety bugs in Firefox 150.0.1. The gathered records describe memory corruption clues and state that, with sufficient effort, some flaws could have allowed arbitrary code execution. Mozilla's advisory confirms the issue was fixed in Firefox 150.0.2. Affected software...

CVE-2026-16358

Summary: CVE-2026-16358 is a site-isolation issue in the Graphics: WebRender component of Mozilla Firefox/Firefox ESR. The underlying problem is within WebRender's handling of cross-origin/site isolation, and it has been fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected p...

CVE-2006-6500

CVE-2006-6500 describes a heap-based buffer overflow in Mozilla-related products. A remote attacker could crash the application or possibly execute arbitrary code by crafting CSS cursor images that trigger an incorrect Windows bitmap size calculation during conversion. Affected software per the d...

CVE-2006-1530

Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.

CVE-2008-3835

CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...

CVE-2025-3031

CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...

CVE-2012-4195

CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....

CVE-2012-4217

CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey

CVE-2025-8038

CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...

CVE-2026-12304

CVE-2026-12304 involves a Same-origin policy bypass in the Networking: Cookies component affecting Mozilla products. The vulnerability is documented for Firefox and Thunderbird (including firefox-esr and Thunderbird ESR variants) with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderb...

CVE-2026-6760

Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...

CVE-2017-7763

CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...

CVE-2025-4089

CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...

CVE-2025-6435

CVE-2025-6435 corresponds to a Mozilla Firefox/Thunderbird issue where saving a response from Devtools Network tab via the Save As menu may fail to preserve the .download extension. This could allow a user to inadvertently run a malicious executable. The FreeBSD advisory also notes memory safety ...

CVE-2026-2796

CVE-2026-2796 describes a JIT miscompilation in the JavaScript: WebAssembly component that affects Firefox and Thunderbird prior to version 148. The root cause is a JIT miscompilation in the WebAssembly pathway within the JavaScript engine, leading to a high-severity impact (as reflected by the C...

CVE-2026-6768

CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...

CVE-2026-6784

CVE-2026-6784 covers memory safety bugs in Mozilla Firefox 149 and Thunderbird 149 that could lead to memory corruption and, with sufficient effort, potentially arbitrary code execution. The vulnerability is evidenced across multiple feeds and is mitigated by upgrading to Firefox 150 and Thunderb...

CVE-2009-3982

The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2025-4085

CVE-2025-4085 affects Mozilla Firefox (earlier than 138.0) and Mozilla Thunderbird (earlier than 138.0). The issue arises when a content process could abuse the privileged UITour actor to leak sensitive information or escalate privileges. The description consistently identifies the root cause as ...