CVE-2026-74954

A side-channel vulnerability exists in the Storage: Cache API component of Firefox and Thunderbird . This flaw allows for information disclosure . The issue is addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific exploit details or in-the-wild explo...

CVE-2026-84123

CVE-2026-84123 identifies a privilege escalation vulnerability caused by a use-after-free flaw in the Graphics: WebGPU component. This issue affects Mozilla Firefox , Mozilla Thunderbird , and associated packages. Remediation is available in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and...

CVE-2006-6501

CVE-2006-6501 affects Mozilla Firefox 2.x before 2.0.0.1, Firefox 1.5.x before 1.5.0.9, SeaMonkey before 1.0.7, and Thunderbird/SeaMonkey-family components as noted in connected advisories. The issue is a privilege-escalation via the watch Javascript function that could allow remote code executio...

CVE-2013-0759

CVE-2013-0759 affects Mozilla Firefox (and related Mozilla components) prior to version 18.0, Firefox ESR prior to 10.0.12 and 17.0.2, Thunderbird prior to 17.0.2 and ESR prior to 10.0.12/17.0.2, and SeaMonkey prior to 2.15. The vulnerability allows remote attackers to spoof the address bar by ex...

CVE-2013-0769

CVE-2013-0769 refers to multiple unspecified vulnerabilities in the Mozilla browser engine that could cause memory corruption and application crashes, potentially enabling remote code execution. Affected products and versions cited in connected docs include Mozilla Firefox before 18.0, Firefox ES...

CVE-2025-8031

The Mozilla Firefox , Firefox ESR , and Thunderbird email clients are vulnerable to a security flaw where the username:password portion of URLs was not correctly stripped from CSP reports . This oversight could potentially lead to the leakage of HTTP Basic Authentication credentials. The issue ha...

CVE-2025-9181

Mozilla Firefox and Thunderbird are affected by a vulnerability involving uninitialized memory in the JavaScript Engine component. Specifically, the issue relates to access to an uninitialized pointer , which could allow a malicious actor to compromise the confidentiality, integrity, and accessib...

CVE-2026-74947

A privilege escalation vulnerability exists in the Graphics component of Mozilla Firefox and Mozilla Thunderbird due to an invalid pointer . This flaw affects various versions, including Firefox prior to 154 and Thunderbird prior to 153.1. The issue has been remediated in Firefox 154, Firefox ESR...

CVE-2026-74962

A site isolation issue exists in the Networking: Cookies component of the Mozilla Firefox and Mozilla Thunderbird browsers. This vulnerability affects various versions, including Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The is...

CVE-2026-74985

CVE-2026-74985 describes a privilege escalation vulnerability in the Enterprise Policies component of Mozilla products. The issue affects Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Remediation is available in the aforementioned versions. Exploitation details are n...

CVE-2026-84144

This vulnerability involves internally found bugs in Mozilla Thunderbird 154 and Thunderbird ESR 153.1 . The issues showed evidence of memory corruption or other security-relevant defects, which could potentially be exploited with sufficient effort. The flaws have been addressed in the release of...

CVE-2012-1974

CVE-2012-1974 is a use-after-free vulnerability in gfxTextRun::CanBreakLineBefore affecting Mozilla Firefox (and related apps like Thunderbird/SeaMonkey) prior to version 15.0, with remote code execution or a denial of service via unspecified vectors. The connected Nessus entries confirm the CVE ...

CVE-2012-3957

Affected components: Mozilla Firefox before 15.0 (and Firefox ESR 10.x before 10.0.7), Thunderbird before 15.0 (and Thunderbird ESR 10.x before 10.0.7), SeaMonkey before 2.12.** Vulnerability and root cause: Heap-based buffer overflow in nsBlockFrame::MarkLineDirty, enabling remote code execution...

CVE-2012-4208

CVE-2012-4208 affects Mozilla Firefox ≤ prior to 17.0, Thunderbird ≤ prior to 17.0, and SeaMonkey ≤ 2.13/2.14. The XrayWrapper did not consider compartment during property filtering, allowing remote sites to bypass chrome-only restrictions on reading DOM object properties. Impact per description:...

CVE-2013-0779

CVE-2013-0779 affects Mozilla Firefox (before 19.0), Thunderbird (before 17.0.3), and SeaMonkey (before 2.16). The issue is in nsCodingStateMachine::NextState, allowing remote attackers to execute arbitrary code or cause a denial of service via an out-of-bounds read. The connected OpenVAS/Nessus ...

CVE-2013-0763

CVE-2013-0763 is a use-after-free vulnerability in Mozilla Firefox (pre-18.0) and Firefox ESR 17.x (pre-17.0.1), Thunderbird (pre-17.0.2/ESR 17.x pre-17.0.1), and SeaMonkey (pre-2.15). It is triggered via Mesa driver interactions and a resized WebGL canvas, potentially allowing remote attackers t...

CVE-2017-7847

Mozilla Thunderbird prior to 52.5.2 is affected by CVE-2017-7847 through crafted CSS in an RSS feed that can leak local path strings (potentially including user names). The underlying issue is leakage via RSS processing of CSS. Impact is information disclosure; exploitation details are not provid...

CVE-2025-9182

The Graphics: WebRender component in Mozilla Firefox , Firefox ESR , and Thunderbird is vulnerable to a denial-of-service (DoS) attack. The root cause is an out-of-memory condition, which may be triggered by improper resource cleanup or release. This vulnerability allows an attacker to cause remo...

CVE-2026-6760

The Firefox web browser and Thunderbird email client are affected by a mitigation bypass vulnerability in the Networking: Cookies component. The root cause is related to the software's reliance on cookies without sufficient checks for their authenticity and integrity . Exploitation of this flaw c...

CVE-2026-6768

The Mozilla Firefox web browser and Mozilla Thunderbird email client are affected by a vulnerability in the Networking: Cookies component. This flaw allows for a mitigation bypass , where an attacker can bypass authentication by utilizing an alternative path or channel. Exploitation of this vulne...

CVE-2026-74959

A mitigation bypass vulnerability exists in the Storage: Cache API component of Mozilla Firefox and Mozilla Thunderbird . The flaw allows attackers to bypass established security mitigations. The issue has been resolved in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , T...

CVE-2026-74965

A privilege escalation vulnerability exists in the Shell Integration component of the Mozilla Firefox and Mozilla Thunderbird browsers. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and...

CVE-2026-84138

A Denial-of-Service (DoS) vulnerability exists in the PDF Viewer component of Firefox and Thunderbird . The vulnerability has been addressed in Firefox 155 and Thunderbird 155 . While specific root cause details are not provided in the documents, the impact is a high availability loss as indicate...

CVE-2024-11159

CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...

CVE-2025-8039

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are affected by an information disclosure vulnerability where search terms persist in the URL bar even after navigating away from the search page. This exposure can allow an attacker to compromise the confidentiality and integrity o...

CVE-2026-0818

Mozilla Thunderbird versions prior to 147.0.1 and 140.7.1 are vulnerable to a CSS-based exfiltration of content from partially encrypted emails. When a user requests to decrypt an inline OpenPGP message embedded within an HTML-formatted email, the decrypted content is rendered while the outer mes...

CVE-2026-16372

CVE-2026-16372 involves a privilege escalation vulnerability within the DOM: Content Processes component of the browser engine. This security issue affects products including Firefox and Thunderbird . The vulnerability was addressed and fixed in Firefox 153 and Thunderbird 153 . Specific details ...

CVE-2026-16392

A JIT miscompilation vulnerability exists in the JavaScript Engine: JIT component of Mozilla Firefox and Mozilla Thunderbird . This flaw was addressed in Firefox 153 and Thunderbird 153 . While specific technical root causes or exploit details are not provided in the documentation, the issue is c...

CVE-2026-84143

CVE-2026-84143 covers internally found bugs in Thunderbird 154 , Thunderbird ESR 153.1 , and Thunderbird ESR 140.14 , some showing evidence of memory corruption or other security-relevant defects. Mozilla presumes some could have been exploited with enough effort, but no confirmed in-the-wild exp...

CVE-2026-92036

The Networking: HTTP component in Mozilla Firefox and Thunderbird is vulnerable to incorrect boundary conditions . This security flaw has been addressed in Firefox 156 and Thunderbird 156 . While the vulnerability has been reported in the wild as of September 17, 2026, specific exploitation detai...

CVE-2018-18512

CVE-2018-18512 is a use-after-free vulnerability in Thunderbird triggered while playing a sound notification. The memory holding the sound data is freed while playback continues asynchronously, enabling potential crashes. Affected products: Thunderbird versions prior to 60.5. Root cause: use-afte...

CVE-2025-1942

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability in the String.toUpperCase() function. When this function results in a longer string, it can incorporate uninitialized memory into the output. This flaw originates from access to an uninitialized point...

CVE-2025-8036

Mozilla products, specifically Firefox , Firefox ESR , and Thunderbird , are vulnerable to a flaw where Thunderbird caches CORS preflight responses across IP address changes. This behavior enables attackers to circumvent Cross-Origin Resource Sharing (CORS) policies using DNS rebinding attacks. A...

CVE-2026-12298

A memory safety bug was identified and fixed in Mozilla Firefox and Mozilla Thunderbird . The vulnerability impacts Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the root cause is described as a memory safety issue, specific details regarding the underlying m...

CVE-2026-16410

CVE-2026-16410 identifies a JIT miscompilation vulnerability within the JIT component of the JavaScript Engine . This flaw affects Firefox and Thunderbird , with remediation available in version 153 for both products. Technical details regarding the root cause, specific exploit vectors, or practi...

CVE-2026-2765

CVE-2026-2765 is a memory-safety issue described in the connected Astra/Amazon advisories as a use-after-free in the JavaScript Engine component. Affected products include Firefox (and ESR) and Thunderbird, with fixed versions noted as Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderb...

CVE-2026-74960

A site isolation issue exists in the WebExtensions component of the Mozilla Firefox and Thunderbird browsers. This vulnerability has been addressed in Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . No specific details regardin...

CVE-2026-74983

A mitigation bypass exists in the Data Loss Prevention component of Mozilla Firefox and Thunderbird . This vulnerability is present in versions prior to Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . The impact is characterize...

CVE-2026-84134

This vulnerability affects the Profile Backup component in Mozilla Firefox and Mozilla Thunderbird . The root cause is described as an other issue within that specific component. Impact details are not explicitly provided in the documents, but the severity is rated as CRITICAL (CVSS 3.1 score of ...

CVE-2026-84137

CVE-2026-84137 involves a spoofing issue within the DOM: Core & HTML component . This vulnerability affects Mozilla Firefox and Mozilla Thunderbird . The issue has been addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or remote e...

CVE-2026-8959

Mozilla products, including Firefox , Firefox ESR , and Thunderbird , are vulnerable to a sandbox escape caused by incorrect boundary conditions in the Widget: Win32 component. This input validation error allows for potential sandbox escapes in affected versions. The vulnerability has been addres...

CVE-2025-8038

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a data forgery issue where Thunderbird ignores paths during frame navigation validity checks. Specifically, the CSP frame-src was not correctly enforced for paths. This vulnerability stems from insufficient verific...

CVE-2026-12299

CVE-2026-12299 involves a JIT miscompilation vulnerability within the DOM: Core & HTML component . This issue impacts the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbird...

CVE-2026-12312

A memory safety bug has been identified in Firefox and Thunderbird . The vulnerability is present in several versions, including Firefox 152 , Firefox ESR 140.12 , and Thunderbird 152 and Thunderbird 140.12 . This bug has been addressed in the aforementioned versions. No specific root cause detai...

CVE-2026-6779

The JavaScript Engine component in Mozilla Firefox and the Thunderbird email client is vulnerable to an issue caused by insufficient validation of input data . This security flaw could allow an attacker to compromise the confidentiality of protected information . The vulnerability has been addres...

CVE-2026-74958

CVE-2026-74958 is an information disclosure vulnerability affecting the WebRTC component in Mozilla products. The vulnerability has been addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . No specific technical root cause or exploit details are provided in the...

CVE-2026-92048

A sandbox escape vulnerability exists in the Widget: Win32 component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions. This issue affects multiple versions of the browser and its email client. Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , a...

CVE-2017-7845

CVE-2017-7845 is a concrete vulnerability: a buffer overflow in ANGLE’s Direct3D 9 path used for WebGL rendering can crash the process. It affects Windows, and is listed against Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox

CVE-2026-84141

CVE-2026-84141 is an integer overflow in the Graphics: ImageLib component of Mozilla's image processing library, enabling remote code execution via crafted image content. The vulnerability affects Firefox (before 155), Firefox ESR (before 153.2), Thunderbird (before 155), and Thunderbird ESR (bef...

CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...