CVE-2009-1840

CVE-2009-1840 affects Mozilla Firefox (before 3.0.11), Thunderbird and SeaMonkey, where content policy checks were not performed before loading a script file into a XUL document. This allowed a crafted HTML document (e.g., via a web bug in email or a web page/ad) to bypass intended access restric...

CVE-2025-4088

A security vulnerability in Mozilla Firefox and the Thunderbird email client allows malicious websites to use redirects to send credentialed requests to arbitrary endpoints. This occurs on any site that has invoked the Storage Access API , enabling potential Cross-Site Request Forgery (CSRF) atta...

CVE-2026-16388

CVE-2026-16388 identifies a sandbox escape vulnerability in the DOM: Networking component of the Mozilla Thunderbird and Firefox browsers. The vulnerability was addressed in Firefox 153 and Thunderbird 153 . No specific exploit details or information regarding the underlying root cause are provid...

CVE-2026-16400

CVE-2026-16400 describes an information disclosure vulnerability in the DOM: Security component . The vulnerability was addressed in Firefox 153 and Thunderbird 153 . While connected documents confirm the presence of this CVE in the Mozilla Thunderbird 153 release (as part of MFSA 2026-88), no sp...

CVE-2026-2758

CVE-2026-2758 is a memory-safety use-after-free in the Mozilla Firefox JavaScript GC component. Public details show it affects Firefox and Thunderbird families and was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple connected advisorie...

CVE-2026-92059

The DOM: Editor component in Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR is vulnerable to incorrect boundary conditions . This security issue has been addressed in versions Firefox 156 , Firefox ESR 153.3 , Thunderbird 156 , and Thunderbird 153.3 . While the vulnerability is listed ...

CVE-2008-4062

Summary: CVE-2008-4062 covers multiple /unspecified / vulnerabilities in Mozilla Firefox (before 2.0.0.17 and 3.x before 3.0.2), Thunderbird (before 2.0.0.17), and SeaMonkey (before 1.1.12). The flaws involve the JavaScript engine and are triggered by vectors related to (1) misinterpretation of N...

CVE-2012-3963

CVE-2012-3963 is a Use-after-free in Mozilla Firefox's js::gc::MapAllocToTraceKind that can allow remote code execution. Affected: Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, SeaMonkey before 2.12. Mitigation: upgrade to Firefo...

CVE-2012-4183

CVE-2012-4183 is a use-after-free in DOMSVGTests::GetRequiredFeatures affecting Firefox before 16.0, Firefox ESR before 10.0.8, Thunderbird before 16.0, and SeaMonkey before 2.13, with potential for remote code execution or a denial of service via heap memory corruption. Connected advisories from...

CVE-2013-0784

CVE-2013-0784 is one of multiple memory-safety vulnerabilities affecting Mozilla Firefox, Thunderbird, and SeaMonkey. The connected advisories (Ubuntu USN-1729-2 and related GLSA/Nessus entries) document memory corruption risks that could lead to denial of service or potentially arbitrary code ex...

CVE-2025-3032

The Mozilla Firefox browser and Mozilla Thunderbird email client are affected by a vulnerability involving a file descriptor leak from the fork server to web content processes. This flaw could allow an attacker to perform privilege escalation attacks. The issue is present in versions prior to 137...

CVE-2026-12308

A memory safety bug has been identified and fixed in Mozilla Thunderbird 152 and Firefox 152 , along with several Extended Support Release (ESR) versions including Firefox ESR 140.12 and Thunderbird 140.12 . The vulnerability is associated with the Thunderbird client and the Firefox web browser. ...

CVE-2026-12326

The Firefox web browser and Thunderbird email client (versions 151) are affected by memory safety bugs involving operations that go beyond buffer boundaries in memory. These vulnerabilities can result in memory corruption , which could potentially be exploited by a remote attacker to achieve arbi...

CVE-2026-16353

The Firefox browser and Thunderbird mail client are affected by a vulnerability involving an invalid pointer in the DOM: Bindings (WebIDL) component. This flaw could lead to multiple security consequences, including the potential execution of arbitrary code , privilege escalation , information di...

CVE-2026-16407

A mitigation bypass exists in the DOM: Service Workers component of the Mozilla Firefox and Mozilla Thunderbird browsers. This vulnerability was addressed in Firefox 153 and Thunderbird 153 . While technical details are provided in the documentation, specific exploit information is not present.

CVE-2026-16409

CVE-2026-16409 identifies an invalid pointer vulnerability within the Security: PSM component. This flaw affects Mozilla Firefox and Mozilla Thunderbird . The vulnerability has been addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the available documentation.

CVE-2026-6783

CVE-2026-6783 involves an incorrect boundary handling and integer overflow in the Audio/Video Playback component. Affected software is Mozilla Firefox and Thunderbird; the issue is mitigated by upgrading to Firefox 150 and Thunderbird 150, which include the fix. The CVSS-based reports indicate a ...

CVE-2026-74963

A Same-origin policy bypass exists in the Networking: Cookies component of the Mozilla Firefox and Thunderbird applications. This vulnerability affects various versions of Firefox and Thunderbird, including Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 , Thunderbird 154 , Thunderbird 140.1...

CVE-2026-74971

A security vulnerability in the DOM: UI Events & Focus Handling component allows for information disclosure . This issue affects the Mozilla Firefox and Thunderbird applications. The vulnerability has been addressed in the following versions: Firefox 154 , Firefox ESR 140.14 , Firefox ESR 153.1 ,...

CVE-2026-84139

A clickjacking vulnerability exists in the DOM: Events component of the Mozilla Firefox and Thunderbird web browsers. This flaw was addressed in Firefox 155 , Firefox ESR 153.2 , Thunderbird 155 , and Thunderbird 153.2 . No specific exploit details or in-the-wild exploitation instances were provi...

CVE-2008-4068

CVE-2008-4068 is a directory-traversal vulnerability in Mozilla Firefox (pre-2.0.0.17 and 3.x pre-3.0.2), Thunderbird (pre-2.0.0.17), and SeaMonkey (pre-1.1.12) triggered by crafted resource: URIs. The flaw lets remote attackers bypass local HTML restrictions, read sensitive information, and prom...

CVE-2012-4179

CVE-2012-4179 is a use-after-free in Mozilla Firefox's nsHTMLCSSUtils::CreateCSSPropertyTxn that can lead to code execution or heap memory corruption. Affected are Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey befor...

CVE-2026-12309

A memory safety bug has been identified and fixed in Mozilla Firefox and Mozilla Thunderbird . This vulnerability affects Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause is not detailed beyond a memory safety issue, the vulnera...

CVE-2026-16364

CVE-2026-16364 involves incorrect boundary conditions in the Audio/Video: Playback component of the Mozilla software suite. This vulnerability was addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the available documentation.

CVE-2026-16380

A mitigation bypass exists in the Networking component of Firefox and Thunderbird . The vulnerability was addressed in Firefox 153 and Thunderbird 153 . Exploitation details are not provided in the documents.

CVE-2026-74967

A Same-origin policy bypass vulnerability exists in the Audio/Video: Playback component of the Firefox web browser and Thunderbird email client. This flaw allows for the circumvention of origin-based security boundaries during media playback. The vulnerability has been addressed in Firefox 154 , ...

CVE-2026-92045

CVE-2026-92045 involves a sandbox escape vulnerability caused by incorrect boundary conditions in the WebRTC component . This flaw impacts multiple products including Firefox , Firefox ESR , Thunderbird , and Thunderbird ESR . Remediation is available in Firefox 156 , Firefox ESR 153.3 , Thunderb...

CVE-2026-92062

CVE-2026-92062 is a privilege escalation vulnerability affecting the Session Restore component in Mozilla Firefox and Thunderbird . The flaw allows an attacker to gain elevated privileges on a system. Remediation is available in the following versions: Firefox 156 , Firefox ESR 153.3 , Thunderbir...

CVE-2013-0781

CVE-2013-0781 is a use-after-free in Mozilla’s nsPrintEngine::CommonPrint that affects Firefox, Thunderbird, and SeaMonkey versions prior to their listed fixes (Firefox before 19.0, Thunderbird before 17.0.3, SeaMonkey before 2.16). The underlying issue is a heap memory corruption/use-after-free ...

CVE-2026-16361

Mozilla Thunderbird and Firefox ESR are affected by memory safety bugs that can lead to memory corruption . If successfully exploited, these vulnerabilities could allow an attacker to execute arbitrary code . The issues were addressed in Thunderbird 140.13 , Firefox ESR 115.38 , and Firefox ESR 1...

CVE-2026-2766

CVE-2026-2766 is a use-after-free in the JavaScript Engine: JIT component of Firefox/Firefox ESR that was fixed in Firefox 148, ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Affected products in the provided documents include Firefox-based browsers and Thunderbird; multiple advisories (Astra...

CVE-2026-2779

CVE-2026-2779 covers incorrect boundary conditions in Networking: JAR within Firefox (and Firefox ESR). Public advisories indicate the issue affects Firefox before version 148 and Firefox ESR before 140.8, with Firefox 148/ESR 140.8 and Thunderbird updates mitigating it. The connected Amazon Linu...

CVE-2026-92007

The Graphics: CanvasWebGL component in Mozilla Firefox and Thunderbird is vulnerable to privilege escalation due to incorrect boundary conditions. This vulnerability affects various versions of the software, including Firefox 156 , Firefox ESR 115.41 , Firefox ESR 140.16 , Firefox ESR 153.3 , Thu...

CVE-2026-92012

Mozilla Firefox and Thunderbird are affected by CVE-2026-92012, a privilege escalation vulnerability caused by incorrect boundary conditions within the Graphics: CanvasWebGL component. The vulnerability has been addressed in the following versions: Firefox 156, Firefox ESR 115.41, Firefox ESR 140...

CVE-2026-92017

CVE-2026-92017 is a privilege escalation vulnerability affecting the DOM: Service Workers component in Mozilla Firefox and Thunderbird . The issue was addressed in Firefox versions 156 , ESR 115.41 , ESR 140.16 , and ESR 153.3 , along with corresponding Thunderbird versions. No specific root caus...

CVE-2026-92061

The Security: Process Sandboxing component in Firefox and Thunderbird is vulnerable due to incorrect boundary conditions . This flaw can potentially impact security boundaries within the sandboxing environment. The vulnerability was addressed and fixed in Firefox 156 and Thunderbird 156 . While t...

CVE-2006-1531

CVE-2006-1531 concerns an unspecified vulnerability in Firefox and Thunderbird prior to 1.5.0.2 and SeaMonkey prior to 1.0.1 that could allow a remote attacker to cause a denial of service (crash) and possibly execute arbitrary code via unknown DHTML-related attack vectors. Public vendor details ...

CVE-2006-6500

CVE-2006-6500 describes a heap-based buffer overflow in Mozilla-related products. A remote attacker could crash the application or possibly execute arbitrary code by crafting CSS cursor images that trigger an incorrect Windows bitmap size calculation during conversion. Affected software per the d...

CVE-2025-10536

An information disclosure vulnerability exists in the Networking: Cache component of Mozilla products, including Firefox , Firefox ESR , and Thunderbird . The root cause is an error within the cache component that could allow an attacker to obtain sensitive information. This vulnerability affects...

CVE-2025-8044

Mozilla Firefox and Thunderbird (specifically versions 140 and Firefox ESR ) are affected by memory safety bugs. These vulnerabilities stem from memory corruption issues where operations are executed outside of the buffer in memory. A malicious actor could exploit these flaws to cause service int...

CVE-2026-12314

A memory safety bug was identified and fixed in Firefox 152 , Firefox ESR 140.12 , Thunderbird 152 , and Thunderbird 140.12 . While the specific technical root cause for CVE-2026-12314 is not detailed beyond its classification as a memory safety issue, several connected documents indicate that si...

CVE-2026-12317

A memory safety bug exists in the Mozilla Firefox and Thunderbird web browser and email client. The vulnerability is caused by operations performing beyond the buffer boundaries in memory. Successful exploitation by a remote attacker can lead to service interruptions (Denial of Service). This iss...

CVE-2026-16374

CVE-2026-16374 is an information disclosure vulnerability within the Framework component of DevTools . This flaw affects Firefox , Firefox ESR , and Thunderbird . The vulnerability was addressed in Firefox 153 , Firefox ESR 140.13 , and Thunderbird 153/140.13 . No specific details regarding the r...

CVE-2026-16393

CVE-2026-16393 involves incorrect boundary conditions within the Graphics: WebGPU component. This vulnerability affects Mozilla Firefox and Mozilla Thunderbird , specifically impacting the WebGPU graphics functionality. The issue has been remediated in Firefox 153 and Thunderbird 153 . Practical ...

CVE-2026-6782

The Firefox web browser and Thunderbird email client are susceptible to an information disclosure vulnerability in the IP Protection component . This flaw could allow a malicious actor to gain access to confidential data . The issue has been resolved in Firefox 150 and Thunderbird 150 . Exploitat...

CVE-2026-74943

A use-after-free in Firefox/Thunderbird's Graphics: ImageLib component (CVE-2026-74943) carries a CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) enabling remote arbitrary code execution with no user interaction. It is fixed in Firefox 154, Firefox ESR 115.39/140.14/153.1, Thunderbird 154/140.14/15...

CVE-2026-84120

A use-after-free vulnerability exists in the Audio/Video component of Mozilla Firefox and Thunderbird . This flaw could potentially allow for the execution of arbitrary code , sandbox escape , or privilege escalation . The issues have been addressed in Firefox 155 , Firefox ESR 115.40 , Firefox E...

CVE-2026-8956

An integer overflow vulnerability exists in the Networking: JAR component of the Firefox web browser and the Thunderbird email client. Exploiting this numerical overflow condition can allow a remote attacker to cause service interruptions . The vulnerability has been addressed in Firefox 151 , Fi...

CVE-2012-5843

CVE-2012-5843 affects Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14. The vulnerability is described as unspecified memory safety hazards in the browser engine that could lead to memory corruption and a crash (DoS) or, potentially, arbitrary code execution via unk...

CVE-2014-1496

CVE-2014-1496 affects Mozilla Firefox (up to 28.0) and related Mozilla suite components (Firefox ESR 24.x up to 24.4, Thunderbird up to 24.4, SeaMonkey up to 2.25). The vulnerability allows local users to gain privileges by modifying the extracted Mar contents during an update, constituting a loc...