CVE-2024-2607

CVE-2024-2607 is a concrete issue affecting Mozilla Firefox/Thunderbird components on Armv7-A: return registers may be overwritten during JIT/return handling , potentially enabling arbitrary code execution. The CVE is referenced in multiple advisories (Debian, AlmaLinux, CentOS) with explicit fix...

CVE-2024-5700

CVE-2024-5700 is a memory-safety issue affecting Firefox 126, ESR 115.11, and Thunderbird 115.11 (Firefox <127, ESR <115.12, Thunderbird

CVE-2025-0242

The connected documents confirm CVE-2025-0242 involves memory safety bugs in Firefox and Thunderbird (including ESR branches) with evidence of memory corruption and potential arbitrary code execution given sufficient effort. Affected products and versions stated: Firefox < 134, Firefox ESR &lt...

CVE-2024-11694

The CVE-2024-11694 issue is a CSP frame-src bypass and DOM-based XSS stemming from Enhanced Tracking Protection in Mozilla products via the Web Compatibility extension’s Google SafeFrame shim. Affected: Firefox versions <133, Firefox ESR <128.5, Firefox ESR <115.18, Thunderbird <133, ...

CVE-2019-11744

CVE-2019-11744 concerns an XSS in HTML elements such as and where literal angle brackets can be left unescaped, allowing a crafted closing tag to be injected via innerHTML and make subsequent content appear outside the tag. Affected products include Firefox (versions before 69), Thunderbird (be...

CVE-2020-12397

CVE-2020-12397 affects Mozilla Thunderbird. By encoding Unicode whitespace characters within the From header, an attacker could spoof the sender email address displayed by Thunderbird. It impacts Thunderbird versions older than 68.8.0. The connected sources confirm this as part of a set of relate...

CVE-2024-10464

CVE-2024-10464 refers to a vulnerability where repeated writes to history interface attributes could be exploited to cause a Denial of Service in the browser. Publicly documented impact shows affected products include Firefox below 132, Firefox ESR below 128.4, Thunderbird below 128.4, and Thunde...

CVE-2024-6602

CVE-2024-6602 is a memory corruption vulnerability caused by a mismatch between the allocator and deallocator in NSS. It affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird

CVE-2019-9820

The CVE-2019-9820 issue is a use-after-free in the ChromeEventHandler by DocShell that can cause a crash in Thunderbird and Firefox (including ESR). Affected products and versions, per sources: Thunderbird < 60.7, Firefox < 67, and Firefox ESR

CVE-2020-15669

CVE-2020-15669 details (concrete): A use-after-free bug occurs when aborting an operation (e.g., fetch) where an abort signal is deleted while alerting observers, potentially allowing arbitrary code execution. Affected products include Firefox ESR versions earlier than 68.12 and Thunderbird versi...

CVE-2019-11713

CVE-2019-11713 is a use-after-free in HTTP/2 when a cached stream is closed while still in use, leading to a potentially exploitable crash. Affected products include Firefox ESR < 60.8, Firefox < 68, and Thunderbird

CVE-2020-6798

CVE-2020-6798 involves incorrect parsing when a template tag is used inside a select tag, enabling JavaScript injection under browser-like contexts. The vulnerability affects Thunderbird versions prior to 68.5 (and Firefox before 73 / ESR 68.5); exploitation is discussed in the context of cross-s...

CVE-2021-23969

The CVE-2021-23969 entry concerns a Content Security Policy (CSP) violation report handling issue in Firefox and related Mozilla products. Affected components: Firefox (and Thunderbird) CSP violation reporting when redirects occur. Root cause: during certain redirects, the reporter could set the ...

CVE-2024-7519

CVE-2024-7519 describes memory corruption due to insufficient checks when processing graphics shared memory, enabling sandbox escape. Affected products include Firefox <129, Firefox ESR <115.14, Firefox ESR <128.1, Thunderbird <128.1, and Thunderbird

CVE-2024-4770

CVE-2024-4770 is a memory-safety use-after-free issue in PDF rendering when saving a page to PDF, reported for Firefox <126, Firefox ESR <115.11, and Thunderbird

CVE-2024-5688

CVE-2024-5688 is a use-after-free in object transplant triggered by garbage collection timing, affecting Firefox versions before 127 and Firefox ESR before 115.12, and Thunderbird before 115.12. Root cause: memory safety issue during object transplant that can lead to heap corruption if GC runs a...

CVE-2024-9393

Summary: CVE-2024-9393 describes a cross-origin JavaScript execution in PDFs via a crafted multipart response, allowing access to cross-origin content under the resource://pdf.js origin. Affected software (from provided docs): Mozilla Firefox and Thunderbird (including ESR branches). Desktop Site...

CVE-2024-2605

CVE-2024-2605 affects Firefox and related Mozilla products on Windows, where the Windows Error Reporter can be abused as a sandbox escape to run arbitrary code. The description states affected versions: Firefox < 124, Firefox ESR < 115.9, and Thunderbird

CVE-2019-11691

CVE-2019-11691 is a use-after-free vulnerability in XMLHttpRequest (XHR) triggered by an event loop, causing the XHR main thread to be invoked after the object is freed. Affects Thunderbird versions < 60.7 and Firefox/Firefox ESR versions

CVE-2024-6600

CVE-2024-6600 describes a memory-out-of-bounds in Angle’s GLSL shader allocation on macOS when allocating more than 8192 ints in private shader memory, leading to potential memory corruption. Affected products per sources include Mozilla Firefox and Thunderbird (and ESR branches) with versions pr...

CVE-2019-11752

CVE-2019-11752 is a use-after-free in IndexedDB: deleting a key value during conversion may allow a crash and potential exploitation. Affected products include Firefox versions before 69 and Thunderbird versions before 68.1/60.9 (and corresponding ESR lines). Several connected advisories note fix...

CVE-2023-25735

CVE-2023-25735 describes a use-after-free caused by cross-compartment wrappers wrapping a scripted proxy, which could cause objects from other compartments to be stored in the main compartment during unwrapping. Affected products include Firefox <110, Thunderbird <102.8, and Firefox ESR

CVE-2024-6615

CVE-2024-6615 relates to memory safety bugs in Mozilla Firefox and Thunderbird, with issues present in Firefox 127 and Thunderbird 127 that could lead to memory corruption and arbitrary code execution. Connected advisories (MFSA2024-32, MFSA2024-29) confirm multiple memory-safety and related issu...

CVE-2020-6821

CVE-2020-6821: WebGL copyTexSubImage reads outside the source resource; memory that should be zero is uninitialized, enabling potential data disclosure. Affected products include Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox

CVE-2021-29946

CVE-2021-29946 affects Firefox/Thunderbird components where ports written as an integer overflow beyond 16-bit bounds could bypass port blocking when used in the Alt-Svc header. Connected advisories show the issue is labeled as port blocking bypass (access restriction bypass) with remediation via...

CVE-2016-9905

CVE-2016-9905 is tied to a crash in EnumerateSubDocuments when adding or removing sub-documents, affecting Thunderbird and Firefox ESR prior to 45.6. The connected sources consistently identify a crash/memory safety context (e.g., use-after-free and memory corruption patterns across related CVEs)...

CVE-2024-6606

CVE-2024-6606 : The issue is an out-of-bounds read in the clipboard component caused by clipboard code failing to check the index on an array access. Affected products are Mozilla Firefox and Mozilla Thunderbird, with exploitable impact on versions earlier than 128. The vulnerability is described...

CVE-2024-2612

CVE-2024-2612 affects Firefox <124, Firefox ESR <115.9, and Thunderbird

CVE-2024-9392

CVE-2024-9392 impacts Firefox and Thunderbird before version 131 (and ESR before 128.3/115.16) where a compromised content process could bypass site isolation and load cross-origin content. This could enable cross-origin access to PDF/JSON via multipart responses and, in some cases, broader arbit...

CVE-2024-11691

CVE-2024-11691: A memory corruption/out-of-bounds write flaw in Apple GPU drivers via WebGL on Apple Silicon M-series. Affected products include Firefox and Thunderbird releases listed in MFSA advisories: Firefox <133 and ESR <128.5; Thunderbird <133 and ESR

CVE-2024-10458

CVE-2024-10458 describes a permission leak from a trusted site to an untrusted site via embed/object in Firefox and Thunderbird. Affected products and ranges shown in the connected documents include Firefox and Thunderbird before 132 (and ESR before 128.4/115.17 for Firefox, and Thunderbird befor...

CVE-2021-23999

CVE-2021-23999 describes a sandbox/privilege issue where a Blob URL loaded via an unusual user interaction could be executed with System Principal privileges, affecting Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox

CVE-2021-38503

The CVE-2021-38503 issue: the iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. Affected products include Firefox (versions before 94), Thunderbird (before 91.3), and Firefox ...

CVE-2024-6601

CVE-2024-6601 describes a race condition in Mozilla products where a cross-origin container could gain permissions of the top-level origin. Affected are Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird

CVE-2019-9816

Summary: CVE-2019-9816 is a type confusion vulnerability involving manipulation of JavaScript objects in object groups, affecting Mozilla products (Thunderbird and Firefox/Firefox ESR) and specifically related to UnboxedObjects, which are disabled by default on all supported releases. The issue i...

CVE-2024-5696

The CVE-2024-5696 entry concerns memory corruption caused by manipulating text in an tag, affecting Firefox < 127, Firefox ESR < 115.12, and Thunderbird

CVE-2020-26965

CVE-2020-26965 is a browser/password-input issue affecting Firefox (including ESR) versions older than 83/78.5 and Thunderbird older than 78.5. The problem arises when a user’s password is revealed via a “Show Password” control, and, in conjunction with a software keyboard that remembers input, t...

CVE-2021-23998

CVE-2021-23998 describes a content spoofing vulnerability in Firefox/Thunderbird: through complex navigation involving new windows, an HTTP page could inherit the lock icon from an HTTPS page. Affected products are Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox

CVE-2021-23973

CVE-2021-23973 describes a cross-origin loading issue in audio/video contexts where a decoding error could leak information about the resource. Affected software: Firefox versions older than 86, Thunderbird older than 78.8, and Firefox ESR older than 78.8. Public-facing details confirm this vulne...

CVE-2024-7528

CVE-2024-7528 describes a use-after-free in IndexedDB caused by incorrect garbage collection interaction, affecting Mozilla Firefox before 129, Firefox ESR before 128.1, and Thunderbird before 128.1. Connected advisories indicate remediation by upgrading to the latest Firefox/Thunderbird versions...

CVE-2021-23953

CVE-2021-23953 concerns an information-disclosure vulnerability in the PDF handling of Mozilla Firefox (before 85.0) and Thunderbird (before 78.7), plus Firefox ESR before 78.7. The issue arises when a user opens a specially crafted PDF, which could leak cross-origin data served as chunked data. ...

CVE-2021-23982

CVE-2021-23982 is a concrete WebRTC-based information-disclosure vulnerability affecting Mozilla products. The connected documents confirm that a malicious webpage could probe an internal network’s hosts and services running on the user’s machine via WebRTC. Affected products/versions: Firefox ES...

CVE-2021-29985

CVE-2021-29985 is a use-after-free in media channels causing memory corruption, affecting Thunderbird (versions < 78.13 and < 91), Firefox ESR (<78.13) and Firefox (

CVE-2024-5690

Vulnerability CVE-2024-5690 affects Mozilla Firefox and Thunderbird components via a timing-attack on external protocol handler detection. Affected products explicitly include Firefox < 127, Firefox ESR < 115.12, and Thunderbird

CVE-2025-0247

CVE-2025-0247 concerns memory safety bugs in Mozilla Firefox 133 and Thunderbird 133, with impact on Firefox < 134 and Thunderbird

CVE-2024-10459

CVE-2024-10459 is a use-after-free vulnerability triggered when accessibility features are enabled, potentially causing a crash. The issue affects Firefox versions earlier than 132, Firefox ESR prior to 128.4 and 115.17, and Thunderbird versions earlier than 132 or 128.4, as noted across multiple...

CVE-2019-11692

CVE-2019-11692 is a use-after-free in the event listener manager that can occur when listeners are removed while still in use, causing a crash in Thunderbird <=60.6.x/60.7.0, Firefox <=66-67 (and ESR

CVE-2024-5691

The CVE-2024-5691 entry describes a vulnerability where an attacker could trick a sandboxed iframe using an X-Frame-Options header to present a button that, if clicked, bypasses sandbox restrictions and opens a new window. Affected products (per the provided documents) include Mozilla Firefox and...

CVE-2019-11698

CVE-2019-11698 concerns theft of browser history via drag-and-drop of crafted hyperlinks to bookmarks that are dragged into web content. Public documents confirm affected products and versions: Thunderbird < 60.7, Firefox < 67, and Firefox ESR

CVE-2019-9788

CVE-2019-9788 affects Mozilla Thunderbird and Firefox components via memory-safety bugs that could allow arbitrary code execution. The provided documents identify memory-corruption opportunities in Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox