1355 matches found
CVE-2025-3031
CVE-2025-3031 : A vulnerability in Mozilla’s JIT-compiled code allows reading 32 bits spilled onto the stack. Affected products are Firefox and Thunderbird prior to version 137. Root cause, impact, and affected components are stated, but no exploitation details are provided in the documents. Reme...
CVE-2026-16355
JIT miscompilation in the JavaScript Engine (JIT component) for Mozilla Firefox ESR and Firefox affects Firefox ESR releases earlier than 115.38. The issue is fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. Affected entries from multiple sources confirm the vulnerability is tied...
CVE-2026-74944
CVE-2026-74944 is a use-after-free in Firefox/Thunderbird's DOM: Core & HTML component, rated Critical (CVSS 9.8, network-exploitable, no auth or user interaction required). It enables arbitrary code execution, privilege escalation, and information disclosure. Affected versions: Firefox <154, ...
CVE-2025-8038
CVE-2025-8038 corresponds to a Mozilla framing/navigation vulnerability where Thunderbird ignored path checks when validating navigations in a frame. Affected products include Firefox before 141 and Firefox ESR before 140.1, and Thunderbird before 141 and before 140.1. Root cause per the sources ...
CVE-2006-1530
Technical details for CVE-2006-1530 are not publicly available in the provided documents. Monitor for updates.
CVE-2008-3835
CVE-2008-3835 affects Mozilla Firefox up to 2.0.0.17, Thunderbird up to 2.0.0.17, and SeaMonkey up to 1.1.12. Root cause: nsXMLDocument::OnChannelRedirect bypasses Same Origin Policy, allowing remote attackers to run arbitrary JavaScript. Impact: remote code execution via crafted web content. Rem...
CVE-2012-4195
CVE-2012-4195 concerns Mozilla Firefox (and related Mozilla components) where nsLocation::CheckURL does not correctly determine the calling document/principal, enabling cross-site scripting (XSS) via crafted sites and certain add-on behaviors. Affected products/versions include Firefox before 16....
CVE-2025-8036
CVE-2025-8036 : Affects Mozilla Firefox (prior to 141, ESR prior to 140.1) and Thunderbird (prior to 141, 140.1). Root cause is caching of CORS preflight responses across IP address changes, enabling bypass of same-origin policy via DNS rebinding. Connected sources corroborate a DNS-rebinding vec...
CVE-2026-6760
Mitigation bypass in the Networking: Cookies component (CVE-2026-6760) affects Firefox and Thunderbird; root cause is a bypass of cookie-related mitigations. The CVSSv3.1 metrics indicate network attack vector, no privileges required, no user interaction, with high impact to confidentiality, inte...
CVE-2026-7324
CVE-2026-7324 involves memory safety bugs in Firefox 150.0.0 and Thunderbird 150.0.0. Some bugs show evidence of memory corruption, with the description noting that, with sufficient effort, some could be exploited to run arbitrary code. The vulnerability was fixed in Firefox 150.0.1. The connecte...
CVE-2006-6500
CVE-2006-6500 describes a heap-based buffer overflow in Mozilla-related products. A remote attacker could crash the application or possibly execute arbitrary code by crafting CSS cursor images that trigger an incorrect Windows bitmap size calculation during conversion. Affected software per the d...
CVE-2014-1496
CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...
CVE-2025-4089
CVE-2025-4089 is a vulnerability in Mozilla Firefox and Thunderbird related to insufficient escaping in the copy as cURL feature. The impact is local code execution on the user’s system if an attacker lures the user to run a crafted command. Affected software is Firefox and Thunderbird before 138...
CVE-2026-8949
CVE-2026-8949 concerns an integer overflow in Firefox’s Widget: Win32 component. Affected software is Firefox 151 and Firefox ESR 140.11, which include the fix. The available documents do not specify explicit exploit details, impact scope beyond the overflow and version fixes, or whether active e...
CVE-2026-6768
CVE-2026-6768 is a mitigation bypass in Mozilla’s Networking: Cookies component. Connected advisories confirm the vulnerability affects Mozilla products and is mitigated by upgrades to Firefox 150 and Thunderbird 150. Fedora/NSS/Firefox plugins list this CVE among a batch (CVE-2026-6768 included)...
CVE-2025-6435
CVE-2025-6435 corresponds to a Mozilla Firefox/Thunderbird issue where saving a response from Devtools Network tab via the Save As menu may fail to preserve the .download extension. This could allow a user to inadvertently run a malicious executable. The FreeBSD advisory also notes memory safety ...
CVE-2025-9187
CVE-2025-9187 concerns memory safety bugs in Mozilla Firefox (141) and Mozilla Thunderbird (141) that can lead to memory corruption and potential arbitrary code execution. It affects Firefox < 142 and Thunderbird
CVE-2012-4217
CVE-2012-4217 is a use-after-free in Mozilla Firefox <17.0, Thunderbird <17.0, and SeaMonkey
CVE-2013-0781
CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...
CVE-2025-4085
CVE-2025-4085 affects Mozilla Firefox (earlier than 138.0) and Mozilla Thunderbird (earlier than 138.0). The issue arises when a content process could abuse the privileged UITour actor to leak sensitive information or escalate privileges. The description consistently identifies the root cause as ...
CVE-2026-6779
CVE-2026-6779 refers to an “Other issue in the JavaScript Engine component” that affects Firefox and Thunderbird. The vulnerability was fixed in Firefox 150 and Thunderbird 150; Fedora advisories also call for updates to NSS and Firefox 150 across affected distros. The connected docs do not provi...
CVE-2026-8094
CVE-2026-8094 : A vulnerability in the WebRTC component reported in multiple feeds (CVE-2026-8094) affecting Mozilla Firefox ESR builds and Thunderbird. The available documents identify a WebRTC issue but do not provide detailed root cause, impacted products beyond Firefox ESR and Thunderbird, or...
CVE-2009-3982
The CVE-2009-3982 entry concerns Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird, where exposure is via the JavaScript engine. The connected documents confirm a memory-corruption impact in the JS engine that could allow remote code execution or a crash, caused by unspe...
CVE-2017-7763
CVE-2017-7763 : On macOS OS X, default fonts render some Tibetan characters as whitespace, enabling spoofing when used in an IDN in the address bar. Affected products/versions (per connected docs): Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue is spec...
CVE-2026-12292
CVE-2026-12292 : Incorrect boundary conditions in the Web Audio component are fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. Affected software is Mozilla Firefox/Thunderbird Web Audio implementation; mitigation is upgrade to the stated fixed versions. Other con...
CVE-2026-12296
CVE-2026-12296 describes a sandbox escape in the Security: Process Sandboxing component. Affected products include Mozilla Firefox and Firefox ESR, and Mozilla Thunderbird with fixes implemented in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The description does not ...
CVE-2026-74934
CVE-2026-74934 is a site isolation issue in the Graphics: CanvasWebGL component of Mozilla Firefox and Thunderbird. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw requiring user interaction and high attack complexity, b...
CVE-2017-7755
CVE-2017-7755 affects Mozilla Firefox and Thunderbird installers on Windows. The Firefox installer can be made to load malicious DLLs stored in the same directory as the installer, enabling privilege escalation when the installer runs with elevated privileges. Affected products/versions include F...
CVE-2025-4088
CVE-2025-4088 describes a cross-origin CSRF issue in Thunderbird (and affected Firefox) where malicious sites could exploit Redirects via the Storage Access API to send credentialed requests to arbitrary endpoints. Affected products: Firefox < 138 and Thunderbird
CVE-2025-9184
The CVE-2025-9184 entry concerns memory safety bugs in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141, with evidence of memory corruption that could potentially allow arbitrary code execution. Affected products include Firefox < 142, Firefox ESR < 140.2, Thunderb...
CVE-2025-3032
The CVE-2025-3032 entry describes a vulnerability in Firefox and Thunderbird where file descriptors leak from the fork server to web content processes, enabling privilege escalation. Affected products are Firefox and Thunderbird versions prior to 137. The root cause is the unintended propagation ...
CVE-2025-4090
CVE-2025-4090 affects Thunderbird for Android and Firefox/Thunderbird before version 138 (Thunderbird <138; Firefox
CVE-2025-5272
CVE-2025-5272 arises from memory-safety bugs in Mozilla Firefox 138 and Thunderbird 138, with some bugs showing memory corruption that could potentially allow arbitrary code execution. The affected products are Firefox versions prior to 139 and Thunderbird versions prior to 139. The issue is addr...
CVE-2025-8040
CVE-2025-8040 corresponds to memory-safety bugs in Mozilla Firefox/Thunderbird products (Firefox/Thunderbird 140 line, ESR 140.0 and related versions) with evidence of memory corruption that could potentially lead to arbitrary code execution. Affected components are the Firefox and Thunderbird br...
CVE-2026-12290
A memory-safety vulnerability affecting Mozilla Thunderbird and related Firefox components has been fixed in Thunderbird 152 and Firefox 152 (and ESR branches 140.12 and 115.37). The CVE-2026-12290 entry, and associated related CVEs cited in SUSE/OSV/Debian/Bugzilla/MFSA advisories, indicate a me...
CVE-2026-16350
CVE-2026-16350 affects Mozilla Firefox and Firefox ESR (Audio/Video: cubeb). The issue is caused by incorrect boundary conditions in cubeb, with a remediation by upgrading to Firefox 153, Firefox ESR 115.38, or Firefox ESR 140.13. Public CVSS 3.1 vector indicates NETWORK attack, no user interacti...
CVE-2026-2765
CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...
CVE-2026-6748
CVE-2026-6748 concerns uninitialized memory in Mozilla’s Audio/Video: Web Codecs component. The Initial CVE page notes fixes in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Connected advisories from Debian (DSA-6225/DSA-6229) and DLA-4549/4546/NASL entries confirm mul...
CVE-2026-6758
CVE-2026-6758: Use-after-free in the JavaScript: WebAssembly component. Affected: Firefox and Thunderbird; fixed in Firefox 150 and Thunderbird 150. CVSS v3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No explicit exploit details provided in the connected documents.
CVE-2013-0777
CVE-2013-0777 affects Mozilla Firefox, Thunderbird and SeaMonkey. The related openSUSE security update (openSUSE-SU-2013:0323-1) notes MFSA 2013-28 family fixes for Firefox/Thunderbird/SeaMonkey, including CVE-2013-0777, and lists fixed versions: Firefox 19.0, Thunderbird 17.0.3, SeaMonkey 2.16 (...
CVE-2017-7765
CVE-2017-7765 corresponds to a Mark of the Web bypass on Windows when saving files with very long names, bypassing the security warning before running downloaded executables. Affected products include Firefox < 54, Firefox ESR < 52.2, and Thunderbird
CVE-2026-16361
CVE-2026-16361 affects Firefox ESR 115.37 and 140.12, described as memory safety bugs with evidence of memory corruption. The advisory notes these could have been exploited to run arbitrary code, and fixes are applied in Firefox ESR 115.38 and 140.13. Affected components/roots are not detailed be...
CVE-2026-6761
CVE-2026-6761 — Privilege escalation in the Networking component (Microsoft/ Mozilla naming in documents shows Firefox/Thunderbird exposure). Affected products include Firefox (fixed in Firefox 150 and Firefox ESR 140.10) and Thunderbird (fixed in Thunderbird 150 and Thunderbird 140.10). The CVSS...
CVE-2026-74939
Mozilla Firefox's DOM: Navigation component contains a privilege escalation flaw (CVSS 8.8 HIGH). Exploitation requires a network-based attacker to lure a user into visiting a crafted page. Affected versions must be upgraded to Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, or Firefox ESR 1...
CVE-2012-3983
CVE-2012-3983 affects Mozilla Firefox (pre-16.0), Thunderbird (pre-16.0), and SeaMonkey (pre-2.13). Reported memory safety vulnerabilities could cause memory corruption and crashes and potentially allow arbitrary code execution via unknown vectors. Remediation evidenced in connected documents inc...
CVE-2026-12311
CVE-2026-12311 is a information-disclosure and sandbox-escape issue in Mozilla’s Security: Sandbox/Process Sandboxing affecting Firefox and related components. The initial entry states impact as information disclosure with sandbox escape; connected advisories confirm affected products include Fir...
CVE-2026-16368
CVE-2026-16368: Affects Firefox JavaScript/WebAssembly component due to incorrect boundary conditions. Root cause described as boundary-condition flaw with all three security properties potentially impacted (high confidentiality, integrity, availability). Public fixed versions: Firefox 153 and Fi...
CVE-2026-6765
CVE-2026-6765 affects Firefox and Thunderbird. The vulnerability is an information disclosure in the Form Autofill component. Root cause details are not provided beyond disclosure, but the issue is mitigated by fixes in Firefox 150 , Firefox ESR 140.10 , Thunderbird 150 , and Thunderbird 140.10 ....
CVE-2026-8959
CVE-2026-8959 describes a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. The vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. CVSS 3.1 base metrics indicate a Network attacker, no privileges required, but ...