1309 matches found
CVE-2026-12294
CVE-2026-12294 concerns a Sandbox escape in the DOM: Workers component found in Mozilla products. The vulnerability affects Firefox (including Firefox 152 and ESR branches 140.12 and 115.37) and Thunderbird (152 and 140.12). The underlying issue is a sandbox escape in the Workers component, with ...
CVE-2026-7324
CVE-2026-7324 involves memory safety bugs in Firefox 150.0.0 and Thunderbird 150.0.0. Some bugs show evidence of memory corruption, with the description noting that, with sufficient effort, some could be exploited to run arbitrary code. The vulnerability was fixed in Firefox 150.0.1. The connecte...
CVE-2013-0777
CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...
CVE-2017-7755
CVE-2017-7755 affects Mozilla Firefox and Thunderbird installers on Windows. The Firefox installer can be made to load malicious DLLs stored in the same directory as the installer, enabling privilege escalation when the installer runs with elevated privileges. Affected products/versions include F...
CVE-2017-7765
CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird
CVE-2025-8036
CVE-2025-8036 : Affects Mozilla Firefox (prior to 141, ESR prior to 140.1) and Thunderbird (prior to 141, 140.1). Root cause is caching of CORS preflight responses across IP address changes, enabling bypass of same-origin policy via DNS rebinding. Connected sources corroborate a DNS-rebinding vec...
CVE-2026-12295
CVE-2026-12295 describes a sandbox escape in the DOM: Navigation component affecting Mozilla Firefox and Thunderbird. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The entry lists a CVSS v3.1 base score of 9.6 (CRITICAL...
CVE-2006-1531
CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...
CVE-2025-4088
CVE-2025-4088 describes a cross-origin CSRF issue in Thunderbird (and affected Firefox) where malicious sites could exploit Redirects via the Storage Access API to send credentialed requests to arbitrary endpoints. Affected products: Firefox < 138 and Thunderbird
CVE-2025-4090
CVE-2025-4090 affects Thunderbird for Android and Firefox/Thunderbird before version 138 (Thunderbird <138; Firefox
CVE-2025-5272
CVE-2025-5272 arises from memory-safety bugs in Mozilla Firefox 138 and Thunderbird 138, with some bugs showing memory corruption that could potentially allow arbitrary code execution. The affected products are Firefox versions prior to 139 and Thunderbird versions prior to 139. The issue is addr...
CVE-2025-9184
The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...
CVE-2026-16375
CVE-2026-16375 affects Mozilla Firefox’s Networking: HTTP component with a site isolation issue. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. Affected product: Firefox (Networking: HTTP) with site isolation as the underlying bug. According to the provided documents, the CVSS...
CVE-2026-2797
CVE-2026-2797 is a use-after-free in the JavaScript: GC component affecting Firefox and Thunderbird. The issue was fixed in Firefox 148 and Thunderbird 148. Public exploits are noted in some sources; CVSS metrics indicate a high-severity, memory-safety class vulnerability with network attack vect...
CVE-2026-6748
CVE-2026-6748 concerns uninitialized memory in Mozilla’s Audio/Video: Web Codecs component. The Initial CVE page notes fixes in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories from Debian (DSA-6225/DSA-6229) and DLA-4549/4546/NASL entries confirm mul...
CVE-2017-5411
CVE-2017-5411 is a use-after-free in ANGLE libGLES during buffer storage on Windows, affecting Firefox < 52 and Thunderbird
CVE-2026-16356
CVE-2026-16356 describes a sandbox-escape use-after-free flaw in Mozilla Firefox’s Disability Access APIs component. The NVD entry notes this vulnerability affects Firefox desktop products and was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. The consolidated feeds (NVD, Debia...
CVE-2025-3032
The CVE-2025-3032 entry describes a vulnerability in Firefox and Thunderbird where file descriptors leak from the fork server to web content processes, enabling privilege escalation. Affected products are Firefox and Thunderbird versions prior to 137. The root cause is the unintended propagation ...
CVE-2025-8040
CVE-2025-8040 corresponds to memory-safety bugs in Mozilla Firefox/Thunderbird products (Firefox/Thunderbird 140 line, ESR 140.0 and related versions) with evidence of memory corruption that could potentially lead to arbitrary code execution. Affected components are the Firefox and Thunderbird br...
CVE-2025-9187
CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird
CVE-2026-16383
CVE-2026-16383 is a mitigation bypass in the DOM: Networking component. It affects Firefox (including ESR) and Thunderbird where the issue was addressed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The root cause is described as a DOM mitigation bypass within the N...
CVE-2026-16351
CVE-2026-16351 is a sandbox escape caused by a use-after-free in the DOM: Navigation component. It affected Mozilla Firefox and Firefox ESR prior to 115.38, with fixes in Firefox 153 and ESR 115.38/140.13. Affected products include Firefox ESR versions older than 115.38 (per multiple feeds), and ...
CVE-2026-16377
Mitigation bypass in Firefox’s PDF Viewer component (CVE-2026-16377) is confirmed. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. According to the sources, the CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, low complexity, and no user interaction required, a...
CVE-2026-8094
CVE-2026-8094 : A vulnerability in the WebRTC component reported in multiple feeds (CVE-2026-8094) affecting Mozilla Firefox ESR builds and Thunderbird. The available documents identify a WebRTC issue but do not provide detailed root cause, impacted products beyond Firefox ESR and Thunderbird, or...
CVE-2009-3980
CVE-2009-3980 affects Mozilla Firefox 3.5.x prior to 3.5.6, SeaMonkey prior to 2.0.1, and Thunderbird; the issue is memory corruption in the browser engine that can lead to a denial of service or potentially arbitrary code execution via unknown vectors. Public records indicate fixes in Firefox 3....
CVE-2012-3983
CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...
CVE-2012-4212
Public technical details about CVE-2012-4212 are not disclosed in the provided documents. Monitoring for updates is advised.
CVE-2026-12293
CVE-2026-12293 is a use-after-free in the Graphics: WebGPU component. The flaw is fixed in Firefox 152 and Thunderbird 152. Sources from NVD/Mozilla advisories confirm the issue and the patch versions; exploit details are not provided in the supplied documents. The vulnerability is classified wit...
CVE-2026-6755
CVE-2026-6755 describes a mitigation bypass in the DOM: postMessage component. Affected products reference Mozilla Firefox and Thunderbird; the vulnerability was fixed in Firefox 150 and Thunderbird 150. The CVSSv3.1 base score is 6.5 (Network attack vector, Low attack complexity, Privileges requ...
CVE-2026-6765
CVE-2026-6765 affects Firefox and Thunderbird. The vulnerability is an information disclosure in the Form Autofill component. Root cause details are not provided beyond disclosure, but the issue is mitigated by fixes in Firefox 150 , Firefox ESR 140.10 , Thunderbird 150 , and Thunderbird 140.10 ....
CVE-2017-5425
CVE-2017-5425 : The Gecko Media Plugin sandbox allowed access to local files via regex-matched paths. In OS X, this could expose data in subdirectories of “/private/var” for Firefox < 52 and Thunderbird
CVE-2025-4086
CVE-2025-4086 affects Thunderbird for Android and Firefox/ Thunderbird versions earlier than 138. The issue is triggered by a filename containing a large number of encoded newline characters that can obscure the file extension in the download dialog, potentially misleading users about the downloa...
CVE-2026-12292
CVE-2026-12292 : Incorrect boundary conditions in the Web Audio component are fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Affected software is Mozilla Firefox/Thunderbird Web Audio implementation; mitigation is upgrade to the stated fixed versions. Other con...
CVE-2026-6758
CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component. Affected: Firefox and Thunderbird; fixed in Firefox 150 and Thunderbird 150. CVSS v3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No explicit exploit details provided in the connected documents.
CVE-2026-6779
CVE-2026-6779 refers to an “Other issue in the JavaScript Engine component” that affects Firefox and Thunderbird. The vulnerability was fixed in Firefox 150 and Thunderbird 150; Fedora advisories also call for updates to NSS and Firefox 150 across affected distros. The connected docs do not provi...
CVE-2009-4630
Mo zilla Necko (Firefox, SeaMonkey and related apps) exposes a DNS prefetching flaw where domain names in links in local HTML are resolved, enabling remote observers to log DNS requests and infer user network location. Root cause: prefetching by the Necko DNS resolver. Impact: information disclos...
CVE-2012-4218
CVE-2012-4218 involves a use-after-free in Mozilla Firefox’s BuildTextRunsScanner::BreakSink::SetBreaks, affecting Firefox < 17.0, Thunderbird < 17.0, and SeaMonkey
CVE-2012-5354
CVE-2012-5354 is covered by details in connected advisories/plugins. The open-connected sources show that Mozilla Firefox before 16.0, Mozilla Thunderbird before 16.0, and SeaMonkey before 2.13 are vulnerable to a clickjacking-style issue when navigating away from a page that has an active set of...
CVE-2026-16390
CVE-2026-16390 describes a mitigation bypass in the Firefox Enterprise Policies component. The vulnerability is indicated as fixed in Firefox 153 and Firefox ESR 140.13. The initial entry provides a CVSS 3.1 base score of 9.1 (CRITICAL) with network attack vector, low attack complexity, and no us...
CVE-2026-6761
CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...
CVE-2026-12291
CVE-2026-12291 is a use‑after‑free defect in the Networking: HTTP component that affects Firefox and Thunderbird products. The vulnerability is fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. The CVSS 3.1 base score is 8.8 (HIGH) with network...
CVE-2026-16350
CVE-2026-16350 affects Mozilla Firefox and Firefox ESR (Audio/Video: cubeb). The issue is caused by incorrect boundary conditions in cubeb, with a remediation by upgrading to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13. Public CVSS 3.1 vector indicates NETWORK attack, no user interacti...
CVE-2026-16355
JIT miscompilation in the JavaScript Engine (JIT component) for Mozilla Firefox ESR and Firefox affects Firefox ESR releases earlier than 115.38. The issue is fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected entries from multiple sources confirm the vulnerability is tied...
CVE-2026-6750
CVE-2026-6750 is a privilege-escalation in the Graphics: WebRender component affecting Mozilla Firefox/Firefox ESR and Thunderbird. The vulnerability is fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10 (with Thunderbird 150 and Thunderbird 140.10 also listed in the advisory set). ...
CVE-2026-8959
CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...
CVE-2026-16361
CVE-2026-16361 affects Firefox ESR 115.37 and 140.12, described as memory safety bugs with evidence of memory corruption. The advisory notes these could have been exploited to run arbitrary code, and fixes are applied in Firefox ESR 115.38 and 140.13. Affected components/roots are not detailed be...
CVE-2026-16368
CVE-2026-16368: Affects Firefox JavaScript/WebAssembly component due to incorrect boundary conditions. Root cause described as boundary-condition flaw with all three security properties potentially impacted (high confidentiality, integrity, availability). Public fixed versions: Firefox 153 and Fi...
CVE-2026-2783
CVE-2026-2783 is a JIT miscompilation information-disclosure vulnerability in the JavaScript Engine (JIT component) that affects Firefox and Thunderbird products. Public details in connected advisories state the issue arises from JIT miscompilation, enabling information disclosure, and indicate f...
CVE-2026-16391
Information disclosure in Firefox’s Storage: IndexedDB component (CVE-2026-16391) is addressed in Firefox 153 and Firefox ESR 140.13. The CVSSv3.1 vector indicates an unaltered scope, network attack vector, high confidentiality impact with no impact to integrity/availability, and no user interact...