CVE-2024-6611

A nested iframe that triggers a cross-site navigation can cause SameSite=Strict or Lax cookies to be sent, potentially impacting security boundaries. This vulnerability affects Firefox versions prior to 128 and Thunderbird versions prior to 128 . No information regarding a specific remediation or...

CVE-2021-29985

CVE-2021-29985 is a use-after-free in media channels causing memory corruption, affecting Thunderbird (versions < 78.13 and < 91), Firefox ESR (<78.13) and Firefox (

CVE-2024-4768

A bug in the interaction between popup notifications and WebAuthn allows attackers to trick users into granting permissions. This vulnerability impacts Firefox < 126 , Firefox ESR < 115.11 , and Thunderbird

CVE-2024-5692

Mozilla Firefox (versions < 127), Firefox ESR (versions < 115.12), and Thunderbird (versions

CVE-2024-6607

This vulnerability affects Firefox < 128 and Thunderbird < 128 . It allows an attacker to prevent a user from exiting pointerlock by pressing the escape key and to overlay customValidity notifications from a element over certain permission prompts. This could be used to confuse users into ...

CVE-2024-6614

This vulnerability affects Firefox < 128 and Thunderbird

CVE-2024-9401

Memory safety bugs in Firefox and Thunderbird may lead to memory corruption . With sufficient effort, these flaws could be exploited to achieve arbitrary code execution . The vulnerability affects Firefox < 131 , Firefox ESR < 128.3 , Firefox ESR < 115.16 , Thunderbird < 128.3 , and T...

CVE-2021-23953

CVE-2021-23953 concerns an information-disclosure vulnerability in the PDF handling of Mozilla Firefox (before 85.0) and Thunderbird (before 78.7), plus Firefox ESR before 78.7. The issue arises when a user opens a specially crafted PDF, which could leak cross-origin data served as chunked data. ...

CVE-2025-0240

A compartment mismatch occurs when parsing a JavaScript module as JSON , potentially leading to cross-compartment access and a use-after-free vulnerability. This affects Mozilla Firefox (versions prior to 134 and ESR 128.6) and Thunderbird (versions prior to 134 and 128.6). Exploitation of this v...

CVE-2024-6609

The CVE-2024-6609 entry concerns NSS memory management: when memory is nearly exhausted, an elliptic curve key that was never allocated could be freed again, potentially enabling memory corruption or related instability. Affected products cited in connected docs include Mozilla Firefox and Mozill...

CVE-2019-11692

CVE-2019-11692 is a use-after-free in the event listener manager that can occur when listeners are removed while still in use, causing a crash in Thunderbird <=60.6.x/60.7.0, Firefox <=66-67 (and ESR

CVE-2019-11730

CVE-2019-11730 describes a same-origin policy violation where opening a locally saved HTML file could allow file: URIs to access files in the same directory or subdirectories, enabling the Fetch API to read contents and potentially exfiltrate them. The issue affects Firefox ESR < 60.8, Firefox...

CVE-2025-0239

The ALPN (Application-Layer Protocol Negotiation) component in Mozilla Firefox , Firefox ESR , and Thunderbird (including Thunderbird ESR ) is vulnerable to an Alt-Svc certificate validation failure. When a server redirects to an insecure site, the component fails to properly validate certificate...

CVE-2025-1011

A bug in WebAssembly code generation could lead to a crash in Mozilla Firefox , Firefox ESR , and Thunderbird (including Thunderbird ESR ). Attackers might leverage this vulnerability to achieve code execution . The issue has been addressed in Firefox 135 , Firefox ESR 128.7 , Thunderbird 128.7 ,...

CVE-2025-1012

A race condition during concurrent delazification in Mozilla Firefox and Thunderbird could lead to a use-after-free vulnerability. This issue affects Firefox < 135 , Firefox ESR < 115.20 , Firefox ESR < 128.7 , Thunderbird < 128.7 , and Thunderbird

CVE-2019-11698

CVE-2019-11698 concerns theft of browser history via drag-and-drop of crafted hyperlinks to bookmarks that are dragged into web content. Public documents confirm affected products and versions: Thunderbird < 60.7, Firefox < 67, and Firefox ESR

CVE-2021-29988

The CVE-2021-29988 issue is a memory safety vulnerability in Mozilla code where Firefox incorrectly treated an inline list-item as a block element, leading to an out-of-bounds read or memory corruption and a potentially exploitable crash. Affected products and versions: Thunderbird < 78.13 and...

CVE-2021-43537

CVE-2021-43537: An incorrect type conversion of sizes from 64-bit to 32-bit integers causes a heap buffer overflow during structured cloning, leading to memory corruption and potentially exploitable crashes. Affected: Firefox before 95 and Thunderbird before 91.4.0. Remediation: upgrade to Firefo...

CVE-2024-11698

A flaw in handling fullscreen transitions can cause the application to become stuck in fullscreen mode when a modal dialog is opened during the transition. This issue specifically affects macOS and results in a disrupted browsing experience where users cannot exit fullscreen via standard actions ...

CVE-2021-29986

CVE-2021-29986 describes a race condition in getaddrinfo that can cause memory corruption and a potentially exploitable crash on Linux. Affected products include Thunderbird and Firefox variants: Thunderbird < 78.13 and < 91, Firefox ESR < 78.13, and Firefox

CVE-2023-6209

CVE-2023-6209 corresponds to a parsing vulnerability where relative URLs starting with three slashes and a "/../" path could override the specified host, potentially enabling security issues on affected sites. The issue is documented for Firefox and Thunderbird, with affected versions cited as Fi...

CVE-2019-9796

CVE-2019-9796 is a use-after-free in the SMIL animation controller where double registration with the refresh driver leads to a dangling pointer after the controller is removed. Affected products include Thunderbird and Firefox (Firefox ESR < 60.6, Firefox

CVE-2020-12406

CVE-2020-12406 involves a missing type check during unboxed objects removal in Mozilla code, leading to a crash that could be exploited to run arbitrary code. Affected products/versions from the provided documents include Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR

CVE-2022-34478

Summary: CVE-2022-34478 affects Thunderbird on Windows, where the ms-msdt, search, and search-ms protocols could deliver content to Microsoft apps via prompts opened by user interaction. The underlying risk is exploitation of a prompt-based handling in these protocols that bypasses the browser. T...

CVE-2020-15664

The CVE-2020-15664 issue arises from a malicious page holding a reference to eval() from an about:blank window, allowing access to InstallTrigger and prompting users to install an extension. Affected products include Firefox < 80, Thunderbird < 78.2/68.12, Firefox ESR < 68.12/78.2, and F...

CVE-2020-6806

CVE-2020-6806 is a memory-safety bug causing an out-of-bounds read during promise resolution that could lead to memory corruption and a potentially exploitable crash. The vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR

CVE-2020-6814

CVE-2020-6814 refers to memory-safety bugs in Mozilla Firefox and Thunderbird (68.5 timeframe) with potential to run arbitrary code. Affected products/versions: Thunderbird < 68.6, Firefox < 74, Firefox ESR < 68.6, and Firefox ESR

CVE-2024-11696

This vulnerability affects Firefox versions < 133 , Firefox ESR < 128.5 , Thunderbird < 133 , and Thunderbird

CVE-2020-15683

CVE-2020-15683 : Mozilla Firefox and Thunderbird memory-safety issues reported affecting Firefox ESR < 78.4, Firefox < 82, and Thunderbird

CVE-2020-6825

CVE-2020-6825 is a memory-safety issue in Mozilla Firefox/Thunderbird affecting Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox

CVE-2020-6831

CVE-2020-6831 is a bug described in Debian security advisories as a buffer overflow in the SCTP chunk input validation in the usrsctp library. The Debian entries explicitly tie this CVE to Firefox ESR (<68.8), Firefox (<76) and Thunderbird (

CVE-2021-23981

CVE-2021-23981 describes a memory-safety issue in WebGL where uploading a Texture into a Pixel Buffer Object could confuse WebGL and skip binding the buffer used to unpack it, leading to an out-of-bounds read and potential information leak or crash. Affected software includes Firefox ESR < 78....

CVE-2021-29984

CVE-2021-29984 involves instruction reordering that allowed a GC-related object misevaluation, causing memory corruption and potentially exploitable crashes in Mozilla components. Affected products include Thunderbird and Firefox ESR/Firefox releases prior to 78.13/91; the exploit would require m...

CVE-2024-11693

This vulnerability affects Firefox versions prior to 133, Firefox ESR prior to 128.5, Thunderbird versions prior to 133, and Thunderbird prior to 128.5. The issue is specifically restricted to Windows operating systems , where the executable file warning is not presented during the download of .l...

CVE-2024-4769

This vulnerability exists in Firefox , Firefox ESR , and Thunderbird when importing resources via Web Workers . The underlying cause is that error messages distinguish between application/javascript responses and non-script responses, which could be abused to leak information cross-origin. Affect...

CVE-2024-5693

The Offscreen Canvas component in Firefox and Thunderbird failed to properly track cross-origin tainting . This flaw could allow an attacker to access image data from another site, violating the same-origin policy . Affected versions include Firefox < 127 , Firefox ESR < 115.12 , and Thunde...

CVE-2018-18505

CVE-2018-18505 concerns an IPC privilege-escalation in Mozilla products where an authentication added during IPC process creation is not applied to channels created later, enabling potential sandbox escape through IPC channels. Public advisories tie this to Thunderbird and Firefox releases prior ...

CVE-2019-11743

CVE-2019-11743 describes cross-origin access to unload event attributes, enabling timing-side-channel exposure of history in certain browsers. Connected docs confirm affected products and versions, with fixes noted in Thunderbird updates (e.g., Thunderbird 60.9.0) and Firefox/ESR advisories addre...

CVE-2021-23984

The CVE-2021-23984 entry describes a vulnerability in which a malicious extension could open a popup window without an address bar, allowing spoofing of a site and credential theft. Affected products include Firefox ESR < 78.9, Firefox < 87, and Thunderbird

CVE-2021-24002

CVE-2021-24002 is a vulnerability observed in Firefox before 88 and Thunderbird before 78.10 where clicking an FTP URL containing encoded newline characters (%0A, %0D) could cause the server to interpret newlines and execute arbitrary commands. Affected products include Firefox ESR < 78.10, Fi...

CVE-2021-38504

The CVE-2021-38504 issue is a real vulnerability affecting Firefox < 94, Thunderbird < 91.3, and Firefox ESR

CVE-2024-11706

A null pointer dereference vulnerability exists in the pk12util component, specifically within the SEC_ASN1DecodeItem_Util function. This issue occurs when the software processes malformed or improperly formatted input files. The vulnerability impacts Firefox versions prior to 133 and Thunderbird...

CVE-2024-7526

The ANGLE component in Firefox and Thunderbird fails to initialize parameters correctly, leading to a read from uninitialized memory . This vulnerability could be exploited to leak sensitive data from memory. Affected versions include Firefox < 129 , Firefox ESR < 115.14 , Firefox ESR < ...

CVE-2024-7527

The CVE-2024-7527 issue (use-after-free at the start of sweeping) affects Firefox <129 and Thunderbird

CVE-2021-29969

Thunderbird is affected by CVE-2021-29969: when STARTTLS is used for IMAP, an attacker injecting IMAP responses before TLS completion could cause Thunderbird to display spoofed information (e.g., folders that don’t exist). Affects Thunderbird versions older than 78.12. The issue originates from n...

CVE-2024-4777

CVE-2024-4777 concerns memory-safety bugs in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10, potentially allowing arbitrary code execution. Public sources in connected documents confirm affected products and versions: Firefox < 126, Firefox ESR < 115.11, and Thunderbird

CVE-2024-6610

The CVE-2024-6610 issue is disclosed across multiple sources as a UI vulnerability in Mozilla Firefox and Thunderbird prior to version 128, caused by form validation popups that can capture escape key presses and block exiting full-screen mode. Affected products: Firefox <128 and Thunderbird

CVE-2019-11693

CVE-2019-11693 describes a Linux-specific buffer overflow in WebGL’s bufferdata, affecting Thunderbird and Firefox (Thunderbird <60.7, Firefox <67, ESR

CVE-2019-11715

CVE-2019-11715: HTML parsing error can contribute to content XSS. Affected: Firefox ESR <60.8, Firefox <68, Thunderbird

CVE-2021-29976

CVE-2021-29976 is a memory-safety issue affecting Mozilla code shared by Firefox and Thunderbird. The advisory details indicate memory-safety bugs that could be exploited to run arbitrary code, impacting Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox