CVE-2012-3968

CVE-2012-3968 is a use-after-free in Firefox’s WebGL implementation related to deletion of a fragment shader by its accessor. The issue allows remote attackers to execute arbitrary code via crafted web content. Affected products include Mozilla Firefox (and Firefox ESR 10.x lineage) prior to patc...

CVE-2012-4204

The CVE-2012-4204 entry describes a memory-corruption/remote-code-execution vulnerability in Mozilla Firefox’s JavaScript engine (str_unescape) affecting Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14, exploitable via unspecified vectors. Connected documents indicate rela...

CVE-2012-5840

CVE-2012-5840 is a Use-after-free vulnerability in Mozilla Firefox’s nsTextEditorState::PrepareEditor, affecting Firefox prior to 17.0, Firefox ESR 10.x prior to 10.0.11, Thunderbird prior to 17.0, Thunderbird ESR 10.x prior to 10.0.11, and SeaMonkey prior to 2.14. The flaw allows remote attacker...

CVE-2018-18513

CVE-2018-18513 is a Firefox/Thunderbird vulnerability where a crash can occur while processing a crafted S/MIME message or an XPI package with a crafted signature, allowing a denial-of-service attack as Thunderbird reopens the last seen message on restart and re-triggers the crash. Affected produ...

CVE-2026-74964

An integer overflow vulnerability exists in the Graphics component of the Mozilla Firefox and Mozilla Thunderbird applications. This flaw was addressed in the release of Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunderbird 153.1 . While spe...

CVE-2026-92038

CVE-2026-92038 describes a mitigation bypass in the Remote Settings Client component of the Mozilla Firefox and Thunderbird browsers. The vulnerability was addressed in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the technical root cause is not detailed in th...

CVE-2006-6503

CVE-2006-6503: Affected Mozilla Firefox 2.x before 2.0.0.1, Mozilla Firefox 1.5.x before 1.5.0.9, Mozilla Thunderbird before 1.5.0.9, and SeaMonkey before 1.0.7. The issue allows bypassing cross-site scripting (XSS) protection by changing the src attribute of an IMG element to a javascript: URI. ...

CVE-2009-3981

CVE-2009-3981 affects Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird. The issue is an unspecified remote vulnerability in the browser engine that can cause memory corruption, leading to a crash or potentially arbitrary code execution via unknown vectors, and can result in ...

CVE-2010-0159

CVE-2010-0159 affects Mozilla-based browsers including Firefox 3.0.x (before 3.0.18) and 3.5.x (before 3.5.8), Thunderbird before 3.0.2, and SeaMonkey before 2.0.3. The vulnerability arises from memory-corruption in layout handling, specifically in nsBlockFrame::StealFrame and related vectors, al...

CVE-2012-4180

CVE-2012-4180 : A heap-based buffer overflow in the nsHTMLEditor::IsPrevCharInNodeWhitespace function in Mozilla Firefox prior to 16.0 (and Firefox ESR 10.x prior to 10.0.8; Thunderbird prior to 16.0; Thunderbird ESR 10.x prior to 10.0.8; SeaMonkey prior to 2.13) could allow remote code execution...

CVE-2026-8954

The Audio/Video component in Firefox and Thunderbird is vulnerable to an integer overflow caused by incorrect boundary conditions . This flaw allows attackers to perform operations beyond the buffer limits in memory, which can lead to the access of confidential data . Affected versions include Fi...

CVE-2017-7757

CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...

CVE-2026-12325

A Denial-of-service vulnerability exists in the Graphics: ImageLib component of Mozilla products, including Firefox and Thunderbird . Attackers can exploit this flaw to cause a denial-of-service attack. This issue has been addressed in Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thund...

CVE-2026-16352

A sandbox escape vulnerability exists in the Disability Access APIs component of the Mozilla Firefox and Thunderbird browsers. This flaw is caused by a use-after-free condition. Impacting multiple components, this issue was addressed in Firefox 153 , Firefox ESR 115.38 , Firefox ESR 140.13 , Thun...

CVE-2026-16354

CVE-2026-16354 is an information disclosure vulnerability within the Graphics: ImageLib component of the Mozilla Firefox and Thunderbird browsers. The flaw was addressed in Firefox versions 153 , ESR 115.38 , and ESR 140.13 , as well as Thunderbird versions 153 and 140.13 . No specific exploit de...

CVE-2026-74974

CVE-2026-74974 describes a Same-origin policy bypass within the Graphics: ImageLib component of Mozilla products. The vulnerability affects Firefox and Thunderbird . This issue has been addressed in several versions, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 15...

CVE-2026-84124

A use-after-free vulnerability exists in the DOM: Core & HTML component of the Mozilla Firefox and Thunderbird software. This flaw could potentially lead to arbitrary code execution , sandbox escape , or privilege escalation . The vulnerability has been addressed in the following versions: Firefo...

CVE-2026-84145

This vulnerability involves internally found bugs in Mozilla Thunderbird and Mozilla Firefox . The defects may lead to memory corruption or other security-relevant issues, which could potentially be exploited with sufficient effort. Affected versions include Thunderbird 154 , Thunderbird ESR 153....

CVE-2026-92035

CVE-2026-92035 is a sandbox escape vulnerability in the Graphics component caused by incorrect boundary conditions. This flaw affects Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Impactful remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbi...

CVE-2008-4058

CVE-2008-4058 affects Mozilla-based products (Firefox, SeaMonkey, Thunderbird) where XPConnect could be abused to pollute XPCNativeWrappers via chrome XBL/chrome JS, enabling remote arbitrary-code execution with chrome privileges. Publicly documented affected ranges include Firefox before 2.0.0.1...

CVE-2012-4216

CVE-2012-4216 is a use-after-free in gfxFont::GetFontEntry affecting Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14. Exploitation could lead to remote code execution or a denial of service via h...

CVE-2025-4084

The "Copy as cURL" feature in Mozilla Firefox ESR (on Windows) and Mozilla Thunderbird is vulnerable to local code execution due to insufficient escaping of special characters . An attacker could trick a user into executing a malicious command on their system. This issue specifically affects Fire...

CVE-2026-6748

Mozilla Firefox , Firefox ESR , and the Thunderbird email client are vulnerable to a flaw in the Audio/Video: Web Codecs component due to uninitialized memory . In certain instances, this vulnerability can be exploited by a remote attacker to execute arbitrary code . The issue has been addressed ...

CVE-2026-6750

A privilege escalation vulnerability exists in the Graphics: WebRender component of Mozilla Firefox and the Thunderbird email client. The root cause is attributed to deficiencies in access control , which could allow an attacker to enhance their privileges remotely. This vulnerability has been ad...

CVE-2026-6758

The Firefox web browser and Thunderbird email client are affected by a use-after-free vulnerability in the JavaScript: WebAssembly component . This flaw occurs when the software attempts to use memory after it has been freed, which could allow a remote attacker to trigger a service failure . The ...

CVE-2026-74948

A vulnerability in the Graphics component of Mozilla Firefox and Thunderbird leads to information disclosure . This issue has been addressed in several releases, including Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.14 , and Thunde...

CVE-2008-4067

CVE-2008-4067 describes a directory traversal vulnerability in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12) on Linux. An attacker could read arbitrary files via a resource: URI containing .. and URL-encoded / sequences. The c...

CVE-2026-12327

Memory safety bugs exist in Firefox ESR 140.11 , Thunderbird ESR 140.11 , Firefox 151 , and Thunderbird 151 . These vulnerabilities involved memory corruption , which could potentially be exploited with sufficient effort to execute arbitrary code . The issues have been addressed in the following ...

CVE-2026-16379

CVE-2026-16379 involves a privilege escalation vulnerability within the DOM: Content Processes component of the Mozilla Firefox browser and Thunderbird mail client. The issue allows for elevated privileges and was addressed in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 1...

CVE-2026-74969

A use-after-free vulnerability exists in the Layout: Text and Fonts component of the Mozilla Firefox and Thunderbird web browser and mail client. This flaw was addressed in the release of Firefox 154 , Firefox ESR 115.39 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140...

CVE-2012-4193

CVE-2012-4193 affects Mozilla Firefox and related Mozilla products (Firefox before 16.0.1, Firefox ESR before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR before 10.0.9, SeaMonkey before 2.13.1). Root cause: a security check in the defaultValue unwrapping of security wrappers is omitted, al...

CVE-2012-4215

CVE-2012-4215 is a use-after-free in Mozilla Firefox’s nsPlaintextEditor::FireClipboardEvent that could allow remote code execution or a heap memory corruption, affecting Firefox before 17.0, Firefox ESR before 10.0.11, Thunderbird before 17.0, Thunderbird ESR before 10.0.11, and SeaMonkey before...

CVE-2012-5835

CVE-2012-5835 describes an integer overflow in the WebGL subsystem of Mozilla Firefox prior to 17.0 (also affecting Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0 and Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14). The overflow can lead to remote code execution or a den...

CVE-2012-5838

CVE-2012-5838 affects the WebGL copyTexImage2D in Mozilla Firefox (<17.0), Thunderbird (<17.0), and SeaMonkey (

CVE-2012-5839

CVE-2012-5839 is a heap-based buffer overflow in Mozilla's gfxShapedWord::CompressedGlyph::IsClusterStart that affects Firefox and related Mozilla components. Affected software includes Mozilla Firefox before 17.0 (and ESR 10.x before 10.0.11), Thunderbird before 17.0 (and ESR 10.x before 10.0.11...

CVE-2025-5262

A double-free vulnerability exists in the libvpx encoder within the vpx_codec_enc_init_multi function. The issue occurs after a failed allocation when initializing the encoder for WebRTC , potentially leading to memory corruption and an exploitable crash. This vulnerability affects Thunderbird ve...

CVE-2026-12310

A memory safety bug exists in Firefox and Thunderbird , specifically affecting Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . The vulnerability has been addressed in the specified versions. While the specific root cause component is not detailed in the primary descr...

CVE-2026-16385

The Graphics: WebGPU component in Mozilla Firefox and Thunderbird is vulnerable to an information disclosure due to uninitialized memory . This vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or practical exploitation instructions are provided in the d...

CVE-2026-16403

A spoofing issue exists in the Address Bar component of the Firefox and Thunderbird web browsers. This vulnerability has been addressed and fixed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the documentation.

CVE-2026-6761

A privilege escalation vulnerability exists in the Networking component of Mozilla Firefox , Firefox ESR , and the Thunderbird email client. The flaw is caused by deficiencies in access control , which could allow a malicious actor to remotely enhance their privileges. The issue has been addresse...

CVE-2026-74945

CVE-2026-74945 identifies an information disclosure vulnerability within the Graphics: Text component of Firefox and Thunderbird . The root cause involves an uninitialized heap disclosure that can be triggered via a crafted web font. Specifically, a malicious @font-face font can walk the OTS outp...

CVE-2026-74966

A vulnerability exists in the Form Autofill component, leading to an information disclosure . The issue has been resolved in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . Exploitation details are not provided in the available documents.

CVE-2026-74977

An integer overflow vulnerability exists in the Graphics component of Firefox and Thunderbird . This issue was addressed in Firefox 154 , Firefox ESR 153.1 , Thunderbird 154 , and Thunderbird 153.1 . While the documents provide high-level details regarding the overflow and the affected software v...

CVE-2026-84131

Mozilla Firefox and Thunderbird are affected by a privilege escalation vulnerability caused by an invalid pointer within the Graphics component . This security issue could potentially allow for the execution of arbitrary code or other unauthorized actions. Remediation is available in the followin...

CVE-2012-5833

CVE-2012-5833 concerns WebGL texImage2D handling in Mozilla Firefox (and related Gecko-based products) that interacts with Mesa drivers. The vulnerability can allow remote code execution or a denial of service (memory corruption) via certain level parameter values. Affected versions include Firef...

CVE-2025-3031

The Mozilla Firefox browser and Mozilla Thunderbird email client are vulnerable to an information disclosure flaw. An attacker could read 32 bits of values spilled onto the stack within a JIT compiled function . This vulnerability could allow a malicious actor to compromise the confidentiality an...

CVE-2025-6435

Mozilla Firefox and Thunderbird versions prior to 140 are affected by a vulnerability where saving a response from the Network tab in Devtools via the Save As context menu may fail to append the .download file extension. This lack of extension sanitization could lead to a user inadvertently runni...

CVE-2025-8040

Mozilla Firefox and Thunderbird are affected by memory safety bugs involving memory corruption. The vulnerability arises from the execution of operations outside of the buffer in memory , which could allow a remote attacker to cause a service failure or potentially execute arbitrary code with suf...

CVE-2026-12297

Mozilla products Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by incorrect boundary conditions in the Networking component . This security flaw was addressed in the release of Firefox 152 , Firefox ESR 140.12 , Firefox ESR 115.37 , Thunderbird 152 , and Thunderbir...

CVE-2026-6765

The Form Autofill component in Mozilla Firefox and the Thunderbird email client is vulnerable to an information disclosure flaw. This vulnerability stems from deficiencies in access control for personal information, which could allow a malicious actor to gain unauthorized access to protected data...