Search for packages
| purl | pkg:deb/debian/firefox@149.0-1?distro=sid |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-11pv-s4za-tbch | A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. |
CVE-2024-4768
|
| VCID-135c-h34e-tye5 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40957
|
| VCID-13he-qsr4-h3d4 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4709
|
| VCID-13hn-7fbd-mfhq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1553
|
| VCID-13kw-adwc-93by | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29918
|
| VCID-14gr-rfym-5yha | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6463
|
| VCID-15mn-5hnv-w7f4 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.*Note: this issue only affects Firefox on Windows operating systems.* |
CVE-2020-12389
|
| VCID-16cw-k8f1-8kc4 | Mozilla developers and community members Julien Cristau, Christian Holler reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-38499
|
| VCID-16q2-yvfb-u3br | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11717
|
| VCID-17tt-jftn-m3bd | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31737
|
| VCID-184j-aaaw-pbed | If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.**Note*: Due to a clerical error this advisory was not included in the original announcement, and was added in February 2022. |
CVE-2021-4221
|
| VCID-18my-61hh-n3gb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1934
|
| VCID-19cb-y1de-u3bn | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1957
|
| VCID-19r2-4svk-uydr | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4578
|
| VCID-19vv-zhum-43hp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10468
|
| VCID-19yr-k5mp-quc3 | Privilege escalation in the IPC component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4722
|
| VCID-1a64-m2w1-hkhs | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6814
|
| VCID-1asm-t31q-w3ef | The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. |
CVE-2017-5455
|
| VCID-1azv-247b-xufb | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2784
|
| VCID-1bwt-pf55-7ubd | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3808
|
| VCID-1dkk-86db-s3ch | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5168
|
| VCID-1e61-jk2b-aubw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23994
|
| VCID-1erb-xc8r-8kfm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26384
|
| VCID-1fjz-wwfj-63fd | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. |
CVE-2025-4090
|
| VCID-1frd-d76n-13fm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26965
|
| VCID-1fv1-edht-ufag | Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4715
|
| VCID-1gbp-dg93-wud9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5129
|
| VCID-1hak-cqnh-tqay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45406
|
| VCID-1hay-xe3q-gyb4 | Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2789
|
| VCID-1jqj-tqfp-73f7 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14325
|
| VCID-1kc3-8bh6-jbc7 | Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local file: URLs, allowing for the reading of local data through a violation of same-origin policy. *Note: This attack only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-7759
|
| VCID-1kfj-m46a-bkd9 | A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29965
|
| VCID-1njr-8t2z-13ex | If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. |
CVE-2018-5163
|
| VCID-1phe-59fw-9qdt | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22739
|
| VCID-1pvk-yzup-wfbc | An out-of-bounds read vulnerability exists in the Skia graphics library, allowing for the possible leaking of data from memory. |
CVE-2019-5849
|
| VCID-1q54-juu2-xbat | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15683
|
| VCID-1qkk-afcz-mba7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12426
|
| VCID-1r1r-3q6z-bbej | The search term could have been specified externally to trigger SQL injection. |
CVE-2022-1887
|
| VCID-1rj3-tt63-4yc1 | Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. |
CVE-2021-38497
|
| VCID-1s5n-6p4c-q3ds | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12417
|
| VCID-1tcx-3zn1-ykdq | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9904
|
| VCID-1u8u-pnq3-t7ae | Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2757
|
| VCID-1uqv-yk9v-nkau | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-36316
|
| VCID-1ur2-g3su-pqd3 | A Cliqz.com developer demonstrated that web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. |
CVE-2016-5288
|
| VCID-1v2s-g46y-ybdc | Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-2792
|
| VCID-1vpc-vfey-qkb6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25732
|
| VCID-1w87-ttm5-m3h8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3035
|
| VCID-1w8j-w2rh-hqdf | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2809
|
| VCID-1xcg-n9k4-tqc4 | A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. |
CVE-2025-1011
|
| VCID-1xy1-1vks-1ugu | A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. |
CVE-2020-15662
|
| VCID-1z5d-4wfm-8yfk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9396
|
| VCID-1zf8-qjts-9fbc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11704
|
| VCID-22wr-t2b9-g7bv | Multiple vulnerabilities have been reported in the SeaMonkey project, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6499
|
| VCID-22xt-tnu1-gyhu | An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by blob: as the protocol, leading to user confusion and further spoofing attacks. |
CVE-2017-5415
|
| VCID-23bx-as83-e3bv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5435
|
| VCID-23eu-22t2-cydd | Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4714
|
| VCID-23v6-x6d6-buca | A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption. |
CVE-2019-9805
|
| VCID-24j1-4jbd-abft | When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. *This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2023-29546
|
| VCID-253e-56sw-77b1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6611
|
| VCID-2648-ggwp-cyfv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25735
|
| VCID-26d3-ctnj-7kbh | Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4691
|
| VCID-26jx-pxqe-yucz | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1958
|
| VCID-27hw-egkx-w7d4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-1529
|
| VCID-289s-f2w6-53g9 | Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4716
|
| VCID-28ad-d2hr-r3e7 | Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. |
CVE-2024-53975
|
| VCID-28dd-azvp-pkeu | Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. |
CVE-2020-15648
|
| VCID-2a5d-8cac-mkft | A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.* |
CVE-2023-29542
|
| VCID-2bnv-phbv-7khe | Multiple vulnerabilities have been reported in Mozilla Firefox. |
CVE-2006-5464
|
| VCID-2bqp-adeh-7kck | security flaw |
CVE-2006-2788
|
| VCID-2bwb-r8fr-sua8 | Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the address bar contents. This can lead to a malicious site to appear to have the same URL as the trusted site.*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* |
CVE-2024-8897
|
| VCID-2c5u-jbc5-27bg | A use-after-free vulnerability can occur when arguments passed to the IsPotentiallyScrollable function are freed while still in use by scripts. This results in a potentially exploitable crash. |
CVE-2018-5100
|
| VCID-2c6t-jrux-37d9 | Multiple unspecified vulnerabilities in Mozilla Firefox have unspecified vectors and impact, as claimed during ToorCon 2006. NOTE: the vendor and original researchers have released a follow-up comment disputing this issue, in which one researcher states that "I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not. |
CVE-2006-5160
|
| VCID-2cc4-sryx-auh7 | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4723
|
| VCID-2cd3-m37k-5ydh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29946
|
| VCID-2cuh-xyst-rbgv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7518
|
| VCID-2ejc-7bd5-qkbf | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3028
|
| VCID-2fx7-py1u-pfdv | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1736
|
| VCID-2j1e-fjx6-tucr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6872
|
| VCID-2j27-84u7-83ak | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5276
|
| VCID-2j6k-5q8j-3fbc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-9680
|
| VCID-2j7g-g6dj-qydb | If a page is loaded from an original site through a hyperlink and contains a redirect to a data:text/html URL, triggering a reload will run the reloaded data:text/html page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. |
CVE-2017-5466
|
| VCID-2k99-39yt-gkbe | During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. |
CVE-2021-38496
|
| VCID-2kcw-vt7h-1ya1 | A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-11702
|
| VCID-2mf4-kpr7-3kcu | If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bounds read with the read memory sent to the originating server in response. |
CVE-2018-5153
|
| VCID-2myh-pg75-1kgb | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13025
|
| VCID-2ptm-gx1p-uyhf | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9897
|
| VCID-2pvz-3cmq-53dk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7519
|
| VCID-2q2k-zuq7-cye9 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3032
|
| VCID-2q2t-rh3t-5qgy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-25748
|
| VCID-2q4w-u64u-rbh2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4778
|
| VCID-2rzn-8a6r-5fhs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43540
|
| VCID-2s85-r5tn-wucn | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31741
|
| VCID-2sd2-88zt-kkaq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2020-6796
|
| VCID-2syj-hbw7-fkbp | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29988
|
| VCID-2tts-gwgd-zqcz | A vulnerability has been discovered in NSS, which can lead to the recovery of private data. |
CVE-2023-5388
|
| VCID-2u79-8nnu-e7dj | The Extensions manager in Mozilla Firefox 2.0 does not properly populate the list of local extensions, which allows attackers to construct an extension that hides itself by finding its name in the list and then calling RemoveElement, as demonstrated by the FFsniFF extension. NOTE: it was later reported that 3.0 is also affected. |
CVE-2006-6585
|
| VCID-2v3a-jr55-ybbj | The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. |
CVE-2021-43532
|
| VCID-2vdu-1jvt-5uf3 | Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29944
|
| VCID-2vy5-zebk-1bgk | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29961
|
| VCID-2vyc-yhw7-muea | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43546
|
| VCID-2w58-mdmk-guh8 | Mozilla has updated the version of Network Security Services (NSS) library used in Firefox to NSS 3.23. This addresses four moderate rated networking security issues reported by Mozilla engineers Tyson Smith and Jed Davis. |
CVE-2016-2834
|
| VCID-2wqx-77qd-fbfd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12386
|
| VCID-2xe3-59tz-zbc3 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9901
|
| VCID-2xk4-1b82-p3ft | Dynamically changing the style of an element from position:relative to position:static can cause Gecko to operate on freed memory. It may be possible to exploit this in order to run arbitrary code.This flaw was introduced during Firefox 1.5 and SeaMonkey 1.0 development and does not affect Firefox 1.0 or the Mozilla Suite 1.7Thunderbird 1.5 could be vulnerable if JavaScript is enabled in mail. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.Update (13 April 2006) This flaw has been fixed in Thunderbird 1.5.0.2 |
CVE-2006-0294
|
| VCID-2xvy-5r3e-eqfd | Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. |
CVE-2025-14744
|
| VCID-2xza-hhmr-5ybw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7826
|
| VCID-2y2t-51pa-m3gv | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-45417
|
| VCID-2ybd-wjmm-c7hm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12370
|
| VCID-2yeg-q5hq-wud1 | A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. *Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected.* |
CVE-2017-7770
|
| VCID-2z7p-2uj3-2qfb | If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.* |
CVE-2019-9815
|
| VCID-2zdh-azdw-tuav | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-2609
|
| VCID-2zja-svg5-mqct | By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port number such as '1', and without a lock icon) while controlling the page contents. |
CVE-2020-12412
|
| VCID-2zxp-rnge-5ufc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23983
|
| VCID-32pc-j3he-pffx | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4055
|
| VCID-3315-b7du-kydm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5448
|
| VCID-33n8-tvfg-2qg9 | Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client |
CVE-2025-5020
|
| VCID-33u4-8can-hkck | Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-1414
|
| VCID-3465-gq22-3kfy | Multiple vulnerabilities have been found in Expat, the worst of which may allow execution of arbitrary code. |
CVE-2016-0718
|
| VCID-351y-4nek-u3aw | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4698
|
| VCID-353s-ucdm-z7ck | After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. |
CVE-2020-6810
|
| VCID-358q-cakg-h7h4 | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3803
|
| VCID-35af-887a-cbcg | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3860
|
| VCID-362f-1bn1-mbg5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46882
|
| VCID-37ud-wx7n-mqhs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42927
|
| VCID-37yz-42mm-5ybv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23970
|
| VCID-38j9-cugr-abc9 | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-35113
|
| VCID-39za-a75a-z7c3 | On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. *Note: This attack only affects the Linux operating system. Other operating systems are not affected.* |
CVE-2017-7794
|
| VCID-3ayf-d2s1-67ff | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8382
|
| VCID-3cbn-278y-hkah | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7784
|
| VCID-3d1e-hqg2-zbbm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37210
|
| VCID-3dea-vjmc-b7eb | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5297
|
| VCID-3dy5-4e6w-3kgt | A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. |
CVE-2017-5427
|
| VCID-3e4u-tnge-wkew | Denial-of-service due to out-of-memory in the Graphics: WebRender component. |
CVE-2025-9182
|
| VCID-3ega-m6fz-uugy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5464
|
| VCID-3ehk-593t-abcp | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5408
|
| VCID-3ekg-4fq3-4bdc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3856
|
| VCID-3fpq-jre6-53fs | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11706
|
| VCID-3gj8-p1tj-g3c3 | Mozilla Firefox 1.5.0.4 and earlier allows remote user-assisted attackers to cause a denial of service (crash) via a form with a multipart/form-data encoding and a user-uploaded file. NOTE: a third party has claimed that this issue might be related to the LiveHTTPHeaders extension. |
CVE-2006-3731
|
| VCID-3gmj-y8qd-ufej | Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2787
|
| VCID-3grf-hwk1-3fh8 | Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4719
|
| VCID-3kd3-hwzv-efbn | Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-4721
|
| VCID-3kgq-ew8p-ubg5 | Firefox cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. |
CVE-2025-8036
|
| VCID-3mpq-vv29-hbap | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11724
|
| VCID-3nbs-awz4-zfgb | The return value from gfx::SourceSurfaceSkia::Map() wasn't being verified which could have potentially lead to a null pointer dereference. |
CVE-2023-25733
|
| VCID-3nrj-5r53-37ab | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6135
|
| VCID-3nup-1513-ybaq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5400
|
| VCID-3nzs-5tgj-q3hw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23964
|
| VCID-3pvs-3ppc-r7a5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3857
|
| VCID-3qfb-sxha-v3cw | Same-origin policy bypass in the Layout component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10529
|
| VCID-3rfz-fntk-vffv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11728
|
| VCID-3rn4-418d-vqd5 | Calling the QueryInterface method of the built-in Location and Navigator objects causes memory corruption that might be exploitable to run arbitrary code.This flaw appears to have been introduced during development of Firefox 1.5/SeaMonkey 1.0 -- Firefox 1.0 and the older Mozilla Suite 1.7 do not appear to be vulnerable.Thunderbird 1.5 could be vulnerable if JavaScript is enabled in mail. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.Update (7 February 2006) H D Moore of the Metasploit Project published a working exploit on milw0rm for the Linux and Mac OS X versions of Firefox 1.5. Severity upgraded to critical.Update (13 April 2006) This flaw has been fixed in Thunderbird 1.5.0.2 |
CVE-2006-0295
|
| VCID-3sg3-9yx7-fufa | Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2790
|
| VCID-3sjh-f264-m3g7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8387
|
| VCID-3smq-ax5u-ryd3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-17012
|
| VCID-3tww-nhmh-gua6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5410
|
| VCID-3u86-qe3j-63d3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34475
|
| VCID-3v78-2fyv-tqht | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12385
|
| VCID-3vbp-2h4f-7bav | A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. |
CVE-2024-2611
|
| VCID-3w3b-gzvg-87ag | If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port - would be granted that permission.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29971
|
| VCID-3xbf-cbqc-suea | Mozilla Firefox 1.0.7 and earlier on Linux allows remote attackers to cause a denial of service (client crash) via an IFRAME element with a large value of the WIDTH attribute, which triggers a problem related to representation of floating-point numbers, leading to an infinite loop of widget resizes and a corresponding large number of function calls on the stack. |
CVE-2005-4720
|
| VCID-3xgu-7evz-mffw | Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4705
|
| VCID-3yea-3gw6-xkcb | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-35111
|
| VCID-3zwq-1hwc-3fgj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29976
|
| VCID-41g2-dvb2-yqhg | Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2024-2614
|
| VCID-41zd-qkbf-bucq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5187
|
| VCID-436x-mrs7-q3gk | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26960
|
| VCID-43dj-vtap-2qd2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32206
|
| VCID-43nm-4qjy-vfgj | On arm64, a WASM br_table instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. |
CVE-2025-8028
|
| VCID-4437-azu7-hyhb | Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font sets on the addressbar. The non-Latin character will not be visible to most viewers. This allows for domain spoofing attacks because these combined domain names do not display as punycode. |
CVE-2017-7833
|
| VCID-44zf-meps-6fey | Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-15650
|
| VCID-4555-zn45-mfd8 | A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack. |
CVE-2019-9806
|
| VCID-46ay-rbbm-gqec | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0884
|
| VCID-46cy-x3cp-tke5 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0743
|
| VCID-47dr-szw4-ryfr | During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. |
CVE-2016-5292
|
| VCID-48em-7yxs-pqf9 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7779
|
| VCID-4azu-y4y6-nyff | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2794
|
| VCID-4b2s-6ynk-tbgd | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29543
|
| VCID-4bfx-2qxt-jfha | Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2024-2615
|
| VCID-4bw1-v6ze-kbds | Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13018
|
| VCID-4byg-5gy3-kkff | The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. |
CVE-2025-8031
|
| VCID-4c3c-ygt3-kbg5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2020-6797
|
| VCID-4c57-5fbn-8bdy | Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL |
CVE-2025-27426
|
| VCID-4d2q-usge-77ft | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9898
|
| VCID-4drw-dpmm-nbcg | The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discovered where the page could attempt to create these images through file: URLs from the local file system. This loading is blocked by the sandbox but could expose local data if combined with another attack that escapes sandbox protections. |
CVE-2018-5118
|
| VCID-4ewq-72xf-rfhq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12371
|
| VCID-4f4y-p7h8-dygq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5728
|
| VCID-4g3s-bh4t-qqhc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6867
|
| VCID-4g7u-xmdq-mkdn | Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14328
|
| VCID-4gsx-puz4-a3f1 | Use-after-free in MediaTrackGraphImpl::GetInstance() |
CVE-2025-11708
|
| VCID-4gwx-75uj-tyep | Mozilla community member jomo reported a use-after-free crash when processing WebGL content. This issue was caused by the use of a texture after its recycle pool has been destroyed during WebGL operations, which frees the memory associated with the texture. This results in a potentially exploitable crash when the texture is later called. |
CVE-2016-2828
|
| VCID-4hcr-7re3-rkhx | An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. |
CVE-2025-6427
|
| VCID-4hnb-y6bt-4fb1 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2798
|
| VCID-4jfr-pz41-gfbz | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7523
|
| VCID-4jqv-p541-tfa9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7749
|
| VCID-4jtc-q2de-nqfz | When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caused the URL to load unintentionally, which could lead to XSS and spoofing attacks.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-43544
|
| VCID-4kd3-95cm-g3fc | Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13019
|
| VCID-4m2d-td6c-ukd4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40958
|
| VCID-4n3b-syg9-ykh9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5446
|
| VCID-4nqf-nxkj-x3g4 | GetBoundName could return the wrong version of an object when JIT optimizations were applied. |
CVE-2024-3852
|
| VCID-4q6h-ac7c-6fav | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42928
|
| VCID-4q6w-tdk9-d3an | Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-4720
|
| VCID-4q92-3x61-ukep | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3858
|
| VCID-4r8e-64b6-bbbu | Use-after-free in the Widget: Cocoa component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4711
|
| VCID-4rpa-nwnh-b3h3 | The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-7760
|
| VCID-4rt5-58ue-sufc | Mozilla developers and community members Gary Kwong, Christian Holler, André Bargull, Bob Clary, Carsten Book, Emilio Cobos Álvarez, Masayuki Nakano, Sebastian Hengst, Franziskus Kiefer, Tyson Smith, and Ronald Crane reported memory safety bugs present in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-7780
|
| VCID-4rvz-3zc6-dkc1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-23606
|
| VCID-4seg-6hwv-3qaw | The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored. |
CVE-2019-11747
|
| VCID-4sv2-j8zg-xkhf | When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2019-17009
|
| VCID-4trh-3k93-97br | The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including javascript: links. If a JSON file contains malicious JavaScript script embedded as javascript: links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are accessible to that context. |
CVE-2018-5176
|
| VCID-4urd-zjpu-47ed | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6870
|
| VCID-4v5u-daet-2ud2 | Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-2807
|
| VCID-4v74-u3y3-xkh6 | If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. |
CVE-2019-11697
|
| VCID-4vg5-9865-s3b2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6606
|
| VCID-4vps-3cxv-xyd5 | On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as .url by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. |
CVE-2024-5692
|
| VCID-4vt1-q4wj-87bm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29980
|
| VCID-4w3q-eb6t-huam | When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination |
CVE-2024-38312
|
| VCID-4xqc-2rzu-y3aj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6873
|
| VCID-4xqc-36jb-63c2 | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2786
|
| VCID-4xud-hwda-pyhw | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5272
|
| VCID-4yvm-d9qr-ebaw | Multiple vulnerabilities have been discovered in NSS, the worst of which could result in arbitrary code execution. |
CVE-2022-1097
|
| VCID-4z19-eyh7-9yf4 | The existence of a specifically requested local file can be found due to the double firing of the onerror when the source attribute on a <track> tag refers to a file that does not exist if the source page is loaded locally. |
CVE-2017-5387
|
| VCID-4z8m-8jr8-pqh6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32212
|
| VCID-4zjw-4gjw-pqh1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0242
|
| VCID-4znr-5fxr-qqhc | A mechanism to bypass Content Security Policy (CSP) protections on sites that have a script-src policy of 'strict-dynamic'. If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the require.js library that is part of Firefox’s Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. |
CVE-2018-5175
|
| VCID-511n-z57u-dqhb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1941
|
| VCID-51b4-ba7r-qucd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29990
|
| VCID-51jr-5fzq-hbav | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23969
|
| VCID-528r-jfhc-abdc | Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. |
CVE-2024-26281
|
| VCID-52ha-qvpu-ruc8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37208
|
| VCID-52qs-bkd7-eygr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23988
|
| VCID-53y3-s5pc-nbh1 | By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). |
CVE-2018-12398
|
| VCID-545u-wnrj-z3dh | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5291
|
| VCID-5461-sgjx-3yd3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26385
|
| VCID-54vr-pby9-ffg7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5459
|
| VCID-55t6-qkan-a7g5 | Mozilla developers Tyson Smith, Lars T Hansen, Valentin Gosu, and Sebastian Hengst reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-23979
|
| VCID-5666-pp89-aqc2 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution.*Note: this issue only affects Firefox on Windows operating systems.* |
CVE-2020-12393
|
| VCID-566b-z61f-5kda | After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* |
CVE-2025-3033
|
| VCID-56jb-xrj9-dyf3 | Mozilla developers and community members Mats Palmgren, Philipp, Byron Campen, Christian Holler, Gary Kwong, Benjamin Bouvier, Bob Clary, Jon Coppeard, and Michael Layzell reported memory safety bugs present in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-5471
|
| VCID-56zj-gzcs-k7eb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1943
|
| VCID-57dt-91vn-pyfn | Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to fullscreen mode after the fix for CVE-2023-6870 in Firefox 121. This could lead to spoofing the browser UI if the sudden appearance of the prompt distracted the user from noticing the visual transition happening behind the prompt. These notifications now use the Android Toast feature. *This bug only affects Firefox on Android. Other operating systems are unaffected.* |
CVE-2024-8388
|
| VCID-58fz-pp5t-8ybz | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1731
|
| VCID-58mr-4qat-sfet | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could arbitrary code execution. |
CVE-2024-29944
|
| VCID-59up-n66e-fyhx | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28281
|
| VCID-59wd-mtjt-4ban | Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-11714
|
| VCID-59xd-f8wh-xbe5 | Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of service (crash) via a crafted FTP response, when attempting to connect with a username and password via the FTP URI. |
CVE-2006-4310
|
| VCID-5aga-y5nk-5fha | A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would processing incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* |
CVE-2021-29964
|
| VCID-5c1p-6gjw-wkgx | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-12391
|
| VCID-5dyh-s3yd-vqes | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9895
|
| VCID-5ept-fu7g-8kes | Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2780
|
| VCID-5f8u-kf14-tkah | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31738
|
| VCID-5fnn-ru3z-f3dt | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11712
|
| VCID-5gs2-jpsz-jbfu | A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. |
CVE-2019-9821
|
| VCID-5hzf-gdbj-8ud8 | Double Free There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. |
CVE-2023-1999
|
| VCID-5j1d-9624-y3e2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3862
|
| VCID-5j6z-g7gt-qyea | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11694
|
| VCID-5kuc-8g2u-8baq | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* |
CVE-2025-6431
|
| VCID-5kwn-x8e4-ukgq | Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-14333
|
| VCID-5n3q-eby7-67de | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5373
|
| VCID-5p2x-6brd-xfad | Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. *Note: This attack only affects OS X operating systems. Other operating systems are unaffected.* |
CVE-2017-7763
|
| VCID-5pf4-9k7e-hbee | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-16042
|
| VCID-5qap-6r9b-6qbv | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38493
|
| VCID-5rhb-8wbf-kyfu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6822
|
| VCID-5seb-8xxp-cbcs | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-25731
|
| VCID-5srb-q1nd-1qfh | A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. *Note: This attack only affects Windows operating systems. Other operating systems are unaffected.* |
CVE-2017-7845
|
| VCID-5tg2-vh52-5yhc | When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. |
CVE-2021-43531
|
| VCID-5up1-n726-hbg2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-0843
|
| VCID-5utj-ddpa-17gq | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26974
|
| VCID-5vfr-zqvb-ykdv | Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. |
CVE-2025-11716
|
| VCID-5vzu-hjqt-83ct | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5695
|
| VCID-5wqt-2dtu-8qa4 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1950
|
| VCID-5wr5-pbq3-ukeu | Georgi Guninski reports integer overflows in the new E4X, SVG, and Canvas features. These lead to memory corruption that is potentially exploitable to run arbitrary code.These flaws were introduced during Firefox 1.5 and SeaMonkey 1.0 development and do not affect Firefox 1.0 or the Mozilla Suite 1.7Thunderbird 1.5 could be vulnerable if JavaScript is enabled in mail. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.Update (13 April 2006) This flaw has been fixed in Thunderbird 1.5.0.2 |
CVE-2006-0297
|
| VCID-5wtc-metc-wfb1 | If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status |
CVE-2024-31392
|
| VCID-5z46-a21q-4yd3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23986
|
| VCID-5zmj-5xkc-zkgc | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-11694
|
| VCID-617s-c6y6-ube4 | Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2022-22752
|
| VCID-622g-5uav-bbgd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7764
|
| VCID-63t8-2rm7-5ya6 | A compromised sandboxed content process can perform a Universal Cross-site Scripting (UXSS) attack on content from any site it can cause to be loaded in the same process. Because addons.mozilla.org and accounts.firefox.com have close ties to the Firefox product, malicious manipulation of these sites within the browser can potentially be used to modify a user's Firefox configuration. These two sites will now be isolated into their own process and not allowed to be loaded in a standard content process. |
CVE-2019-11741
|
| VCID-63zq-gzan-8yff | The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. |
CVE-2020-26972
|
| VCID-646f-ndeq-5bee | Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4687
|
| VCID-65mp-nvc7-6kff | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-18356
|
| VCID-65u4-c84h-qqa1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4766
|
| VCID-65u5-n4mu-dqd2 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1728
|
| VCID-667g-8khd-kkhm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5407
|
| VCID-66dg-7sm8-vbgx | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29970
|
| VCID-66t7-51hw-4yap | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13023
|
| VCID-66z1-8zeg-9qh1 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10528
|
| VCID-675n-7uzz-pqdj | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4688
|
| VCID-67my-umrg-wkgm | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2802
|
| VCID-697p-cpq8-1qax | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32205
|
| VCID-6a4w-c6p8-affn | Control characters prepended before javascript: URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. |
CVE-2017-7839
|
| VCID-6a5y-dwev-93be | When a javascript: URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. |
CVE-2017-5458
|
| VCID-6ada-6td5-gyfn | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34473
|
| VCID-6aqn-abjb-skbd | If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection. |
CVE-2017-7789
|
| VCID-6atn-q8xc-6fdr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23978
|
| VCID-6b6h-x2km-u7fb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1549
|
| VCID-6b9m-3w58-qydd | The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. |
CVE-2017-5414
|
| VCID-6bbw-b3rx-a7hj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10462
|
| VCID-6cde-35h4-vqaj | An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. |
CVE-2016-9075
|
| VCID-6cx1-8t9m-u3av | Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0886
|
| VCID-6dcv-cqhw-c3b7 | On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. |
CVE-2024-11703
|
| VCID-6ds2-ff5c-eqf3 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1739
|
| VCID-6f7n-yr9x-8fbw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22751
|
| VCID-6fkp-5fzu-fydp | Mozilla developers and community members Andreas Pehrson and Christian Holler reported memory safety bugs present in Thunderbird 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-38500
|
| VCID-6fsa-bnes-tkff | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2765
|
| VCID-6fvj-phnx-kfgs | After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. |
CVE-2019-17023
|
| VCID-6h7s-a74e-33c1 | Mozilla developer Anne van Kesteren discovered that <iframe sandbox> with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. |
CVE-2020-15653
|
| VCID-6j2f-jjzf-tbdd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6820
|
| VCID-6jw1-pere-ruee | Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-11715
|
| VCID-6m1t-sn26-fbaf | When adding a range to an object in the DOM, it is possible to use addRange to add the range to an incorrect root object. This triggers a use-after-free, resulting in a potentially exploitable crash. |
CVE-2017-5403
|
| VCID-6na4-sgct-jugy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0754
|
| VCID-6nhk-apgd-h7gh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-18498
|
| VCID-6nrk-u1nq-5ya8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4774
|
| VCID-6p3q-f7f6-mygv | Mozilla developers and community members Christian Holler, Jon Coppeard, Milan Sreckovic, Tyson Smith, Ronald Crane, Randell Jesup, Philipp, Tooru Fujisawa, and Kan-Ru Chen reported memory safety bugs present in Firefox 52 and Firefox ESR 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-5430
|
| VCID-6pk2-g77j-h3b2 | An integer overflow during the parsing of XML using the Expat library. |
CVE-2016-9063
|
| VCID-6q8f-csj4-vkhb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5723
|
| VCID-6qv9-5wrf-cfee | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6613
|
| VCID-6rpt-16pv-yfar | The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. *Note: This attack only affects Windows operating systems. Other operating systems are unaffected.* |
CVE-2017-7755
|
| VCID-6s88-vfr8-u3hj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4585
|
| VCID-6sun-2gu6-jqh7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5434
|
| VCID-6tm9-1vsh-1qa3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4047
|
| VCID-6uth-8k3d-7qdj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12381
|
| VCID-6wce-w5a8-2qet | If a malicious site uses the view-source: protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected. This was fixed by no longer making view-source: linkable. |
CVE-2017-5422
|
| VCID-6wy1-juan-8ua8 | When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page. This allows for spoofing attacks. |
CVE-2017-5417
|
| VCID-6xgq-h4jf-sya9 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2808
|
| VCID-6z7n-s34h-nbed | Mozilla developers and community members Mikhail Gavrilov, Tyson Smith, Marcia Knous, Tom Ritter, Philipp, and Bob Owens reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2019-11735
|
| VCID-6zjy-1agk-nbd9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5174
|
| VCID-71rh-2xhf-euf8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-0511
|
| VCID-72hn-2x6h-tbde | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12421
|
| VCID-72wd-b7rj-3fda | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3810
|
| VCID-73bd-e4pc-y7h6 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11708
|
| VCID-73tn-gwzm-1bam | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-45419
|
| VCID-7458-uqdr-5fg7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43541
|
| VCID-74b7-rp1u-23hv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34477
|
| VCID-754j-7erb-z7ae | Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. |
CVE-2025-2817
|
| VCID-75fd-w925-4qh4 | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15676
|
| VCID-75sb-xb3r-3fa8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4573
|
| VCID-769r-8mmt-6qcc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11705
|
| VCID-77u8-v9gs-sfca | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25728
|
| VCID-77xm-mea8-n3ec | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12393
|
| VCID-77xw-dvy5-5uch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5445
|
| VCID-77y6-jskt-qucb | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
CVE-2025-59375
|
| VCID-782n-nc6m-13ec | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1551
|
| VCID-7939-5qcd-tqgg | Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges.*This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.* |
CVE-2025-4082
|
| VCID-79kw-syxy-n7a1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5447
|
| VCID-7acy-1dnk-pkcq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31747
|
| VCID-7aua-26jh-y3cr | Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent process under certain conditions. |
CVE-2019-9799
|
| VCID-7b8k-mgs3-cud5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29550
|
| VCID-7c8g-ben5-suet | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11710
|
| VCID-7ddz-65jt-pudk | Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code. |
CVE-2021-23997
|
| VCID-7ej3-csq2-9ycp | When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26955
|
| VCID-7ej9-whhw-97hn | A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. |
CVE-2019-9819
|
| VCID-7ejt-gurv-rkcw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23975
|
| VCID-7eu3-hxbk-8fd7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1935
|
| VCID-7f4r-4uzq-37ak | Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability affects Firefox < 148.0.2. |
CVE-2026-3846
|
| VCID-7fvy-7hpe-kbej | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38492
|
| VCID-7hkk-2k6p-vyc7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2019-17024
|
| VCID-7hu9-yxju-9bae | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5099
|
| VCID-7hye-1c3x-cubf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-4058
|
| VCID-7jjr-g2uj-wqdr | An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. |
CVE-2024-26283
|
| VCID-7kf6-5a92-hfhk | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5252
|
| VCID-7knr-6rqg-8kcw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29960
|
| VCID-7krh-czjm-4ufx | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26978
|
| VCID-7ksf-b6g3-ukcc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5155
|
| VCID-7mvz-mr2e-hyfx | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7787
|
| VCID-7p9y-82kb-r7h3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34472
|
| VCID-7pu2-1t9x-5yf1 | If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. |
CVE-2018-12403
|
| VCID-7q66-66b2-kucc | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. |
CVE-2025-5266
|
| VCID-7sbd-1n7f-ryed | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4057
|
| VCID-7t2x-pksm-ubgy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45416
|
| VCID-7taq-vg8p-f3dj | Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addressbar as displayed to users. *Note: This attack only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-5463
|
| VCID-7tc4-d3hr-bubf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31743
|
| VCID-7u5b-uzd5-7kdc | Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver. *This bug only affected the application on Apple M series hardware. Other platforms were unaffected.* |
CVE-2024-11691
|
| VCID-7v6j-9uuc-qkc8 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. |
CVE-2025-4919
|
| VCID-7vfx-u76f-ubet | By tricking the browser with a X-Frame-Options header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. |
CVE-2024-5691
|
| VCID-7vk4-9vwa-pbe9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45418
|
| VCID-7wac-zu58-5kgj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6825
|
| VCID-7wmw-hpfw-vuaa | Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2761
|
| VCID-7wvh-upas-2bgh | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. |
CVE-2024-9394
|
| VCID-7x5h-kej1-e3ef | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0751
|
| VCID-7xac-5zdj-9fgk | Mozilla developers and community members Boris Zbarsky, Carsten Book, Christian Holler, Byron Campen, Jan de Mooij, Jason Kratzer, Jesse Schwartzentruber, Marcia Knous, Randell Jesup, Tyson Smith, and Ting-Yu Chou reported memory safety bugs present in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-7827
|
| VCID-7xxf-jqdy-xya3 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-45415
|
| VCID-7yw2-2r4n-rugg | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9790
|
| VCID-7zbd-n414-43b7 | If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily invisible within Firefox. *Note: This vulnerability only affects OS X. Other operating systems are not affected.* |
CVE-2018-5110
|
| VCID-7zqn-1txc-r3d2 | When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. |
CVE-2024-4770
|
| VCID-8243-6pew-wuaj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-34415
|
| VCID-82f1-zb9f-qbg8 | If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. |
CVE-2025-6435
|
| VCID-83xt-ng2x-zugv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26953
|
| VCID-83zz-zvbw-vqer | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29549
|
| VCID-84jf-84jx-3fgj | Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14323
|
| VCID-84kk-wfxx-t3c8 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5380
|
| VCID-84nu-ma7v-efd1 | When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2022-22749
|
| VCID-86mg-qy53-pyc3 | As part of the Firefox 1.5.0.2 release we fixed several crash bugs to improve the stability of the product, with a particular focus on finding crashes caused by DHTML. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code with enough effort.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1531
|
| VCID-86q8-2yv7-efez | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2790
|
| VCID-878b-mn4w-wkg4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4049
|
| VCID-87at-xwyp-3bgm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23965
|
| VCID-87mf-fznn-m3gy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6205
|
| VCID-8988-upt6-tfgw | A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. |
CVE-2024-10941
|
| VCID-89es-k3ja-1be1 | PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF ### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645 |
CVE-2024-4367
GHSA-wgrm-67xf-hhpq |
| VCID-89kx-fdvr-73cs | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22754
|
| VCID-89nm-zgtp-cqc1 | The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of /private/var that could expose personal or temporary data. This has been updated to not allow access to /private/var and its subdirectories. *Note: this issue only affects OS X. Other operating systems are not affected.* |
CVE-2017-5425
|
| VCID-89t2-wzrw-nycq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12362
|
| VCID-8b6h-ptgc-3yfs | Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. |
CVE-2026-2032
|
| VCID-8bux-cyfn-pfhr | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5694
|
| VCID-8bvd-y3qe-8qfk | The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged access. Additionally, there was a race condition during checks for junctions and symbolic links by the Maintenance Service, allowing for potential local file and directory manipulation to be undetected in some circumstances. This allows for potential privilege escalation by a user with unprivileged local access. *Note: These attacks requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2019-11736
|
| VCID-8ckv-8maw-k3af | When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. |
CVE-2020-15681
|
| VCID-8d85-r58y-4qez | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-45407
|
| VCID-8dfd-mq2b-bqg5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22757
|
| VCID-8dgu-ppan-9ub2 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4048
|
| VCID-8dmy-qa26-rbha | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5258
|
| VCID-8egk-yeg9-cbcn | The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requires files in a specific format so arbitrary data cannot be read but it is possible that some local file information could be exposed. |
CVE-2018-5107
|
| VCID-8enx-7aa9-cqd3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22737
|
| VCID-8ez8-17vy-xuf3 | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2801
|
| VCID-8ffc-g2p2-xfax | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3801
|
| VCID-8fny-dsut-7ba3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5171
|
| VCID-8frm-8p43-pyh8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5442
|
| VCID-8fu2-5gxg-ekhy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23961
|
| VCID-8gnk-vdur-9uet | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1734
|
| VCID-8gzb-8g1n-yqfw | If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the Referer and Sec-* headers, meaning there is the potential for incorrect security checks within the browser in addition to incorrect or misleading information sent to remote websites.*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* |
CVE-2024-5687
|
| VCID-8h3r-nznt-jff7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5175
|
| VCID-8hgj-7cb6-fbbp | A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. *Note: this vulnerability only affects Windows. Other operating systems are unaffected.* |
CVE-2019-9818
|
| VCID-8hm6-nz5h-yfcm | An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. |
CVE-2025-4918
|
| VCID-8hqw-tgvq-pucf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12392
|
| VCID-8hrt-1yt3-1bh3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31745
|
| VCID-8jkx-ad5d-e7cd | A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. |
CVE-2021-24001
|
| VCID-8jzn-g96u-tudw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26956
|
| VCID-8k1r-9djq-h3bh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12390
|
| VCID-8k4z-rq29-mqg5 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11697
|
| VCID-8m89-ma2u-5fgu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5730
|
| VCID-8q1b-fdq4-aqha | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45405
|
| VCID-8qtg-h4km-bfg2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11719
|
| VCID-8qyy-e4jt-rbc4 | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4695
|
| VCID-8r1a-6vz3-r3a9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37212
|
| VCID-8rq6-26hu-m3gz | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9813
|
| VCID-8s22-tw1u-7kbw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45411
|
| VCID-8san-ze3j-dqdx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3030
|
| VCID-8sba-dejt-vqfp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3861
|
| VCID-8tfc-2aaq-47dk | A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results in a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. |
CVE-2018-18504
|
| VCID-8tmx-53k3-pbfj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26961
|
| VCID-8u4y-zrhv-8fe9 | Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0887
|
| VCID-8uk6-x62z-uybr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-2505
|
| VCID-8v2e-2y19-d3fc | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13024
|
| VCID-8v6f-5kdt-9qam | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29974
|
| VCID-8v6z-1ktm-jygr | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23602
|
| VCID-8vka-qus2-tbhj | Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, Firefox ESR < 115.32.1, Thunderbird < 140.7.2, and Thunderbird < 147.0.2. |
CVE-2026-2447
|
| VCID-8vn5-q4h7-ffa6 | If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent file: URL. |
CVE-2018-5182
|
| VCID-8wa6-ce1p-fbh8 | In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage of sites visited during private browsing sessions. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.* |
CVE-2018-12400
|
| VCID-8wgm-j522-4yac | An out-of-bounds write in Graphite might allow remote attackers to execute arbitrary code. |
CVE-2017-5436
|
| VCID-8wuh-f43p-efee | Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances. This could allow the development tools panel for the extension to load a URL that it should not be able to access, including potentially privileged pages. |
CVE-2018-5112
|
| VCID-8x12-urec-77e2 | When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.*This bug only affects Firefox on MacOS. Other operating systems are unaffected.* |
CVE-2021-4128
|
| VCID-8xek-k5y2-6bfp | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4689
|
| VCID-8xkk-qc7d-fqg2 | Mozilla developers and community members Philipp, Diego Calleja, Mikhail Gavrilov, Jason Kratzer, Christian Holler, Markus Stange, Tyson Smith reported memory safety bugs present in Firefox 70. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2019-17013
|
| VCID-8xz8-qent-zkav | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5260
|
| VCID-8y7u-dhmg-j3ch | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2838
|
| VCID-8ztk-5sbf-6kez | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15673
|
| VCID-8zy6-g8kn-hbdc | Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2775
|
| VCID-92b6-64g1-3kbn | When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* |
CVE-2025-0244
|
| VCID-92j3-c6tu-tkc9 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1955
|
| VCID-92qb-fqpr-27hm | A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. |
CVE-2019-9820
|
| VCID-935y-sfuq-qqgh | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5263
|
| VCID-93au-w2zh-3yhg | Integer overflow in the SVG component. This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10533
|
| VCID-942z-zc2a-n3cc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-45413
|
| VCID-94py-4f6r-gbf9 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1952
|
| VCID-957q-jagj-9kg7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7527
|
| VCID-95bb-qys4-tyar | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-28160
|
| VCID-95g4-dcau-6bd1 | The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. |
CVE-2025-1019
|
| VCID-95qq-zty2-2qa8 | A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability is limited because the memory is freed and reused in a brief window of time during the freeing of the same callstack. |
CVE-2018-5180
|
| VCID-95vw-esba-23a2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1937
|
| VCID-962a-dwqf-3ycg | Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13016
|
| VCID-96tr-zf8q-gkfu | An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. |
CVE-2023-49061
|
| VCID-98mt-7srw-qfh4 | A vulnerability has been discovered in libvpx, which could lead to execution of arbitrary code. |
CVE-2025-5283
|
| VCID-98q2-wb23-y3b4 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1741
|
| VCID-996p-a498-tycp | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0749
|
| VCID-99qv-vm84-eqau | Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. |
CVE-2022-46883
|
| VCID-9bth-c8sa-mkdk | An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the referrerpolicy attribute. |
CVE-2023-49060
|
| VCID-9c98-7zzd-p3f8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12396
|
| VCID-9caj-c15z-xuf5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9403
|
| VCID-9cje-24ah-p7fk | A content security policy (CSP) frame-ancestors directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. |
CVE-2017-7808
|
| VCID-9dmp-uv8y-suau | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5699
|
| VCID-9dpt-xfu6-cuh5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4580
|
| VCID-9e85-bdkj-zyf3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25751
|
| VCID-9fsb-vzuc-efc5 | A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. |
CVE-2016-9894
|
| VCID-9fxa-6w88-y3h4 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5268
|
| VCID-9g5z-mhve-8ye8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to remote code execution. |
CVE-2024-1556
|
| VCID-9gcc-mnu4-jkf5 | Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147 and Thunderbird < 147. |
CVE-2026-0889
|
| VCID-9gcq-8grt-vfhc | A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. |
CVE-2016-9070
|
| VCID-9h1s-hhn8-9ydy | Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. |
CVE-2024-26282
|
| VCID-9h4y-xcex-1fch | WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. |
CVE-2018-18495
|
| VCID-9hep-yqmw-8bg4 | When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default. *Note: This issue only affects 64-bit Windows. 32-bit Windows and other operating systems are unaffected.* |
CVE-2016-9072
|
| VCID-9k9g-4cxt-3faj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7754
|
| VCID-9kc8-k5kc-u7em | Firefox incorrectly accepted a newline in a HTTP/3 header, interpreting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. |
CVE-2021-29991
|
| VCID-9kps-5e3g-v7hb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11718
|
| VCID-9rm3-u7dy-zuhu | Same-origin policy bypass in the Graphics: Canvas2D component. |
CVE-2025-9180
|
| VCID-9saf-1zax-5ycy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6865
|
| VCID-9tc4-qr6d-6kfu | When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. |
CVE-2020-15654
|
| VCID-9tdt-84zg-3fd7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31742
|
| VCID-9the-k9nt-4bdg | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-34416
|
| VCID-9tkb-9fch-67bc | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-1802
|
| VCID-9tnj-j5xv-43cm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-36318
|
| VCID-9tnr-m8mg-3ffw | Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system.*This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.* |
CVE-2025-5265
|
| VCID-9u64-4cr7-w3e1 | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3677
|
| VCID-9v4g-hwwe-3ybg | Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2019-17025
|
| VCID-9vy1-km8x-9fd3 | firefox: Heap use-after-free in nsINode::ReplaceOrInsertBefore |
CVE-2016-9069
|
| VCID-9x81-rf7u-yyhg | Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-4729
|
| VCID-9xv3-q3p3-ukap | Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remote attackers to cause a denial of service (application crash) via a large HTML file that loads a DOM call from within nested DIV tags, which causes part of the currently rendering page and referenced objects to be deleted. |
CVE-2005-2414
|
| VCID-9y48-sjn7-rqeu | Mozilla developers and community members Kevin Brosnan, Mihai Alexandru Michis, and Christian Holler reported memory safety bugs present in Thunderbird 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-38501
|
| VCID-9ym2-agp7-budj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23601
|
| VCID-9z19-npd3-sbar | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. |
CVE-2020-15682
|
| VCID-9z3s-qfbc-vbdc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6859
|
| VCID-9zxb-j4ep-n7g9 | Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2791
|
| VCID-a2as-nfu2-ykax | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32214
|
| VCID-a2k9-85qx-u7cy | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9788
|
| VCID-a2nq-ss2f-bqac | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29917
|
| VCID-a2x3-x693-gqdf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23984
|
| VCID-a3g7-atnx-jyg4 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6869
|
| VCID-a3hz-rgbm-ybdf | Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-14861
|
| VCID-a4cx-2k56-23db | Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-8040
|
| VCID-a5dv-qhc6-pqb5 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1740
|
| VCID-a659-299u-byfb | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29986
|
| VCID-a66n-msy9-d3f9 | Mozilla developers Tyson Smith, Aaron Klotz, David Major and Jason Kratzer reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-26969
|
| VCID-a68p-hcz6-jffj | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.*Note: this issue only affects Firefox on Windows operating systems.* |
CVE-2020-12388
|
| VCID-a6wm-rraf-gbh9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6831
|
| VCID-a79m-8sp3-v3dh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12360
|
| VCID-a7q5-uxwb-dfh9 | run-mozilla.sh in Thunderbird, with debugging enabled, allows local users to create or overwrite arbitrary files via a symlink attack on temporary files. |
CVE-2005-2353
|
| VCID-a8gt-y9j7-zuhs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29548
|
| VCID-a8vw-n16x-duee | Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. |
CVE-2025-5264
|
| VCID-a98z-hwzc-wkcj | Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0882
|
| VCID-a9b9-3zxy-hubc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12409
|
| VCID-a9j8-ync3-jfgy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5758
|
| VCID-aaju-2u3m-77dh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23962
|
| VCID-abh6-ejxb-k7be | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0292
|
| VCID-abt2-6a7f-pfba | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3864
|
| VCID-aby2-r7bt-vybb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23977
|
| VCID-acgm-1xtc-mkdq | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1790
|
| VCID-adfd-zkn8-3fgd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5156
|
| VCID-aeku-1hmt-akbc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4764
|
| VCID-aemu-emvp-hkfh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10460
|
| VCID-af5n-5ye1-s3fd | Mozilla Firefox before 3.6 is vulnerable to XSS via the rendering of Cascading Style Sheets |
CVE-2011-2670
|
| VCID-af6b-4jqc-fugx | The mozAddonManager allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. |
CVE-2017-5393
|
| VCID-ag5p-n7es-v7gh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28176
|
| VCID-ag97-q79a-xbgb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23605
|
| VCID-ahzj-vepp-r3f4 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31744
|
| VCID-ahzr-nr7g-5ue2 | A STUN server in conjunction with a large number of webkitRTCPeerConnection objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems, allowing for a denial of service attack. |
CVE-2017-5388
|
| VCID-ajzf-jj8y-3ue3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25729
|
| VCID-ajzz-xqu4-y7fe | When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatch in some situations. |
CVE-2018-18503
|
| VCID-ak2m-xsvt-eqbs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15652
|
| VCID-akhr-nck5-sfh2 | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.This bug only affects Thunderbird for Windows. Other operating systems are unaffected.* |
CVE-2022-36314
|
| VCID-akrk-hjgk-5kbz | Spoofing issue in the Site Permissions component. This vulnerability affects Firefox < 143 and Thunderbird < 143. |
CVE-2025-10534
|
| VCID-akwm-tx92-bqfs | Mozilla Firefox through 1.5.0.3 has a vulnerability in processing the content-length header |
CVE-2011-2668
|
| VCID-an3w-wb6n-zuee | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45410
|
| VCID-anuu-bk6v-93ec | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2777
|
| VCID-ap6c-9pta-wbdz | security update |
CVE-2016-1951
|
| VCID-ap8s-63rs-jyff | If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. |
CVE-2019-17020
|
| VCID-apes-5sa9-w7gd | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0755
|
| VCID-aquh-9cjg-wyey | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46877
|
| VCID-as4y-nhw6-akfx | A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. |
CVE-2025-4087
|
| VCID-as8g-vnyj-u7hk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29539
|
| VCID-asw1-t3mj-2kem | URLs using javascript: have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the javascript: URL the protocol is not removed and the script will execute. This could allow users to be socially engineered to run an XSS attack against themselves. |
CVE-2018-5143
|
| VCID-avgs-nz9j-gqg8 | On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. |
CVE-2025-1930
|
| VCID-avqy-uk9j-2kev | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37209
|
| VCID-avw6-7aqv-hbaa | Multiple vulnerabilities have been found in Mozilla SeaMonkey, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-9079
|
| VCID-aw1p-efnf-57e1 | Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page |
CVE-2025-27424
|
| VCID-awnf-jwg6-k3bk | Mozilla Developer Rob Wu discovered that a redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. |
CVE-2020-15655
|
| VCID-awue-n9ua-hfej | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7757
|
| VCID-ax8a-z9s4-e3dk | A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.* |
CVE-2019-9794
|
| VCID-axd2-wt2a-fqcn | WebExtensions with the ActiveTab permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with this permission. |
CVE-2018-5116
|
| VCID-axtu-gujv-rfgk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12410
|
| VCID-azdd-vdn3-kffy | Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2758
|
| VCID-azpr-25fb-5qba | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6871
|
| VCID-b3jt-7h5q-vqgd | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1546
|
| VCID-b3rg-quvp-2uha | A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. |
CVE-2025-4083
|
| VCID-b3rt-2zdj-4bct | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26382
|
| VCID-b3uc-t8zd-2kbs | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1949
|
| VCID-b3zg-y242-xybq | If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. |
CVE-2024-4767
|
| VCID-b4bq-q3ga-3ff1 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4707
|
| VCID-b4dv-raac-tkf1 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5259
|
| VCID-b4fq-m97e-eybr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12418
|
| VCID-b5jm-57h2-2qcs | JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2764
|
| VCID-b5y9-qmw5-nkbv | If an attacker could find a way to trigger a particular code path in SafeRefPtr, it could have triggered a crash or potentially be leveraged to achieve code execution. |
CVE-2024-2612
|
| VCID-b65s-fwk5-gkbs | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2827
|
| VCID-b67z-91x3-sug1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11764
|
| VCID-b6sf-z5tm-4uau | Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4696
|
| VCID-b6ug-rdyx-4uaw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8900
|
| VCID-b7sc-ty24-k7gj | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4765
|
| VCID-b828-9v26-aqbv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22755
|
| VCID-b87w-p2r8-9uc2 | An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. |
CVE-2018-5109
|
| VCID-b8c2-qrxm-sybt | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38508
|
| VCID-b8dx-232z-qbbc | Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2779
|
| VCID-b8qk-zbj4-yfg2 | When setting a thread name on Windows in WebRTC, an incorrect number of arguments could have been supplied, leading to stack corruption and a potentially exploitable crash. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-13722
|
| VCID-b8xy-bqk8-dyf5 | Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-6436
|
| VCID-b911-qnc2-x3aj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38509
|
| VCID-b9aw-u5wp-6uhk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5693
|
| VCID-ba5x-yqnr-83h3 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to remote code execution. |
CVE-2024-1554
|
| VCID-bae9-9f51-wqac | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11760
|
| VCID-bapg-hzuc-ykby | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4575
|
| VCID-baq3-sm51-3qae | An error in the WindowsDllDetourPatcher where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. *Note: This attack only affects Windows operating systems. Other operating systems are not affected.* |
CVE-2017-7782
|
| VCID-bb61-y349-fqgx | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5266
|
| VCID-bbsb-t7kv-4bbw | Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. |
CVE-2016-2815
|
| VCID-bc7q-srps-sfd7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29541
|
| VCID-bccq-jn4j-8qd8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-16541
|
| VCID-bd3j-r1wt-dyf4 | Security researcher sushi Anton Larsson reported that when paired fullscreen and pointerlock requests are done in combination with closing windows, a pointerlock can be created within a fullscreen window without user permission. This pointerlock cannot then be cancelled without terminating the browser, resulting in a persistent denial of service attack. This can also be used for spoofing and clickjacking attacks against the browser UI. |
CVE-2016-2831
|
| VCID-bd7t-psdb-qqfw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23974
|
| VCID-bdu3-hre7-9uej | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4571
|
| VCID-bf98-7vgs-zubp | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29547
|
| VCID-bfdm-fkfv-nfch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12365
|
| VCID-bfg9-wdyu-9qbh | WebExtensions can bypass normal restrictions in some circumstances and use browser.tabs.executeScript to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged about: pages. |
CVE-2018-5135
|
| VCID-bj2j-3fjg-yyhr | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2782
|
| VCID-bjny-apx2-8ba1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11695
|
| VCID-bjyq-1zfk-eugq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5383
|
| VCID-bk86-keag-kfg8 | Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect from HTTPS to HTTP, allowing content that should be blocked, such as scripts, to be loaded on a page. |
CVE-2017-7835
|
| VCID-bm8j-1dxt-q3a8 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5103
|
| VCID-bnsn-65aa-efb8 | Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143.0.3. |
CVE-2025-11152
|
| VCID-bp4q-baaa-t7at | A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the main thread while cancelling fetch operations. |
CVE-2018-5092
|
| VCID-bp6q-cu6s-2ke7 | Mozilla developers and community members reported several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. |
CVE-2016-2818
|
| VCID-bpsj-5ap7-zuhq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5097
|
| VCID-bqyj-qnak-eydy | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43543
|
| VCID-brmh-yppw-tqbh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-34417
|
| VCID-bshu-jxhj-27b8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5700
|
| VCID-bsnh-1chq-z7ae | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9400
|
| VCID-bsz8-aq12-73cj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11725
|
| VCID-bt2a-qhce-zqcc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-7530
|
| VCID-bva6-xgue-q3dh | In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. *Note: This issue only affects macOS. Other operating systems are unaffected.* |
CVE-2019-9804
|
| VCID-bw96-5g6y-j3c4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6860
|
| VCID-bwk4-hqx8-97dy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10459
|
| VCID-bwm1-yauc-xudu | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2801
|
| VCID-bxdr-5t7k-rbdn | The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms.*Update: The 52.7.2 source release accidentally did not include this patch (the Mozilla-produced 52.7.2 binaries are fine). Anyone building 52.7.2 on ARM should use revision 5cd5586a2f48424a9031a3fa4c782954a9df9a52 instead of the released source. |
CVE-2018-5147
|
| VCID-bxgd-f6n7-r3cj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29972
|
| VCID-bxng-uq7z-hubn | The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances, allowing for potential man-in-the-middle attacks on the linked resources. |
CVE-2019-9803
|
| VCID-bxrh-7kwf-p3at | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40956
|
| VCID-bxxh-v75g-5yez | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29540
|
| VCID-by1g-8wvm-ffgt | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11721
|
| VCID-byhb-42wc-xff5 | The implementation of E4X introduced an internal "AnyName" object which was unintentionally exposed to web content. This singleton object could be used by two cooperating domains as a communication channel to get around same-origin restrictions that prevent direct access from one window or frame to another. This could not be used to violate same-origin protection of another window's content, it was simply a mutually accessible storage spot. E4X was not supported in Firefox 1.0 or Mozilla 1.7Thunderbird 1.5 could be vulnerable if JavaScript is enabled in mail. This is not the default setting and we strongly discourage users from turning on JavaScript in mail. Thunderbird is not vulnerable in its default configuration.Update (13 April 2006) This flaw has been fixed in Thunderbird 1.5.0.2 |
CVE-2006-0299
|
| VCID-bzgb-mdsk-yua6 | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. |
CVE-2025-1009
|
| VCID-c11z-6f9c-3bb5 | A mechanism to spoof the addressbar through the user interaction on the addressbar and the onblur event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. |
CVE-2017-5451
|
| VCID-c2kz-qw3v-eqbz | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5262
|
| VCID-c33s-zggk-qkaz | Multiple vulnerabilities have been reported in Mozilla Firefox. |
CVE-2006-5462
|
| VCID-c3ex-zw8a-6bcy | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5257
|
| VCID-c4pj-vwxp-tfb8 | Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6503
|
| VCID-c4qs-a9kw-p3hc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2019-17017
|
| VCID-c51s-yenc-4yab | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38504
|
| VCID-c52k-tg8d-sbeg | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23599
|
| VCID-c576-h945-7kby | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability affects Firefox < 143 and Thunderbird < 143. |
CVE-2025-10531
|
| VCID-c5b5-beuj-z3gh | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40959
|
| VCID-c5q7-x23j-bkha | A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a maliciously crafted path string to reference the resources. *Note: this vulnerability does not affect WebExtensions.* |
CVE-2018-5137
|
| VCID-c6jc-3917-x7dx | Security researcher Tim McCormack reported that when a page requests a series of permissions in a short timespan, the resulting permission notifications can show the icon for the wrong permission request. This can lead to user confusion and inadvertent consent given when a user is prompted by web content to give permissions, such as for geolocation or microphone access. |
CVE-2016-2829
|
| VCID-c6rx-p235-9bdz | Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-10537
|
| VCID-c7sb-zust-e7f9 | Tor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68. |
CVE-2019-13075
|
| VCID-c83b-ttr4-83em | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2797
|
| VCID-c8p3-ef58-wudt | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5376
|
| VCID-c9mk-pbph-jfbn | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28287
|
| VCID-c9pz-t1b3-ykf2 | Firefox for Android allowed a sandboxed iframe without the allow-downloads attribute to start downloads. |
CVE-2025-8042
|
| VCID-ccbk-bcjn-9ygr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11740
|
| VCID-ccev-4z5c-u3hj | Mozilla developers Christian Holler, Jan-Ivar Bruaroey, and Gabriele Svelto reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-35114
|
| VCID-ccz8-tmpe-wker | Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-13027
|
| VCID-ce3x-bw1m-jyf4 | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-18506
|
| VCID-cede-kbgf-8bgd | Mozilla developers Christian Holler and Lars T Hansen reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-38494
|
| VCID-cejz-671b-wyga | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-23604
|
| VCID-cfqv-7r6b-g3e9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4576
|
| VCID-cfy8-73k1-jkdj | The Mozilla Maintenance Service helper.exe application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-7761
|
| VCID-cggq-6c2f-1qf4 | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2778
|
| VCID-cgvg-aj53-kkbp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-0767
|
| VCID-ch3v-nq5w-3fg4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37202
|
| VCID-cj16-a2tv-cqd7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4574
|
| VCID-cmnc-fyxb-rfd4 | An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash.*This bug only affects Firefox for macOS. Other operating systems are unaffected.* |
CVE-2023-29531
|
| VCID-cmr4-6stm-jfe9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7524
|
| VCID-cpez-x3zd-p7bu | Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2785
|
| VCID-cpra-u2v5-3qg5 | An attack using manipulation of updater.ini contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-7766
|
| VCID-cqm9-yqqx-t3ds | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29537
|
| VCID-cqpd-wav4-pubn | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26381
|
| VCID-cqtb-7t8w-rug2 | A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. |
CVE-2016-5287
|
| VCID-cr2w-ffbf-rfdu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5729
|
| VCID-csm4-qspw-83da | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5188
|
| VCID-cszr-1fu2-6be5 | Mozilla developers and community members Alex Gaynor, André Bargull, Boris Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Philipp, Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-12406
|
| VCID-ctgf-rds5-4fda | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12396
|
| VCID-ctme-czwh-3yf3 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29538
|
| VCID-cupx-f8h2-dbfw | WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. |
CVE-2019-11748
|
| VCID-cver-m3d6-rkhp | If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26964
|
| VCID-cxxg-uk18-pqhq | A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. |
CVE-2017-7821
|
| VCID-cypj-1jsu-cbh5 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-1016
|
| VCID-cz9e-m77e-bbdx | Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-5272
|
| VCID-czs9-72n5-z3ap | Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2805
|
| VCID-d194-2uh4-pug1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22743
|
| VCID-d25k-36fw-67af | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks |
CVE-2024-10474
|
| VCID-d2fm-vmeb-xuh9 | Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. |
CVE-2025-5271
|
| VCID-d2xh-7g2m-s3a9 | Mozilla developers Byron Campen and Christian Holler reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-15674
|
| VCID-d34y-zjxp-9ugj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29977
|
| VCID-d3n9-h8yh-r3ds | Mozilla Firefox 1.0.1 and possibly other versions, including Mozilla and Thunderbird, allows remote attackers to spoof the URL in the Status Bar via an A HREF tag that contains a TABLE tag that contains another A tag. |
CVE-2005-4809
|
| VCID-d4bx-x9pb-8kfx | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5150
|
| VCID-d5hs-m1zz-kybj | The destructor function for the WindowsDllDetourPatcher class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. *Note: This attack only affects Windows operating systems. Other operating systems are not affected.* |
CVE-2017-7804
|
| VCID-d636-k6r3-skez | Mozilla developers and community members Christian Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan Varga, Marcia Knous, André Bargull, and Philipp reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2019-9814
|
| VCID-d7jf-wx4p-cuek | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7807
|
| VCID-d9dm-aww1-pfbm | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5253
|
| VCID-d9vf-maye-6ff7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22745
|
| VCID-d9z7-npfz-53a8 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2837
|
| VCID-daaa-zra4-w7hz | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-23600
|
| VCID-db28-rbyf-1qf4 | Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14329
|
| VCID-dcjm-7xcr-ayew | Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-5268
|
| VCID-dck1-2x3v-1ygr | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7792
|
| VCID-dcw1-cagp-mkd5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34480
|
| VCID-ddem-1dt1-uff7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38503
|
| VCID-ddhz-4wa1-zke9 | A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. |
CVE-2020-15647
|
| VCID-ddwf-z514-hbbj | Information disclosure in the Networking: Cache component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10536
|
| VCID-de4g-6sjv-6ugg | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2820
|
| VCID-de9v-k2u9-tbhk | The contextual menu for links could provide an opportunity for cross-site scripting attacks |
CVE-2024-43113
|
| VCID-dedv-96fb-vyhp | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29967
|
| VCID-deth-9krh-kufj | Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0890
|
| VCID-dg61-9h8j-tkfj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29916
|
| VCID-dgwm-n1zx-qkbq | Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13012
|
| VCID-dgxf-c2sb-5qds | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0247
|
| VCID-dh3c-g3k3-zkb7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7805
|
| VCID-dh5k-q87q-4qfs | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11696
|
| VCID-dhed-rfz6-ffe9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26951
|
| VCID-dher-5g6m-yuev | Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-23957
|
| VCID-dhsg-zyny-5ybq | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. *This vulnerability only affects Firefox for Android.* |
CVE-2018-12382
|
| VCID-dhy3-wnzu-x7dw | Unspecified versions of Mozilla Firefox allow remote attackers to cause a denial of service (crash) via a web page that contains a large number of nested marquee tags. NOTE: a followup post indicated that the initial report could not be verified. |
CVE-2006-2723
|
| VCID-dhyh-m8p3-ebdq | SVG loaded through <img> tags can use <meta> tags within the SVG data to set cookies for that page. |
CVE-2017-7837
|
| VCID-dk4z-1j37-aucx | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1979
|
| VCID-dmnj-pt27-3bge | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9391
|
| VCID-dq19-byye-fuag | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34469
|
| VCID-dqhd-ay8b-wfam | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31740
|
| VCID-dqm3-dse4-8bap | When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. |
CVE-2020-6808
|
| VCID-drcd-xhd2-27hn | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9793
|
| VCID-drjc-gxrt-q7ha | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7520
|
| VCID-ds2y-kn7q-vuct | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10464
|
| VCID-dsaw-xa6k-4yfw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26968
|
| VCID-dsqp-sd8u-97et | Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6500
|
| VCID-dsr3-cavn-73bt | Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-3847
|
| VCID-dsuj-fmtr-cbft | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5432
|
| VCID-du2f-xvxg-4bbf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11709
|
| VCID-dukt-jk3k-wqht | When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.**Note: This issue is a different issue from CVE-2025-0244. |
CVE-2025-0246
|
| VCID-dv2d-9a59-xkaq | Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. |
CVE-2017-5384
|
| VCID-dvcv-fgk6-buet | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5277
|
| VCID-dvd1-3gbf-d3gw | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3806
|
| VCID-dve2-6prj-mqbr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12415
|
| VCID-dveb-sthz-bkgu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25738
|
| VCID-dwks-skxt-zkg1 | Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2795
|
| VCID-dxaw-2u95-nfbs | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38474
|
| VCID-dxr7-qubc-tyb7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5401
|
| VCID-dxwp-5jfs-nuew | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2778
|
| VCID-dy9a-9mc6-hfbc | A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.) |
CVE-2021-29955
|
| VCID-dydk-9hwf-4ka4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7793
|
| VCID-dyeg-enk8-cqbe | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38475
|
| VCID-dyn7-63ve-37at | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2813
|
| VCID-dzdd-y6rv-dbe2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6614
|
| VCID-e2k8-m9sm-8uek | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4699
|
| VCID-e2ww-ngam-cugq | The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename. |
CVE-2017-5381
|
| VCID-e36h-6n36-puht | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7814
|
| VCID-e38r-grgp-rfbn | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23998
|
| VCID-e3j5-kyhm-7ye1 | When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. |
CVE-2020-15667
|
| VCID-e43t-3b7n-c3bj | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. |
CVE-2017-5454
|
| VCID-e48r-fz4d-77c3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37203
|
| VCID-e4mx-ww79-1bau | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5274
|
| VCID-e4nx-qfam-cfaj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46872
|
| VCID-e4pk-uyeh-xfgk | The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the same accent as a second character with most font sets. This allows for domain spoofing attacks because these combined domain names do not display as punycode. |
CVE-2017-7832
|
| VCID-e6bs-vk6j-h3e6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6206
|
| VCID-e6xd-fmsu-jkgn | A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as <input type="file">) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. |
CVE-2021-24000
|
| VCID-e7jk-vs8y-fyhr | Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13020
|
| VCID-e7p8-zrwx-5ug6 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing "Esc" or accessing right-click menus, resulting in a disrupted browsing experience until the browser is restarted. *This bug only affects the application when running on macOS. Other operating systems are unaffected.* |
CVE-2024-11698
|
| VCID-eaau-g1uf-73gd | A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable crash. |
CVE-2017-7806
|
| VCID-eauw-p8kn-yqdt | Multiple vulnerabilities have been reported in the SeaMonkey project, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6504
|
| VCID-ebcq-pvj7-fbe4 | Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-9187
|
| VCID-ebhp-kzkz-euhu | Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. *This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.* |
CVE-2023-29545
|
| VCID-ebus-cbbm-u3dn | Mozilla developers and community members Ryan VanderMeulen, Sean Feng, Tyson Smith, Julian Seward, Christian Holler reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-29947
|
| VCID-ebzs-h9p8-tbb4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7830
|
| VCID-ec2q-au5k-vucq | Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-8044
|
| VCID-eccp-16z6-9ug3 | Long pressing on a download link could potentially provide a means for cross-site scripting |
CVE-2024-43112
|
| VCID-ecm1-2298-mkfm | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2799
|
| VCID-ecmf-7x8a-jugv | A segmentation fault can occur during some bidirectional layout operations. |
CVE-2017-5413
|
| VCID-ecs2-1xkw-wkga | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3855
|
| VCID-eeny-3ab1-a3g3 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1730
|
| VCID-ef4k-zer6-bfcz | When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded. This allows for phishing attacks where a malicious page can spoof the identify of another site. |
CVE-2018-5111
|
| VCID-efsu-6f8m-93en | The Mozilla Foundation has reported numerous vulnerabilities in Mozilla Firefox, including one that may allow execution of arbitrary code. |
CVE-2006-4569
|
| VCID-efvs-1tuf-guf4 | Information disclosure in the Widget: Cocoa component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4712
|
| VCID-eget-cyhz-xbhr | Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the arbitrary execution of code. |
CVE-2020-16044
|
| VCID-eh1p-amew-hydf | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5264
|
| VCID-ehj2-vyp5-x3fa | Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2803
|
| VCID-emmz-dq8m-sfct | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5261
|
| VCID-epbu-sqny-23ez | Use-after-free in the Audio/Video: GMP component. This vulnerability affects Firefox < 146 and Thunderbird < 146. |
CVE-2025-14326
|
| VCID-er9k-vh29-tyed | Private browsing mode leaves metadata information, such as URLs, for sites visited in browser.db and browser.db-wal files within the Firefox profile after the mode is exited. *Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected.* |
CVE-2016-9062
|
| VCID-ervb-z282-7kdy | When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elements other than those that it injected into the page. This would lead to internal errors and unexpected behavior in the Screenshots code. |
CVE-2020-26967
|
| VCID-erx8-1tfq-kyce | Mozilla developers and community members Carsten Book, Calixte Denizet, Christian Holler, Andrew McCreight, David Bolter, David Keeler, Jon Coppeard, Tyson Smith, Ronald Crane, Tooru Fujisawa, Ben Kelly, Bob Owen, Jed Davis, Julian Seward, Julian Hector, Philipp, Markus Stange, and André Bargull reported memory safety bugs present in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-5399
|
| VCID-esw4-827s-u3f1 | When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin. |
CVE-2024-4769
|
| VCID-etfm-p55m-eyb7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12408
|
| VCID-ev18-anej-zbap | Security researcher Jordi Chancel reported a method to spoof the contents of the addressbar. This uses a persistent menu within a <select> element, which acts as a container for HTML content and can be placed in an arbitrary location. When placed over the addressbar, this can mask the true site URL, allowing for spoofing by a malicious site. |
CVE-2016-2822
|
| VCID-evxv-m7xn-h7aj | Certain canvas operations could have lead to memory corruption. |
CVE-2025-49709
|
| VCID-ewet-6xtr-sqdn | Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates. |
CVE-2011-2669
|
| VCID-ewqm-puf8-hkbv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5168
|
| VCID-ewxs-dh9a-mugn | When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. |
CVE-2025-6432
|
| VCID-ex1b-2rdy-7qhw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-17005
|
| VCID-ey7f-q2ks-g3fr | Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. |
CVE-2025-11721
|
| VCID-eyaw-nzuh-8ue2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5130
|
| VCID-eyf6-1map-zbdz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12395
|
| VCID-eyrw-5dmv-pqfe | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22764
|
| VCID-ez4g-384r-vueu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25745
|
| VCID-f1bq-hn88-fkbz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7843
|
| VCID-f1zm-g4es-vfbz | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0239
|
| VCID-f2nr-z7k3-hya5 | An interaction between XUL content windows and the new faster history mechanism in Firefox 1.5 caused those windows to become translucent. This could be used to construct spoofs that could trick users into interacting with browser UI they can't see. It's possible a clever game-type presentation could persuade an unsuspicious user into some combination of actions that would result in running the attacker's code.Firefox 1.0 and the Mozilla Suite 1.7 are not vulnerable. |
CVE-2006-1725
|
| VCID-f2tn-1hq4-uffa | An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. |
CVE-2025-9179
|
| VCID-f2z3-egzk-efgj | If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown origin" as the requestee, leading to user confusion about which site is asking for this permission. |
CVE-2019-9808
|
| VCID-f3ws-d8fh-9ucz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26959
|
| VCID-f4ja-2ydw-cufu | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2024-11693
|
| VCID-f4pn-vjxk-ybfx | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12379
|
| VCID-f4xy-kftc-mug2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32207
|
| VCID-f5dh-8kx7-vbfq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5441
|
| VCID-f5dq-hbnp-c7b2 | An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. |
CVE-2025-4085
|
| VCID-f5w8-j656-akf4 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-1017
|
| VCID-f5xg-bk9w-fkbe | Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2022-46885
|
| VCID-f6qv-znt2-2bd5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6863
|
| VCID-f79a-dxkf-8yeu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12361
|
| VCID-f7ut-fqny-tffr | JavaScript in the about:webrtc page is not sanitized properly being assigned to innerHTML. Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. |
CVE-2017-7799
|
| VCID-f7zd-nx3e-tba1 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7771
|
| VCID-f8c7-p8nz-bbap | A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server.*Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2023-29532
|
| VCID-f8fw-f3kt-8feb | Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6514
|
| VCID-f8wd-xgwu-8kgm | Canvas allows the use of the feDisplacementMap filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. |
CVE-2016-9077
|
| VCID-f9dc-n2bd-gqdt | A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. |
CVE-2017-5449
|
| VCID-f9yy-d81z-1fgz | Starting in Firefox 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. |
CVE-2025-11719
|
| VCID-fa1y-hpcb-27gj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22760
|
| VCID-fbf2-xqep-kyhg | Mozilla allows remote attackers to cause a denial of service (CPU consumption) via a Javascript BODY onload event that calls the window function. |
CVE-2005-3896
|
| VCID-fcvd-rpmu-1ygk | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5131
|
| VCID-fdue-dg92-13cp | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5146
|
| VCID-ffd7-y29n-6fan | XSLT document loading did not correctly propagate the source document which bypassed its CSP. |
CVE-2025-8032
|
| VCID-fg7v-fypu-k3h4 | Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values. |
CVE-2024-2606
|
| VCID-fgk1-cfpw-pfdn | When typing in a password under certain conditions, a race may have occurred where the InputContext was not being correctly set for the input field, resulting in the typed passwod being saved to the keyboard dictionary. |
CVE-2020-15671
|
| VCID-fgnu-kh7z-xuau | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9902
|
| VCID-fgsw-665h-f7f7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29551
|
| VCID-fh2h-bzfd-fqh8 | The Mozilla Firefox 1.5 line is vulnerable to a buffer overflow in the JavaScript extension which may in theory lead to remote execution of arbitrary code. |
CVE-2006-1993
|
| VCID-fj49-kvwy-bycm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-1919
|
| VCID-fjam-jfc1-pkbv | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2795
|
| VCID-fmub-ph5x-pbdu | Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them. *Note: This issue only affects Firefox 49 and 50.* |
CVE-2016-9078
|
| VCID-fpt6-rk5a-1yfj | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1737
|
| VCID-fpw1-j3wb-xfd5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45408
|
| VCID-fqmm-499j-nyc3 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2830
|
| VCID-fr2x-ad9j-jyej | If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any javascript: URIs will be allowed. This could allow for malicious JavaScript content to be run, bypassing CSP permissions. |
CVE-2019-11738
|
| VCID-frbm-3qry-eygz | IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. |
CVE-2020-12414
|
| VCID-frvc-mqhd-eydh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6601
|
| VCID-fsff-rm4y-wudc | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2780
|
| VCID-fsvy-jfhn-1ydz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12419
|
| VCID-ft6u-geds-fua9 | JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4702
|
| VCID-ftfg-b795-qyan | If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. |
CVE-2019-17014
|
| VCID-ftjt-28gr-eqaw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23972
|
| VCID-ftv9-7sum-17hm | For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. |
CVE-2020-12404
|
| VCID-fvp8-grcg-27d3 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2812
|
| VCID-fw8f-1wt7-afdb | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1045
|
| VCID-fwr3-cgq1-a3b4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6204
|
| VCID-fx8t-41tv-hkdu | Use After Free png_image_free in png.c in libpng has a use-after-free because png_image_free_function is called under png_safe_execute. |
CVE-2019-7317
|
| VCID-fxnj-rr7h-ryb5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46880
|
| VCID-fxx3-xfat-m3bx | An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. |
CVE-2019-17000
|
| VCID-fxyr-h69x-fybu | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3809
|
| VCID-fyrx-ttkj-byc8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-25750
|
| VCID-g1af-pkh5-xygt | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25742
|
| VCID-g24d-23zk-6fgn | AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. |
CVE-2024-2608
|
| VCID-g2et-bnvt-9fem | During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-17021
|
| VCID-g2jp-fq7y-kkcn | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11730
|
| VCID-g2m4-vtf4-yufx | An integer overflow was present in OrderedHashTable used by the JavaScript engine |
CVE-2025-49710
|
| VCID-g3mn-nhq4-zbhv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12424
|
| VCID-g3n8-mvdt-cqdj | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3029
|
| VCID-g3nf-qnz2-h7gg | Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. |
CVE-2019-9817
|
| VCID-g45q-v1td-9qcz | If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data. |
CVE-2019-9802
|
| VCID-g4m8-vzbp-cqgq | A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. *Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected.* |
CVE-2016-9061
|
| VCID-g4vz-yx5u-s7br | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1742
|
| VCID-g4zh-9fuw-d3f1 | Denial-of-service in the XML component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4726
|
| VCID-g6zv-3s2h-67ee | When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. |
CVE-2025-11717
|
| VCID-g7fw-yt1c-fqht | Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the multipart/x-mixed-replace MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. |
CVE-2018-5164
|
| VCID-g83q-g16g-wqc2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34471
|
| VCID-g99d-51ht-kbhn | The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. |
CVE-2025-11720
|
| VCID-gbgr-rxhx-jkae | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1965
|
| VCID-gbsw-gmc4-uqad | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2811
|
| VCID-gcen-3yba-a3ht | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5375
|
| VCID-gcnq-avax-aqcv | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2776
|
| VCID-gcyz-532w-bfcy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0748
|
| VCID-gd3w-dp7g-c7bv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6866
|
| VCID-gdkx-hymn-qfbh | When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-17019
|
| VCID-geb6-buda-4fdb | Mozilla developers and community members Christoph Diehl, Christian Holler, Jon Coppeard, Jason Kratzer, Nathan Froyd, Paul Theriault, Ryan VanderMeulen, Tyson Smith, Sebastian Hengst, Byron Campen, Emilio Cobos Álvarez, Ronald Crane, and Phillipp reported memory safety bugs present in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-5151
|
| VCID-geqm-dd33-cuc5 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6607
|
| VCID-gf3v-rmys-syex | Response header name interning does not have same-origin protections and these headers are stored in a global registry. This allows stored header names to be available cross-origin. |
CVE-2017-7797
|
| VCID-gfdf-pxta-xbg1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12387
|
| VCID-gfj6-dsud-g3fh | Multiple vulnerabilities have been found in NSS, the worst of which may allow execution of arbitrary code. |
CVE-2017-5462
|
| VCID-gfve-nzmn-dbbd | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29914
|
| VCID-gh4v-p1jk-zkd6 | The Find API for WebExtensions can search some privileged pages, such as about:debugging, if these pages are open in a tab. This could allow a malicious WebExtension to search for otherwise protected data if a user has it open. |
CVE-2018-5132
|
| VCID-ghhu-atxz-8ya9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11708
|
| VCID-ghqe-gsw9-c3e4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32211
|
| VCID-gjvm-8v8y-d7c5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23982
|
| VCID-gjz8-f5gu-17f6 | A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage Access API. This enabled potential Cross-Site Request Forgery attacks across origins. |
CVE-2025-4088
|
| VCID-gkrs-1aat-efhf | A data: URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when data: documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. |
CVE-2017-7834
|
| VCID-gkva-6cu9-7keg | Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4692
|
| VCID-gne2-jk48-juhs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11707
|
| VCID-gnv6-wz2h-e3fj | A heap buffer overflow vulnerability may occur in WebAssembly when shrinkElements is called followed by garbage collection on memory that is now uninitialized. This results in a potentially exploitable crash. |
CVE-2018-5094
|
| VCID-gph4-xa9p-73fr | Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-4091
|
| VCID-gpjz-649k-f3he | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5696
|
| VCID-gqbc-wbhs-4bbx | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5256
|
| VCID-gqhc-h5p7-dyh1 | Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. |
CVE-2016-9903
|
| VCID-gr1m-pdaw-a3h1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12377
|
| VCID-gr9t-39mj-2bbe | Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6502
|
| VCID-gret-hn3p-5kbk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7531
|
| VCID-grjt-j4at-pqbp | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11692
|
| VCID-gs3s-s4zk-fyh4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37201
|
| VCID-gs89-ejt1-q7db | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2783
|
| VCID-gshc-3brh-c3dr | In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. |
CVE-2017-5416
|
| VCID-gu5n-35b2-a3am | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2839
|
| VCID-gw8k-uktt-1qft | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12358
|
| VCID-gxfx-4gxp-3kdw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34481
|
| VCID-gxza-vbmf-tke7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-25749
|
| VCID-gyf5-px5b-67dc | Multiple vulnerabilities have been reported in SeaMonkey, some of which may allow user-assisted arbitrary remote code execution. |
CVE-2007-0801
|
| VCID-gyt6-vfya-pueg | When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content. This could potentially be used for social engineering attacks. |
CVE-2019-9807
|
| VCID-h1bz-r5pa-9fbw | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. |
CVE-2025-0245
|
| VCID-h261-q8t7-n3cm | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3034
|
| VCID-h2gc-zk2a-1fg6 | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0884
|
| VCID-h2zq-ubdu-sqc8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5443
|
| VCID-h34x-5zq6-73a3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12369
|
| VCID-h35v-jbx8-kbgd | Mozilla Firefox 1.5.0.6 allows remote attackers to execute arbitrary JavaScript in the context of the browser's session with an arbitrary intranet web server, by hosting script on an Internet web server that can be made inaccessible by the attacker and that has a domain name under the attacker's control, which can force the browser to drop DNS pinning and perform a new DNS query for the domain name after the script is already running. |
CVE-2006-4561
|
| VCID-h497-r9w8-bkem | Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2797
|
| VCID-h4g9-czkw-97hw | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to remote code execution. |
CVE-2024-1555
|
| VCID-h4r6-jrxh-6kcf | JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. |
CVE-2020-15656
|
| VCID-h5ub-djvf-nffv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3302
|
| VCID-h63e-ngr6-zqee | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7772
|
| VCID-h6mx-yu5m-uygt | Mozilla developers Jason Kratzer, Tyson Smith, and Christian Holler reported memory safety bugs present in Firefox 72. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-6801
|
| VCID-h6yb-xsc5-7yck | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1959
|
| VCID-h75p-31wz-nbag | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6823
|
| VCID-h8q1-8w25-2yfz | When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have. |
CVE-2018-12399
|
| VCID-h9em-p9se-rucn | Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14321
|
| VCID-h9jv-54rr-6bd4 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4725
|
| VCID-hay5-714d-u7fd | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12405
|
| VCID-hb7d-bejp-eueu | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11711
|
| VCID-hccf-ueut-vugw | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14322
|
| VCID-hd7u-f91y-dqhz | An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result POINT_AT_INFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection, resulting in an attacked party computing an incorrect shared secret. |
CVE-2017-7781
|
| VCID-hd86-cja2-cud5 | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13022
|
| VCID-he63-5fub-yydv | Multiple vulnerabilities have been reported in Mozilla Firefox. |
CVE-2006-5463
|
| VCID-hehb-ttkd-nbb6 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4772
|
| VCID-hetc-sghb-1fcx | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8384
|
| VCID-hfp7-jaxc-2khq | Uninitialized memory in the JavaScript Engine component. |
CVE-2025-9181
|
| VCID-hfx8-7x82-zqfk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10466
|
| VCID-hgjx-1srq-4qar | As part of the Firefox 1.5.0.2 release we fixed several crash bugs to improve the stability of the product, with a particular focus on finding crashes caused by DHTML. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code with enough effort.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1530
|
| VCID-hgwp-3pm8-xugw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37205
|
| VCID-hgx7-ubwk-wkdj | Mozilla Firefox 1.5.0.1, and possibly other versions, preserves some records of user activity even after uninstalling, which allows local users who share a Windows profile to view the records after a new installation of Firefox, as reported for the list of Passwords Never Saved web sites. NOTE: The vendor has disputed this issue, stating that "The uninstaller is primarily there to uninstall the application. It is not there to uninstall user data. For the moment I will stick by my module-owner decision. |
CVE-2004-2657
|
| VCID-hgy1-3pbq-s3ch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42932
|
| VCID-hhad-uy4u-xkak | When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. *Note: This issue only affects Windows operating systems. Other operating systems are not affected.* |
CVE-2018-18496
|
| VCID-hhtb-ha1v-tffj | A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. |
CVE-2017-5377
|
| VCID-hhu1-cgcx-nfev | During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. |
CVE-2021-38498
|
| VCID-hk7b-ckyd-7qg2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7803
|
| VCID-hkbw-grqv-2qg5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23956
|
| VCID-hmtb-36h7-3uaj | A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.* |
CVE-2025-1940
|
| VCID-hn17-6nvj-9qfw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22738
|
| VCID-hnb1-5t4z-ubhj | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1963
|
| VCID-hp32-swmr-qqdy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46878
|
| VCID-hpnv-s73g-8yhp | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-9812
|
| VCID-hq7v-u57f-5uhc | A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. |
CVE-2017-5456
|
| VCID-hr2p-k95n-pbg3 | The session restore helper crashed whenever there was no parameter sent to the message handler. |
CVE-2023-37456
|
| VCID-hrz4-8mz2-a7e3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6826
|
| VCID-hs5f-21nx-gfeb | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11729
|
| VCID-hs7f-4tav-dfcv | When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26975
|
| VCID-hsc9-up4x-nbgs | Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2762
|
| VCID-hshc-4xnc-gug4 | Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4704
|
| VCID-hsr3-c152-nucq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28286
|
| VCID-hstd-23qm-bqdg | Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4717
|
| VCID-hsy2-jvn8-s3gs | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5089
|
| VCID-hthe-t85x-13gz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5465
|
| VCID-htpg-t39z-nbex | Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. |
CVE-2017-5379
|
| VCID-htr8-mqtk-t7ad | Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2806
|
| VCID-htrf-wxeh-cyha | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5098
|
| VCID-hu6v-g43k-9uep | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9395
|
| VCID-husj-kjf4-ufeq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34479
|
| VCID-hvfz-fm5h-fugx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0744
|
| VCID-hw2h-w5r2-7qhv | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7753
|
| VCID-hwdb-ww2n-fqdq | A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed. This allows an attacker to spoof which page is actually loaded and in use. *Note: This attack only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-7817
|
| VCID-hyhc-qud7-6uax | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5396
|
| VCID-j1hb-8jjy-tqgq | Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4693
|
| VCID-j1yh-f1np-wbcv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4584
|
| VCID-j1zj-1dr1-8yhc | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29912
|
| VCID-j2ax-jb2h-byeu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4052
|
| VCID-j2ga-ggcd-fkg1 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2805
|
| VCID-j2qd-ebuh-8be5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6819
|
| VCID-j2qz-wqhk-yfb6 | A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-43530
|
| VCID-j56s-gf2k-zqdx | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7774
|
| VCID-j5k8-ztxb-uffb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0238
|
| VCID-j623-3wjy-57c2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-23597
|
| VCID-j64y-ejt3-tbe3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11757
|
| VCID-j6w1-yhc3-uqfw | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. |
CVE-2025-6425
|
| VCID-j6x8-vnns-1yfg | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2791
|
| VCID-j7j8-g9du-mqfz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12366
|
| VCID-j7wt-w5x2-nye4 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2800
|
| VCID-j921-2uvd-kked | Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections |
CVE-2024-31393
|
| VCID-j9mr-8yac-3ubj | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1735
|
| VCID-jajw-gyuh-v3dj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12395
|
| VCID-javq-3r82-73fq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2019-17022
|
| VCID-jced-kyws-kuck | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5698
|
| VCID-jebk-6hja-ukfc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9402
|
| VCID-jeja-pgsz-2uaq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23976
|
| VCID-jf6r-vdhm-tyfr | An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-23959
|
| VCID-jfw1-18np-47b8 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1961
|
| VCID-jg37-y3r7-8fcq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34484
|
| VCID-jjqk-qjcz-sudp | A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, leading to a potentially exploitable crash. *Note: This issue is in libGLES, which is only in use on Windows. Other operating systems are not affected.* |
CVE-2017-5411
|
| VCID-jjs1-hz7p-fke6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12387
|
| VCID-jkyr-qzk1-v7fg | WebExtensions may use view-source: URLs to view local file: URL content, as well as content stored in about:cache, bypassing restrictions that only allow WebExtensions to view specific content. |
CVE-2018-5134
|
| VCID-jm7w-hqzq-tqde | Thunderbird executed javascript: URLs when used in object and embed tags. |
CVE-2025-8029
|
| VCID-jmag-tc22-b7dk | Denial-of-service in the Libraries component in NSS. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4727
|
| VCID-jp3p-pdhs-uya7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23985
|
| VCID-jpmt-j1j8-wbbm | Use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 146.0.1. |
CVE-2025-14860
|
| VCID-jr81-ed7a-aqcp | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6811
|
| VCID-js13-n8v6-hyav | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2005-4134
|
| VCID-js15-jev6-6fbs | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1960
|
| VCID-jt6f-rpfx-7kbj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8383
|
| VCID-jtrv-jyme-sybh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5159
|
| VCID-jtsz-m5jr-ebdc | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15664
|
| VCID-jtyr-jd5m-87c3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15659
|
| VCID-jvkp-8vex-4yby | When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for spoofing the domain of the current page. |
CVE-2017-7762
|
| VCID-jvup-17w9-9yf1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25741
|
| VCID-jvy8-w1m2-ayaw | A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. |
CVE-2016-9068
|
| VCID-jwnz-gnjs-1uaa | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7751
|
| VCID-jwze-7mfw-r3ax | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5404
|
| VCID-jxq3-3gzd-yycp | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5294
|
| VCID-jxwt-d17p-1fgk | When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanent Denial of Service.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2022-36317
|
| VCID-jy6e-d578-nkcg | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38507
|
| VCID-jybh-8px4-pqau | Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0885
|
| VCID-jyur-q447-t7hr | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26973
|
| VCID-jz16-4ywn-u7h3 | Long pressing on a download link could potentially allow Javascript commands to be executed within the browser |
CVE-2024-43111
|
| VCID-jzb7-dve8-jygb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5438
|
| VCID-jzd1-xa3x-c7dm | If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive will be ignored, leading to CSP directives not being properly applied to content. |
CVE-2019-11737
|
| VCID-jzte-jqk6-7ya6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5169
|
| VCID-k131-mfqm-dka9 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-1977
|
| VCID-k1u4-hqjh-zbc8 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5251
|
| VCID-k2s2-zkua-8ydy | NSS has an information disclosure vulnerability when handling DSA keys. |
CVE-2020-12399
|
| VCID-k321-r7qq-gbb9 | A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. |
CVE-2019-11691
|
| VCID-k3ec-bt9r-pkhg | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9397
|
| VCID-k3wz-tvrb-p3fg | Memory safety bugs present in Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-14332
|
| VCID-k4a4-f1as-x3bj | NSS has multiple information disclosure vulnerabilities when handling secret key material. |
CVE-2020-12400
|
| VCID-k4e4-363e-xyff | Mozilla developers and community members Christian Holler, Valentin Gosu, and Andrew McCreight reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2021-43534
|
| VCID-k572-1cb2-dugh | Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. |
CVE-2025-12380
|
| VCID-k5hu-n47k-wffm | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2792
|
| VCID-k79j-1yvn-qfd2 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7776
|
| VCID-k813-qahc-ubf4 | Security researcher Aral reported an out-of-bounds write when using the ANGLE graphics library, which is used for WebGL content on Windows systems. This crash occurs due to improper size checking while writing to an array during some WebGL shader operations. The ANGLE graphics library is only used on Windows. Linux, OS X, and Android operating systems are not affected by this vulnerability. |
CVE-2016-2824
|
| VCID-ka31-epgw-2kcq | Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode. This could be used for limited spoofing attacks due to user confusion. |
CVE-2017-7838
|
| VCID-ka9e-ps8e-ryc8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9392
|
| VCID-ka9x-22be-p7aw | Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which allows remote attackers to execute arbitrary code. |
CVE-2018-17466
|
| VCID-kat5-hy8e-skah | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29989
|
| VCID-kavx-hnua-aff7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4771
|
| VCID-kbmp-j4vq-ybhp | A mechanism to spoof the Firefox for Android addressbar using a javascript: URI. On Firefox for Android, the base domain is parsed incorrectly, making the resulting location less visibly a spoofed site and showing an incorrect domain in appended notifications. |
CVE-2017-5450
|
| VCID-kbpr-dnqh-37fu | Mozilla developers Jason Kratzer, Christian Holler, and Byron Campen reported memory safety bugs present in Firefox 79 and Firefox ESR 78.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-15670
|
| VCID-kbqr-p81f-k3ch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12383
|
| VCID-kbyn-rze5-2qeg | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2787
|
| VCID-kc7w-zjh4-vqfq | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11701
|
| VCID-kckx-uwcw-8bbz | A use-after-free vulnerability can occur when manipulating floating first-letter style elements, resulting in a potentially exploitable crash. |
CVE-2018-5101
|
| VCID-kdwy-7p45-hbcs | Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13015
|
| VCID-keec-2paa-qqe6 | The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. *Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected.* |
CVE-2016-9065
|
| VCID-kf1h-zg32-1yh4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40960
|
| VCID-kfxp-azcd-2yej | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46871
|
| VCID-kg3p-hut6-47f6 | A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated _exposedProps_ mechanism on proxy objects. These properties should be explicitly unavailable to proxy objects. |
CVE-2017-7831
|
| VCID-khm6-vuzx-zfeg | A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* |
CVE-2023-25747
|
| VCID-khsw-jwtm-8faq | A use-after-free could have occurred when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. |
CVE-2021-43535
|
| VCID-kk2m-2mxz-sbex | Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird < 140.7. |
CVE-2025-14327
|
| VCID-kk9k-mpvr-7kh9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23981
|
| VCID-kkgh-a9hg-fud8 | A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. |
CVE-2025-11710
|
| VCID-kkp5-vwqy-abbc | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5284
|
| VCID-kn3f-cx36-17h2 | When an iframe has a sandbox attribute and its content is specified using srcdoc, that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included allow-same-origin. |
CVE-2017-7788
|
| VCID-kpk1-e652-nkfa | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22761
|
| VCID-kpun-mgtm-5uhd | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9399
|
| VCID-kr94-y6hg-d3hp | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2020-6799
|
| VCID-krg2-d4vy-z7fu | During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-17015
|
| VCID-krq5-4j17-vfg9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28164
|
| VCID-ks5r-2ftn-dbcq | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-28177
|
| VCID-ksh8-rqg4-wber | Image for moz-icons can be accessed through the moz-icon: protocol through script in web content even when otherwise prohibited. This could allow for information leakage of which applications are associated with specific MIME types by a malicious page. |
CVE-2018-5140
|
| VCID-kskc-agaw-8bcr | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6857
|
| VCID-ktmy-hj42-5kdc | Firefox 1.5.0.7 and 2.0, and Seamonkey 1.1b, allows remote attackers to cause a denial of service (crash) by creating a range object using createRange, calling selectNode on a DocType node (DOCUMENT_TYPE_NODE), then calling createContextualFragment on the range, which triggers a null dereference. NOTE: the original Bugtraq post mentioned that code execution was possible, but followup analysis has shown that it is only a null dereference. |
CVE-2006-5633
|
| VCID-ku26-71r1-vfem | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3854
|
| VCID-kufd-jgaq-jfd2 | WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the webRequest API. For example, this allows for the interception of username and an encrypted password during login to Firefox Accounts. This issue does not expose synchronization traffic directly and is limited to the process of user login to the website and the data displayed to the user once logged in. |
CVE-2018-5152
|
| VCID-kuwd-6tcg-fuha | Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4713
|
| VCID-kvkh-dxw4-rfde | Security researcher firehack reported a buffer overflow when parsing HTML5 fragments in a foreign context such as under an <svg> node. This results in a potentially exploitable crash when inserting an HTML fragment into an existing document. |
CVE-2016-2819
|
| VCID-kvxt-7wyx-dfbr | WebExtensions could use popups and panels in the extension UI to load an about: privileged URL, violating security checks that disallow this behavior. |
CVE-2017-7816
|
| VCID-kx3j-abfc-qfh2 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. |
CVE-2024-9393
|
| VCID-kxvg-qw8v-vydv | Multiple vulnerabilities have been found in NSS, the worst of which may allow execution of arbitrary code. |
CVE-2017-5461
|
| VCID-kzd5-gpff-kbee | As part of the Firefox 1.5.0.2 release we fixed several crash bugs to improve the stability of the product, with a particular focus on finding crashes caused by DHTML. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code with enough effort.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1723
|
| VCID-kzh6-b6jx-hbc4 | The Mozilla Foundation has reported numerous vulnerabilities in Mozilla Firefox, including one that may allow execution of arbitrary code. |
CVE-2006-4568
|
| VCID-kzuh-q579-eqbz | A shared worker created from a data: URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy. |
CVE-2018-5136
|
| VCID-m1pc-eqy5-2khu | If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. |
CVE-2020-15680
|
| VCID-m1tv-6fpx-dudj | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4565
|
| VCID-m26q-fgjn-yugu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25730
|
| VCID-m2cy-38ne-87dy | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5117
|
| VCID-m2sr-re2h-3baq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4050
|
| VCID-m2vr-a1ee-j7gv | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5255
|
| VCID-m3mp-su9k-sfhs | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2763
|
| VCID-m3w6-89ms-z3fk | The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. |
CVE-2017-7822
|
| VCID-m4hs-41n2-8bbz | Malicious pages could use Firefox for Android to pass FIDO: links to the OS and trigger the "hybrid" passkey transport. An attacker within Bluetooth range could have used this to trick the user into using their passkey to log the attacker's computer into the target account. |
CVE-2024-9956
|
| VCID-m52b-kam2-syg4 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5280
|
| VCID-m59v-ygc2-qucg | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5378
|
| VCID-m5f4-3a7z-y7aj | Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks. |
CVE-2018-12401
|
| VCID-m5h6-y3tw-eue6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-20503
|
| VCID-m5pb-75ag-tfep | Use-after-free while manipulating the navigator object within WebVR. *Note: WebVR is not currently enabled by default.* |
CVE-2016-9896
|
| VCID-m6uv-91wz-xfdv | Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4700
|
| VCID-m8cv-zhfc-4kc1 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1727
|
| VCID-m92a-91pv-dffv | If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead.*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2020-35112
|
| VCID-m93r-91y4-xyaz | An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. |
CVE-2025-1010
|
| VCID-m9h1-aw7r-jqb2 | An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. |
CVE-2024-7652
|
| VCID-mc6m-8uzs-pkgu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25744
|
| VCID-mdpv-kcbb-9ubj | Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. |
CVE-2016-9071
|
| VCID-mduv-93pf-d3h4 | A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction. This could be used to open new tabs in a denial of service (DOS) attack or to display unwanted content from arbitrary URLs to users. |
CVE-2018-5141
|
| VCID-mejk-v3p1-eyfy | A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. |
CVE-2019-11695
|
| VCID-menq-g5ce-1yd8 | Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-2793
|
| VCID-mfs8-2vzs-pybf | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3859
|
| VCID-mfsd-3nxb-3keu | The browser.identity.launchWebAuthFlow function of WebExtensions is only allowed to load content over https: but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. |
CVE-2018-5113
|
| VCID-mfwc-dm4n-vbey | Code injection The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. |
CVE-2018-5158
GHSA-7jg2-jgv3-fmr4 |
| VCID-mh92-65bz-43ds | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5721
|
| VCID-mj2t-phst-v7f8 | Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29993
|
| VCID-mj7n-8hf6-2qar | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5724
|
| VCID-mj7u-bpwq-jkhu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8389
|
| VCID-mkyz-6v1k-wyen | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29987
|
| VCID-mm2u-njbv-ckfb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4773
|
| VCID-mm6w-kpe8-4kg3 | Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4684
|
| VCID-mm7x-rfzg-uqfc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45404
|
| VCID-mmvb-w19n-97a3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12420
|
| VCID-mn6j-2wd1-ukfb | Integer overflow in the Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2774
|
| VCID-mnar-hq2z-q7dc | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5265
|
| VCID-mnt3-q341-j7gj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11763
|
| VCID-mp4n-ez8p-63ek | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28163
|
| VCID-mpx9-1b8x-qkaj | A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded. *Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected.* |
CVE-2016-5298
|
| VCID-mqte-f1hw-2ya5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22753
|
| VCID-mqyc-vuqn-tfdg | Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first |
CVE-2025-27425
|
| VCID-mrb2-hz9y-4ufp | When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack. |
CVE-2025-6430
|
| VCID-ms9h-982a-pkdu | Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. |
CVE-2025-1014
|
| VCID-mtkx-1vvb-3yhp | In the Angle graphics library, depth pitch computations did not take into account the block size and simply multiplied the row pitch with the pixel height. This caused the load functions to use a very high depth pitch, reading past the end of the user-supplied buffer.*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2020-16048
|
| VCID-mupu-c1j2-xkgs | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2806
|
| VCID-muvd-ax39-5qf7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6612
|
| VCID-mv4d-eqtc-kkgw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23968
|
| VCID-mvag-kraa-6ydu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23955
|
| VCID-mvg3-6cbk-xyb6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25740
|
| VCID-mvv2-vccm-7qbm | Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2804
|
| VCID-mw96-qtnz-gqdx | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10465
|
| VCID-mw9j-h66p-k7as | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28289
|
| VCID-mwd4-pgxg-zkha | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26485
|
| VCID-mwj3-wa1g-buay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37207
|
| VCID-mwrr-ashj-bfg3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7825
|
| VCID-mwyd-ba4z-eug6 | An upgrade in the XML parser introduced a bug that could read beyond the end of the buffer, often causing a crash. We don't know if this could be exploited to incorporate private data into the DOM of an XML document, but could be a privacy risk if so. Firefox 1.0, Thunderbird 1.0 and Mozilla Suite 1.7 are not affected.Update (13 April 2006) This flaw has been fixed in Thunderbird 1.5.0.2 |
CVE-2006-0298
|
| VCID-mx8t-s47w-wud5 | When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation. Given an electro-magnetic trace of a few signature generations, the private key could have been computed. |
CVE-2020-6829
|
| VCID-myaj-sqb7-27dq | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. |
CVE-2020-6830
|
| VCID-myv9-89b8-w7dm | In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the SEE_MASK_FLAG_NO_UI flag associated with downloaded files and will not show any UI. Files that are unknown and potentially dangerous will be allowed to run because SmartScreen will not prompt the user for a decision, and if the user is offline all files will be allowed to be opened because Windows won’t prompt the user to ask what to do. Firefox incorrectly sets this flag when downloading files, leading to less secure behavior from SmartScreen. *Note: this issue only affects Windows 10 users running the April 2018 update or later. It does not affect other Windows users or other operating systems.* |
CVE-2018-5174
|
| VCID-mzbp-5r6m-27cm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22740
|
| VCID-mznp-sxav-xfhn | Multiple vulnerabilities have been reported in Mozilla Firefox. |
CVE-2006-5748
|
| VCID-n1uk-fcmx-yuee | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38478
|
| VCID-n1v6-q6wt-ebaj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-18494
|
| VCID-n2hq-1ck4-ayhp | Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. |
CVE-2025-5263
|
| VCID-n454-esxc-ckhd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12367
|
| VCID-n4g2-4hj3-vkb9 | Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. |
CVE-2026-2634
|
| VCID-n4hu-b1t6-xkay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10458
|
| VCID-n4kc-y37w-qkdk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38506
|
| VCID-n529-v6zj-n3gf | The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. |
CVE-2025-1018
|
| VCID-n6s1-tsx2-7fee | Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). |
CVE-2019-11756
|
| VCID-n796-xf5e-pucq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-4140
|
| VCID-n7fp-17uy-eqe7 | Spoofing issue in the Address Bar component of Firefox Focus for Android. |
CVE-2025-9186
|
| VCID-n8gb-hpjb-v7a5 | Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. |
CVE-2024-2607
|
| VCID-n8j8-h4yf-jffz | Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147 and Thunderbird < 147. |
CVE-2026-0881
|
| VCID-n9js-dkvj-b3fz | A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have lead to memory corruption or a potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 106. |
CVE-2022-46884
|
| VCID-nbvc-j1zu-v7d8 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11762
|
| VCID-nce4-3put-j3ex | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5697
|
| VCID-ndd4-kd1y-z7ep | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0878
|
| VCID-ndex-79sm-gfak | Mozilla developers Christian Holler, Sebastian Hengst, Bogdan Tara, and Tyson Smith reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-15684
|
| VCID-ndp1-5bhw-8kau | When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. |
CVE-2021-29952
|
| VCID-ndtj-s8ud-57gu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34474
|
| VCID-ndzt-rj9t-nbb1 | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0293
|
| VCID-ne9e-2jg4-mbd5 | Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6497
|
| VCID-nexj-aaak-u7aq | Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Internationalized Domain Name (IDN) this can be used for domain name spoofing attacks. *Note: This attack only affects OS X operating systems. Other operating systems are unaffected.* |
CVE-2018-5121
|
| VCID-nfr9-wq4n-97df | If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through file: URLs. |
CVE-2017-7812
|
| VCID-ngdr-hetx-kbf8 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1956
|
| VCID-ngja-2eff-h7hk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-34414
|
| VCID-nguh-j845-wbf1 | A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting). This is a separate bypass from CVE-2019-17000.*Note: This flaw only affected Firefox 69 and was not present in earlier versions.* |
CVE-2019-17001
|
| VCID-ngw4-xb6d-gqfm | An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. |
CVE-2017-5428
|
| VCID-nhsr-4zux-2bck | Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2769
|
| VCID-nkpq-9gd6-nuc4 | Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-0891
|
| VCID-nkzt-x77d-8qb3 | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3113
|
| VCID-nmh4-zpeh-4bcr | Multiple vulnerabilities have been found in Expat, the worst of which could result in a Denial of Service condition. |
CVE-2019-15903
|
| VCID-nmws-nx6k-5qbe | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7798
|
| VCID-nnxw-14g9-77da | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2785
|
| VCID-np75-dzzq-8yef | If a long user name is used in a username/password combination in a site URL (such as http://UserName:Password@example.com), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. |
CVE-2017-7783
|
| VCID-npyt-d8qr-wqdj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5402
|
| VCID-nr84-88hy-6fah | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2796
|
| VCID-ntqr-ptmu-yuen | Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2767
|
| VCID-nuqf-n5jd-cke6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5186
|
| VCID-nvsz-9s3r-nbhq | Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4718
|
| VCID-nxhd-we9n-67fe | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31748
|
| VCID-nyhm-tguf-gkat | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5104
|
| VCID-nyn2-zf8c-67cb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7750
|
| VCID-nzcd-dk9q-puh1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26976
|
| VCID-p1te-bjdc-qke9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-32210
|
| VCID-p1tr-p6je-dybj | This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. *Note: this issue only affects Windows operating systems.* |
CVE-2016-5295
|
| VCID-p365-j5gq-4uct | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2816
|
| VCID-p3jt-3rd4-abb6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11723
|
| VCID-p3yc-cddb-hkhe | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5722
|
| VCID-p44n-ajkd-v7af | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5689
|
| VCID-p4kh-nd6b-jubh | When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* |
CVE-2021-29968
|
| VCID-p6nb-kyzu-bbdf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12425
|
| VCID-p9zh-7wyj-hffm | Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2771
|
| VCID-pa3c-jpdg-ukhh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6213
|
| VCID-paez-g9wh-mfeq | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6609
|
| VCID-pber-bzw2-r3gw | The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-7768
|
| VCID-pbrt-gcqj-kycv | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9900
|
| VCID-pcgf-xtfq-6ugb | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14330
|
| VCID-pcrz-f3nj-kybr | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1938
|
| VCID-pdgz-dsbq-67hq | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1967
|
| VCID-pemg-ndu8-wbbc | Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0879
|
| VCID-pepm-1t68-uuf1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6864
|
| VCID-pgst-zjuv-guee | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-4579
|
| VCID-phf8-uzdb-vber | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29910
|
| VCID-pj4h-ff45-e3ez | A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. |
CVE-2025-1013
|
| VCID-pmkt-c3bw-zkhz | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. |
CVE-2024-9398
|
| VCID-pmwj-2v2k-nfcb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7758
|
| VCID-pn68-e9g7-qbf1 | The executable file warning did not warn users before opening files with the terminal extension. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.* |
CVE-2025-6426
|
| VCID-pn8f-h9r2-xug8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6211
|
| VCID-pp4w-2986-nqee | A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. |
CVE-2017-5467
|
| VCID-pqak-1a9a-b3g1 | The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page, if they can convince the visitor to save the complete web page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, which can result in saving the wrong version of resources based on those cookies. |
CVE-2018-12402
|
| VCID-prum-nfkw-a3gp | When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. |
CVE-2019-17018
|
| VCID-prve-an93-pkd8 | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-1020
|
| VCID-pryc-r9jn-9bds | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12378
|
| VCID-ps9s-3kuv-1yh1 | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15677
|
| VCID-psc3-4ssv-wyb5 | On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. |
CVE-2025-8027
|
| VCID-pse8-xnc7-gkbv | Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. |
CVE-2024-2610
|
| VCID-pst5-367g-h7cs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8386
|
| VCID-pt8y-85gt-8kge | A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. |
CVE-2019-11749
|
| VCID-pucy-jyfx-ryb5 | If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page. Although the prompt contains the real domain making the request, this can result in user confusion about the originating site of the authentication request and may cause users to mistakenly send private credential information to a third party site. |
CVE-2018-5115
|
| VCID-pv9q-fcta-ffbq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4577
|
| VCID-pvvt-h3mh-33eb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0741
|
| VCID-pws7-8qmm-hfes | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-17008
|
| VCID-pww9-m9d4-euew | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7752
|
| VCID-pybb-2ny2-quas | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6209
|
| VCID-pybp-xzy7-q3a8 | Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. |
CVE-2016-9067
|
| VCID-pyqg-v477-auex | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3811
|
| VCID-pzf5-v82a-hkb9 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26486
|
| VCID-pzsj-b4vv-63g2 | When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event |
CVE-2025-11718
|
| VCID-pzwg-wv7w-s7fv | If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https. |
CVE-2019-17002
|
| VCID-q181-ebjc-1qe4 | The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. *Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.* |
CVE-2019-11701
|
| VCID-q1pv-avug-juef | Privilege escalation in the Messaging System component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2777
|
| VCID-q2t7-31ux-cyc6 | On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. *Note: This attack only affects Windows operating systems. Other operating systems are not affected.* |
CVE-2017-7796
|
| VCID-q38n-z9wb-qufk | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5283
|
| VCID-q3au-wru3-pbet | The filename appearing in the Downloads panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. *Note: the dialog to open the file will show the full, correct filename and whether it is executable or not.* |
CVE-2018-5173
|
| VCID-q494-zvyn-quge | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46881
|
| VCID-q4bf-vh36-kye9 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22756
|
| VCID-q4x5-dz5r-jqgr | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9905
|
| VCID-q5ch-b97k-k3hp | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29982
|
| VCID-q61x-vd6b-vygs | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2796
|
| VCID-q72b-g1hz-23fs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5429
|
| VCID-q7jk-b69d-bbav | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7785
|
| VCID-q83t-h55y-eyhv | A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's TITLE element. This vulnerability allows for spoofing but no scripted content can be run. |
CVE-2017-5453
|
| VCID-q9f4-zumy-wbfy | Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-8034
|
| VCID-qa7k-byax-9ugc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28283
|
| VCID-qa9c-xyvd-kygu | Mozilla developer John Schoenick reported that CSS pseudo-classes can be used by web content to leak information on plugins that are installed but disabled. This can be used for information disclosure through a fingerprinting attack that lists all of the plugins installed by a user on a system, even when they are disabled. |
CVE-2016-2832
|
| VCID-qb3k-wy5x-buh4 | Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address |
CVE-2025-23109
|
| VCID-qc2y-5tzg-ruav | JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks if users were convinced to add malicious tags to bookmarks, export them, and then open the resulting file. |
CVE-2017-7840
|
| VCID-qd4e-g5zv-1ucf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43539
|
| VCID-qd97-asaa-2fey | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8385
|
| VCID-qdc5-1z7p-zqar | A javascript: url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly. |
CVE-2017-5420
|
| VCID-qdqj-rhcr-wbca | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6856
|
| VCID-qeh2-jn2v-9ug7 | A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. |
CVE-2025-11709
|
| VCID-qetw-2ah7-5ba4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7809
|
| VCID-qewm-wn6h-b3f3 | OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26957
|
| VCID-qfk6-r2rj-9yd2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28288
|
| VCID-qgte-aw18-wuev | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6608
|
| VCID-qgvp-4eea-bkgm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22748
|
| VCID-qgvy-hzsx-hkge | Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13014
|
| VCID-qh1k-c7ct-efg8 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7786
|
| VCID-qh4a-bn9p-a7hh | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26387
|
| VCID-qhes-9dcx-tbb5 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7777
|
| VCID-qhwf-9n5n-hbaa | The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. |
CVE-2020-15658
|
| VCID-qjs9-h3tt-qucf | Special about: pages used by web content, such as RSS feeds, can load privileged about: pages in an iframe. If a content-injection bug were found in one of those pages this could allow for potential privilege escalation. |
CVE-2017-5391
|
| VCID-qkks-24cp-gqg2 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4706
|
| VCID-qm3n-zmh9-afgy | By triggering multiple pop-up prompts containing javascript: URLs, a malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29953
|
| VCID-qm8f-f8nr-qba9 | Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0880
|
| VCID-qne4-76n5-4yf3 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5250
|
| VCID-qnk9-a332-dbfg | A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack.*Note: This issue only affected Android operating systems. Other operating systems are unaffected.* |
CVE-2025-8364
|
| VCID-qpm2-9p1h-37fd | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1732
|
| VCID-qptm-f15t-57gj | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5290
|
| VCID-qq5h-5k45-rycm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23995
|
| VCID-qq7q-7j4q-h7dz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12397
|
| VCID-qqn4-w66p-vfhd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5731
|
| VCID-qqxg-94u9-m7cm | The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the file system to replace files used by Firefox with their own versions. |
CVE-2017-5397
|
| VCID-qrbp-3x9q-q3g2 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5273
|
| VCID-qrqw-p9v1-zfb2 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5282
|
| VCID-qrsj-pbnc-a7bt | A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android. This could allow an attacker to spoof which page is actually loaded and in use. *Note: this issue only affects Firefox for Android. Other versions and operating systems are unaffected.* |
CVE-2018-5138
|
| VCID-qrva-vbms-sug2 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1969
|
| VCID-qta2-8rnt-k7d1 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2788
|
| VCID-qtcm-9z3v-dydn | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0241
|
| VCID-qtp4-ada6-tydd | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1974
|
| VCID-qu3v-meay-f3dh | Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into granting sensitive permissions by hiding what the user was actually clicking. |
CVE-2025-1939
|
| VCID-qu91-vc1p-dyb1 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9899
|
| VCID-qu9b-rst3-v7fa | Security researcher Frédéric Hoguin reported a mechanism where the Mozilla Windows updater could be used to overwrite arbitrary files. He found that files extracted by the updater from a MAR archive are not locked for writing and can be overwritten by other processes while the updater is running. A malicious local program could invoke the updater and then interfere with the extracted files, replacing them with its own. This vulnerability could be used for privilege escalation if these overwritten files were later invoked by other Windows components that had higher privileges. This issue does not affect non-Windows operating systems. |
CVE-2016-2826
|
| VCID-qv74-f7ax-83cp | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38473
|
| VCID-qv7a-3c41-x3cr | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38477
|
| VCID-qv8f-9y37-bbdk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29985
|
| VCID-qvj2-uwha-xff9 | The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user to copy and paste malicious script content that could then run with the context of either page but does not allow for privilege escalation. |
CVE-2018-5172
|
| VCID-qvqm-n242-vyea | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12405
|
| VCID-qw18-3u5b-e7dt | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6615
|
| VCID-qw5k-tgdz-vkcw | The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-5409
|
| VCID-qwc9-da7w-4kdr | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2804
|
| VCID-qwvy-9yec-dybk | The instanceof operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. |
CVE-2017-7820
|
| VCID-qx6h-9sx4-wqdp | Mozilla developers and community members Randell Jesup, Philipp, Cosmin Sabou, and Natalia Csoregi reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2019-11734
|
| VCID-qy44-ubss-x7et | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40962
|
| VCID-qz95-5z9e-7qb7 | The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. |
CVE-2025-8033
|
| VCID-qzb8-5u9j-27g1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11700
|
| VCID-qzrz-4abn-q7f2 | Security researcher Armin Ebert reported that the location.host property can be set to an arbitrary string after creating an invalid data: URI. This allows for a bypass of some same-origin policy protections. This issue is mitigated by the data: URI in use and any same-origin checks for http: or https: are still enforced correctly. As a result cookie stealing and other common same-origin bypass attacks are not possible. |
CVE-2016-2825
|
| VCID-r1j5-5459-4qeg | Spoofing issue in the Address Bar component. |
CVE-2025-9183
|
| VCID-r27v-bxdj-7fgk | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
CVE-2024-6610
|
| VCID-r29z-4m4j-8kft | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. |
CVE-2025-6424
|
| VCID-r34s-64j2-dfff | Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. |
CVE-2017-5382
|
| VCID-r3mt-tm39-ruc8 | A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. |
CVE-2025-3608
|
| VCID-r3uw-xrkd-myh4 | A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in a potentially exploitable crash. |
CVE-2018-5128
|
| VCID-r4th-1n98-aqc6 | A use-after-free in Mozilla Firefox might allow remote attacker(s) to execute arbitrary code. |
CVE-2020-26950
|
| VCID-r587-gyj4-5kee | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29911
|
| VCID-r5rm-yv4h-4kc3 | Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability affects Firefox < 148. |
CVE-2026-2794
|
| VCID-r631-9h74-sygv | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28282
|
| VCID-r7ss-g876-c7fg | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0237
|
| VCID-r7te-y4n3-1uhj | Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. |
CVE-2017-5385
|
| VCID-r7vt-w149-9bfn | Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2773
|
| VCID-r7vv-451v-nbag | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12392
|
| VCID-r8en-yg26-w3a1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5398
|
| VCID-r8jw-hvmm-pkhs | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2835
|
| VCID-r9rc-27rr-13h6 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-46879
|
| VCID-rafq-49c4-u7g6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32215
|
| VCID-rakk-h5vn-kbaw | Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-15649
|
| VCID-rap5-qz3f-4yhc | When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. |
CVE-2020-6813
|
| VCID-rarq-q7qa-nud7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32213
|
| VCID-rawu-vyqx-2ker | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5172
|
| VCID-rbna-kkn2-2baj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5176
|
| VCID-rbuu-mph9-7uay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1550
|
| VCID-rcg4-7hjg-v7du | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10463
|
| VCID-re3h-pcpx-puhe | A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded. |
CVE-2017-5421
|
| VCID-rev7-13wx-kqew | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11715
|
| VCID-rff5-96dg-qqgp | On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. *Note: this issue only affects Linux. Other operating systems are not affected.* |
CVE-2017-5426
|
| VCID-rg63-avu7-2bdc | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10527
|
| VCID-rhdv-jxvv-5yb2 | A same-origin policy violation allowing the theft of cross-origin URL entries when using a <meta> meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. |
CVE-2018-18499
|
| VCID-rhwa-2ash-jkgh | A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown. However, due to lack of validation from the parent process, if the user accepted the permission request an attacker-controlled permission would be granted rather than the 'Click to Play' permission. |
CVE-2019-11765
|
| VCID-rhzx-ha7x-dfew | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9791
|
| VCID-rjjb-7ycx-cuaa | If manipulated hyperlinked text with chrome: URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. |
CVE-2018-5169
|
| VCID-rk7t-zjzg-eqar | NSS has multiple information disclosure vulnerabilities when handling secret key material. |
CVE-2020-12401
|
| VCID-rkj9-dd18-xka9 | A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. |
CVE-2025-5267
|
| VCID-rm1n-n26f-x3f6 | When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. |
CVE-2019-11754
|
| VCID-rmzq-gwbe-qyba | By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user. |
CVE-2021-23996
|
| VCID-rng1-fen9-ubhq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11714
|
| VCID-rnmw-6ddn-dqg6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12407
|
| VCID-rp5h-ym8y-skbw | Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4701
|
| VCID-rpj2-156g-aqcu | The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display chrome: links as active, clickable hyperlinks in their output. Web sites should not be able to directly link to internal chrome pages. Additionally, the JavaScript debugger will display javascript: links, which users could be tricked into clicking by malicious sites. |
CVE-2018-5167
|
| VCID-rpnz-nsfq-97am | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3865
|
| VCID-rpu7-by29-4fc5 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. |
CVE-2024-53976
|
| VCID-rq11-qm9e-7ubk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43545
|
| VCID-rqkq-q1x2-6fgq | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5281
|
| VCID-rr5w-77jr-uygh | During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.*This issue only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2022-40961
|
| VCID-rsda-j27d-8bdc | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1954
|
| VCID-rsqj-18a5-23gd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5470
|
| VCID-rsy6-acfe-ffb5 | The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.*This bug only affects Firefox for Windows. Other operating systems are unaffected.* |
CVE-2022-22744
|
| VCID-rszh-1c16-47ah | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6798
|
| VCID-ru7n-21qs-eyfx | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5469
|
| VCID-ruc1-kmaz-fkbb | Incorrect boundary conditions in the JavaScript: GC component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
CVE-2025-10532
|
| VCID-rw3y-swwt-2kef | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5091
|
| VCID-rwu8-zz41-1kav | Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and corruption, which leads to potentially exploitable crashes. *Note: This issue only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-5392
|
| VCID-rx2r-8htx-rfbt | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6210
|
| VCID-rx46-z7x6-u3dc | When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. |
CVE-2020-15666
|
| VCID-rz6b-kepf-cfg9 | Mozilla developers and community members Christian Holler, Andrew McCreight, Dan Minor, Tyson Smith, Jon Coppeard, Jan-Ivar Bruaroey, Jesse Ruderman, and Markus Stange reported memory safety bugs present in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2016-5289
|
| VCID-rzsn-vnq8-kub9 | Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2798
|
| VCID-s1mx-dkf3-p7f7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-3853
|
| VCID-s2q1-ncgn-9bfc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12416
|
| VCID-s326-zdyp-67ev | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11742
|
| VCID-s3cz-gvd7-kkcc | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4775
|
| VCID-s3kc-mhdz-nkeh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25743
|
| VCID-s3vw-7gyn-ubdt | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-3600
|
| VCID-s556-eg79-77gu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7522
|
| VCID-s558-4jac-47ft | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7791
|
| VCID-s66q-8p3g-ckg2 | Focus incorrectly truncated URLs towards the beginning instead of around the origin. |
CVE-2025-8043
|
| VCID-s7rc-xagh-w3av | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-28159
|
| VCID-s89g-7f5f-5qd2 | Thunderbird could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. |
CVE-2025-6429
|
| VCID-s95f-9g8b-s3es | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. |
CVE-2024-5690
|
| VCID-s9ss-vz54-j3ha | Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29963
|
| VCID-saht-cs9w-h7h7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5095
|
| VCID-sb4d-y4bp-k3h9 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26958
|
| VCID-sbyn-4c25-h7gz | Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29962
|
| VCID-scb8-77mr-zkap | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3805
|
| VCID-scgj-9r68-due3 | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4253
|
| VCID-scqu-uppe-w3h3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11744
|
| VCID-scws-6fhd-3fg7 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 143 and Thunderbird < 143. |
CVE-2025-10530
|
| VCID-sd2d-m1n5-8kdg | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-36320
|
| VCID-sfyj-m6xa-8bbc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4581
|
| VCID-sg2y-gfue-6qam | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10461
|
| VCID-sg3s-971c-c3fy | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5254
|
| VCID-sgt1-7dt3-yyau | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5173
|
| VCID-sgwe-9xfj-6kav | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2783
|
| VCID-sh7r-dftz-kyhn | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4045
|
| VCID-sjy7-cp3x-nfh2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12368
|
| VCID-sk9f-516d-xqh7 | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9810
|
| VCID-skbg-e4em-bkaw | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-18492
|
| VCID-sknm-65ff-4uck | Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. |
CVE-2018-18511
|
| VCID-sm2q-bg6f-4qag | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34468
|
| VCID-snbc-j4e3-uff1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4582
|
| VCID-sncj-cwvy-ckdf | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7778
|
| VCID-sncs-nk53-jbap | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5279
|
| VCID-sp11-eqxh-t3gw | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2817
|
| VCID-sq1u-5jfc-dyh1 | A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.* |
CVE-2019-9816
|
| VCID-sr45-86k8-8ybs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12364
|
| VCID-sr99-hhmv-xkhq | Security researcher firehack used the Address Sanitizer tool to discover a use-after-free in contenteditable mode. This occurs when deleting document object model (DOM) table elements created within the editor and results in a potentially exploitable crash. |
CVE-2016-2821
|
| VCID-srf6-8n4s-uyb6 | The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2017-7767
|
| VCID-ss1w-euua-83gz | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1552
|
| VCID-ss9j-7jd7-nbf1 | Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2770
|
| VCID-ssdk-7x9y-wke2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23958
|
| VCID-ssxw-2rbk-cyfe | A buffer overflow read during SVG filter color value operations, resulting in data exposure. |
CVE-2017-5412
|
| VCID-stk9-md62-w7b6 | Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability affects Firefox < 143. |
CVE-2025-10535
|
| VCID-su89-u51g-z3hs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23598
|
| VCID-suv6-qrt5-wugc | On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to that location and loaded. *Note: This issue only affects Android. Other operating systems are unaffected.* |
CVE-2019-9798
|
| VCID-svqy-5b6h-7yfj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6603
|
| VCID-swar-qa2u-x3a2 | The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. |
CVE-2018-5119
|
| VCID-swmb-24y4-1kau | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9064
|
| VCID-sx6u-23rv-hya9 | Undefined behavior in the Audio/Video component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4724
|
| VCID-sx7g-4pjb-r7ac | If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.* |
CVE-2022-22736
|
| VCID-szte-x7pv-7ydn | By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.* |
CVE-2022-22750
|
| VCID-t1cv-pb54-xyge | Mozilla developers and community members Dragana Damjanovic, Emilio Cobos Álvarez, Henri Sivonen, Narcis Beleuzu, Julian Seward, Marcia Knous, Gary Kwong, Tyson Smith, Yaron Tausky, Ronald Crane, and André Bargull reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2019-9789
|
| VCID-t1h3-cabw-cyc2 | The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. |
CVE-2025-6434
|
| VCID-t1h9-93b5-73b9 | Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the new page is scrolled out of view if navigations between pages can be timed correctly. *Note: This issue only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-5395
|
| VCID-t2c3-smqc-zkba | Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0877
|
| VCID-t2pe-y7k4-1ff2 | Mozilla developers and community members Arthur Iakab, Christoph Diehl, Christian Holler, Kalel, Emilio Cobos Álvarez, Cristina Coroiu, Noemi Erli, Natalia Csoregi, Julian Seward, Gary Kwong, Tyson Smith, Yaron Tausky, and Ronald Crane reported memory safety bugs present in Firefox 64. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-18502
|
| VCID-t3h9-4h4u-3bgx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5701
|
| VCID-t4bj-qz9s-s7eb | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5405
|
| VCID-t4eb-c363-u7hc | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6805
|
| VCID-t4rc-yuj8-n7au | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0746
|
| VCID-t4t3-5pt5-ayds | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4685
|
| VCID-t52g-d7e2-zkd4 | By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26977
|
| VCID-t52p-7rr7-57ax | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6604
|
| VCID-t5kr-v1tx-5kdy | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2786
|
| VCID-t769-2t1u-57b6 | Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account.*This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.* |
CVE-2021-38505
|
| VCID-t8gg-ptc1-qfdw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4056
|
| VCID-t8mb-cdc3-6ydq | Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. |
CVE-2024-6600
|
| VCID-t8x4-6x9f-j3ar | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11720
|
| VCID-t9c6-d2kv-2uhg | Mozilla developers and community members Christian Holler, Dana Keeler, Ronald Crane, Marcia Knous, Tyson Smith, Daniel Veditz, and Steve Fink reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-12388
|
| VCID-t9cw-yjar-ckfd | A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. |
CVE-2025-11712
|
| VCID-tb9n-zfut-ubht | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1962
|
| VCID-tbu1-adxe-sudv | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-18501
|
| VCID-tce3-s87t-2qh8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25737
|
| VCID-te1e-sjsk-bfd8 | Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2768
|
| VCID-tec1-8t8s-zqgb | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-18500
|
| VCID-tegn-2y58-t3de | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7521
|
| VCID-teh4-fmg6-53ab | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-30547
|
| VCID-tf6z-7brv-dybw | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-46873
|
| VCID-tfa3-jx19-h7bz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11746
|
| VCID-tff1-6wkz-jyar | Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. |
CVE-2019-9797
|
| VCID-tfny-yt17-mffx | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4054
|
| VCID-tfry-ch3y-fyb1 | Mozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66 and Firefox ESR 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2019-9800
|
| VCID-tgpf-32kg-rqc2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0240
|
| VCID-tgsj-hp8b-27f9 | There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. |
CVE-2025-11711
|
| VCID-tgya-wnfn-t7eb | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9066
|
| VCID-tjbr-zbvv-jydr | An invalid downcast from nsHTMLDocument to nsIContent could have lead to undefined behavior. |
CVE-2023-25736
|
| VCID-tjjd-y1pq-ckf4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-5390
|
| VCID-tjkj-zeeh-xqcy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11752
|
| VCID-tjp3-ck7p-5qg3 | An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. |
CVE-2024-2605
|
| VCID-tjtk-gghp-1kdf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23999
|
| VCID-tkmh-549z-4qhd | WebExtensions can use request redirection and a filterReponseData filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. |
CVE-2018-5166
|
| VCID-tkzd-c11q-3qaf | Same-origin policy bypass in the Request Handling component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14331
|
| VCID-tmjf-y8uf-kua8 | As part of the Firefox 1.5.0.2 release we fixed several crash bugs to improve the stability of the product, with a particular focus on finding crashes caused by DHTML. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code with enough effort.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1529
|
| VCID-tnxh-tgsm-tuex | A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.*This bug only affects Firefox for Windows. Other operating systems are unaffected.* |
CVE-2022-22746
|
| VCID-tpk8-jte1-37ap | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-9811
|
| VCID-tpp7-z9eb-bqh4 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1973
|
| VCID-tps4-kxe2-5ugb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6858
|
| VCID-tq36-k8fd-wqgu | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1942
|
| VCID-tq43-rx5u-eybv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4583
|
| VCID-tqw3-3sw6-zqd3 | When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have loaded the DLL, leading to arbitrary code execution. *Note: This issue only affects the Windows operating system; other operating systems are unaffected.* |
CVE-2020-12423
|
| VCID-tre6-ytkj-k7c4 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6821
|
| VCID-tsse-jnma-mbgw | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5278
|
| VCID-tsw2-ujgt-t7g2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0752
|
| VCID-tuk6-1zg4-aqeb | Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML editable page element is user selected. *Note: This attack only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-5452
|
| VCID-tutg-2zzk-4uam | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6207
|
| VCID-tvqs-zrjz-4bhj | Firefox ignored paths when checking the validity of navigations in a frame. |
CVE-2025-8038
|
| VCID-tvsh-whx8-6qdp | Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. |
CVE-2020-15665
|
| VCID-tvsp-tsfk-v7eg | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11759
|
| VCID-tyzw-dhhz-yqer | Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly |
CVE-2024-10004
|
| VCID-tzhk-fgnn-hqah | Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability affects Firefox < 147.0.2. |
CVE-2026-24868
|
| VCID-u1nc-fgsw-mkhc | Mozilla developers and community members Gary Kwong, Olli Pettay, Tooru Fujisawa, Carsten Book, Andrew McCreight, Chris Pearce, Ronald Crane, Jan de Mooij, Julian Seward, Nicolas Pierron, Randell Jesup, Esther Monchari, Honza Bambas, and Philipp reported memory safety bugs present in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-5374
|
| VCID-u23v-7afk-qben | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12363
|
| VCID-u27e-rer2-ykcg | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7844
|
| VCID-u3j3-fc4f-7ff7 | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4686
|
| VCID-u584-a1yu-jqcf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7824
|
| VCID-u5n5-6h82-tqhw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25734
|
| VCID-u63v-3cmf-ryh6 | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2775
|
| VCID-u8hr-uqhd-uyhf | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1729
|
| VCID-u8sk-mm4g-ffem | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7823
|
| VCID-u8w1-rmga-kuan | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0745
|
| VCID-uaw1-ra2m-nbh6 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 143.0.3. |
CVE-2025-11153
|
| VCID-ubg7-durk-3fhz | Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-9184
|
| VCID-ubgg-n1xv-mfhx | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1733
|
| VCID-ubmh-fmpu-fuff | Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality.*This bug only affects Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29973
|
| VCID-ucgx-bfkb-4kg5 | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2779
|
| VCID-ud33-vgxh-8khj | Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2766
|
| VCID-uddz-7wx8-xfbb | When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. |
CVE-2020-6809
|
| VCID-udxt-xuh1-vudp | Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a user selects error links when these tools are open. This can allow style editor information used within Developer Tools to leak cross-origin. |
CVE-2018-5106
|
| VCID-ue8f-ea6q-3fck | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42931
|
| VCID-ufy5-eyqn-ybfw | Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. |
CVE-2020-26962
|
| VCID-ugjs-4tca-d3dk | The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.* |
CVE-2019-11693
|
| VCID-ugsu-2fav-4bdp | If an existing cookie is changed to be HttpOnly while a document is open, the original value remains accessible through script until that document is closed. Network requests correctly use the changed HttpOnly cookie. |
CVE-2018-5114
|
| VCID-uh95-a456-7kbx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0747
|
| VCID-uhct-zkhb-k3ca | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5275
|
| VCID-uhcz-v63r-m3ft | Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13026
|
| VCID-uhde-5x3s-u7fk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23954
|
| VCID-uhjp-n763-cfc9 | Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. |
CVE-2020-26963
|
| VCID-ukf2-qcjg-u7bg | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-0243
|
| VCID-uktd-53fe-xbgj | Multiple vulnerabilities have been reported in Mozilla Firefox. |
CVE-2006-5747
|
| VCID-ukut-zyjx-93gq | Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13013
|
| VCID-umhx-zswu-kkbt | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5293
|
| VCID-umpr-e6yd-nqcd | A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. *Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected.* |
CVE-2016-5299
|
| VCID-unmm-942j-gkh7 | crossbeam-channel Undefined Behavior before v0.4.4 ### Impact The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. ### Patches This has been fixed in crossbeam-channel 0.4.4. We recommend users to upgrade to 0.4.4. ### References See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details. ### License This advisory is in the public domain. |
CVE-2020-15254
GHSA-v5m7-53cv-f3hx |
| VCID-up2q-hqdu-u3a7 | Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks.*This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* |
CVE-2023-29534
|
| VCID-up33-tw5e-bucs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37204
|
| VCID-upd1-hbu7-tbc5 | If the app.support.baseURL preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads chrome://browser/content/preferences/in-content/preferences.xul directly in a tab and executes a search. This stored preference is also executed whenever an EME video player plugin displays a CDM-disabled message as a notification message. |
CVE-2018-5133
|
| VCID-upvn-56py-8ud7 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1933
|
| VCID-uq72-gmg1-uyem | Information disclosure in the XML component. This vulnerability affects Firefox < 147 and Thunderbird < 147. |
CVE-2026-0888
|
| VCID-uqp4-vjty-q3dh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12411
|
| VCID-urpr-qse2-7kcf | Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak.*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2020-26966
|
| VCID-urxv-nzfr-sfhb | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1953
|
| VCID-urz9-3bqp-abbg | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23971
|
| VCID-ushb-eq8b-x3az | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-5785
|
| VCID-usy5-jp7x-f7cv | Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability affects Firefox < 148.0.2. |
CVE-2026-3845
|
| VCID-ut8d-5w7x-4qg2 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1964
|
| VCID-utn2-nt3q-fugv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-36315
|
| VCID-utn7-mdgr-z7em | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43538
|
| VCID-uuc6-a3xx-6khk | Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.* |
CVE-2019-9801
|
| VCID-uuxf-cyfq-p3e2 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45412
|
| VCID-uv8b-n94e-budc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23987
|
| VCID-uvuc-b1rh-pkaq | Mozilla developers and community members Christian Holler, Looben Yang, Jesse Ruderman, Sebastian Hengst, Nicolas Grunbaum, and Gary Kwong reported memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-12375
|
| VCID-uvzd-dxhu-hydg | An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. |
CVE-2022-3266
|
| VCID-uwae-2tu5-syb5 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog.*This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.* |
CVE-2025-4086
|
| VCID-uwrq-mzhx-bfah | A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash. |
CVE-2018-5093
|
| VCID-uwzy-pbnf-kkfw | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15969
|
| VCID-ux24-3d83-23c6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-8381
|
| VCID-v26p-ngz2-tkcd | Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-memory errors. |
CVE-2020-26952
|
| VCID-v28j-cvrw-p3c7 | WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. |
CVE-2016-9073
|
| VCID-v2ak-jyep-a3cv | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. |
CVE-2019-11696
|
| VCID-v5gq-2gv5-gycv | Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. |
CVE-2024-2613
|
| VCID-v5s1-ev2g-4ue1 | When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the code. This may surprise the user and potentially direct them to unwanted content. |
CVE-2024-0953
|
| VCID-v5vy-j784-r3bj | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-26971
|
| VCID-v789-nhyw-wugk | If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. |
CVE-2024-5688
|
| VCID-v865-5aar-sueu | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34470
|
| VCID-v891-36x1-nfcj | Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks |
CVE-2020-12390
|
| VCID-v96d-equt-6bay | If a URL using the file: protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more reliably in a separate process is to open it with the noopener keyword. |
CVE-2018-5181
|
| VCID-v9ua-1tey-cyaa | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46875
|
| VCID-va34-kurf-uycj | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2016-2793
|
| VCID-va3j-erp3-3ugy | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2807
|
| VCID-vb9f-xdth-j7h3 | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3802
|
| VCID-vc9x-hjtc-q3f1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43536
|
| VCID-vcnn-u8k9-8ubs | Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-8035
|
| VCID-vd6g-ywvd-gfhf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29909
|
| VCID-vdpy-f9d9-pfac | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-10467
|
| VCID-vdvy-zc8w-6kbf | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5271
|
| VCID-vdzj-kqfy-d3b7 | libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2023-4863
GHSA-j7hp-h8jx-5ppr |
| VCID-vfsu-6m2n-rkfy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-4776
|
| VCID-vg6v-8pv2-mfhf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-31736
|
| VCID-vgqa-e7yg-wygj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-36319
|
| VCID-vgwu-jbjv-xyd1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7802
|
| VCID-vhy3-sx9u-budr | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5127
|
| VCID-vjw1-g5kk-zuda | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4046
|
| VCID-vkms-c1cv-27er | Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2802
|
| VCID-vkpn-uuym-qkge | Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which allows remote attackers to escalate privileges. |
CVE-2018-6156
|
| VCID-vma9-r6uy-p7c1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6208
|
| VCID-vmm4-dq3p-kqhu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37211
|
| VCID-vnh1-1r8e-efcd | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2814
|
| VCID-vnj4-gwzt-b3bj | Spoofing issue in the Privacy: Anti-Tracking component. This vulnerability affects Firefox < 149 and Thunderbird < 149. |
CVE-2026-4728
|
| VCID-vnmz-2agw-k3fg | A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. |
CVE-2018-12407
|
| VCID-vnuz-wp96-pqgt | WebExtensions could use the mozAddonManager API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. |
CVE-2017-5389
|
| VCID-vp6u-z4be-juaw | When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. |
CVE-2024-9936
|
| VCID-vpd3-v3fr-hkdm | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28285
|
| VCID-vpku-cgw2-gubt | Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. |
CVE-2024-6605
|
| VCID-vqeh-hhax-fqba | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3812
|
| VCID-vqn8-j5bn-zqbr | Multiple vulnerabilities have been reported in Mozilla Thunderbird, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6501
|
| VCID-vrps-vpn4-nkbf | A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.* |
CVE-2019-11700
|
| VCID-vrvn-krwb-d3dr | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9795
|
| VCID-vsyy-wtk7-cbbt | Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2021-29983
|
| VCID-vszp-vyxy-f7g7 | Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2781
|
| VCID-vt2f-abwe-4ba2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-24002
|
| VCID-vtjf-sufh-p3h4 | crossbeam-deque Data Race before v0.7.4 and v0.8.1 ### Impact In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. ### Patches This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. ### Credits This issue was reported and fixed by Maor Kleinberger. ### License This advisory is in the public domain. |
CVE-2021-32810
GHSA-pqqp-xmhj-wgcw |
| VCID-vtmx-swps-zyat | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-38472
|
| VCID-vtwg-jhr9-nydc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5386
|
| VCID-vtwu-x1vt-x3bq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29945
|
| VCID-vun4-z8ju-gbbc | If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with administrative privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with system privileges.*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2020-15663
|
| VCID-vvbx-nscf-43a7 | A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox escape. |
CVE-2019-25136
|
| VCID-vvpm-3zhz-77dm | A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. |
CVE-2019-11692
|
| VCID-vw4n-4r41-ukbp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5727
|
| VCID-vwkf-9gfp-d3cy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0749
|
| VCID-vx1t-x168-4bb8 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29975
|
| VCID-vy64-w5qh-duhp | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22762
|
| VCID-vyfb-4484-9ugb | Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2799
|
| VCID-vysb-zn1g-tuf5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29966
|
| VCID-vz6w-wghm-nqaq | Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-9185
|
| VCID-vzg5-b77s-g3ft | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34478
|
| VCID-vzkp-7dsz-kbee | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2810
|
| VCID-vzwe-r2ms-m7bv | Mozilla engineer Matt Wobensmith reported that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. This is because the Java applet is loaded by the Java plugin, which then mediates all network requests without checking against CSP. This could allow a malicious site to manipulate content through a Java applet to bypass CSP protections, allowing for possible cross-site scripting (XSS) attacks. |
CVE-2016-2833
|
| VCID-w13w-48fx-wuf3 | Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2. |
CVE-2026-24869
|
| VCID-w1a1-6e1k-guh6 | A lock was missing when accessing a data structure and importing certificate information into the trust database. |
CVE-2020-15668
|
| VCID-w1cg-up6a-7ycg | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28162
|
| VCID-w2ee-bevv-p7e6 | The security check in js_ValueToFunctionObject() can be bypassed by clever use of setTimeout() and the new Firefox 1.5 array method ForEach. shutdown demonstrated how to leverage this into a privilege escalation vulnerability that would allow the installation of malware.This vulnerability was introduced during Firefox 1.5 development, Firefox 1.0 and Mozilla Suite 1.7 are not affected.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1726
|
| VCID-w2xw-eupp-cqgf | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25739
|
| VCID-w3wj-w2gp-kqh4 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5157
|
| VCID-w41h-2xyb-h3fj | A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. |
CVE-2018-5177
|
| VCID-w44w-qwmk-mbbd | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5154
|
| VCID-w4tg-7jjp-sker | Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2025-4092
|
| VCID-w4u8-25rz-gqeq | Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2782
|
| VCID-w5hu-w7mu-b3g3 | If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. |
CVE-2019-11698
|
| VCID-w5kb-2dpg-1keg | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to remote code execution. |
CVE-2024-1557
|
| VCID-w67x-2qg8-v7gv | A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. |
CVE-2017-5406
|
| VCID-w68x-99b7-7qgs | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29984
|
| VCID-w6j3-6a6j-uqf1 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1931
|
| VCID-w74w-gxyf-4kg3 | When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. |
CVE-2021-29958
|
| VCID-w794-gqex-83du | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6602
|
| VCID-w7g1-ub97-gqdd | An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns. |
CVE-2017-5418
|
| VCID-w7gj-shrq-3fcz | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2024-11699
|
| VCID-w7rm-rw2c-wuas | Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-15678
|
| VCID-w814-2cmz-ruhz | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29535
|
| VCID-w89k-tvfx-cbez | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12406
|
| VCID-w8br-pq5p-bydy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-28284
|
| VCID-w8sy-3r3a-43ar | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4566
|
| VCID-w9eu-xqcv-q3hb | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34476
|
| VCID-w9ts-2s35-5qb8 | Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. |
CVE-2025-8037
|
| VCID-w9xm-y9fr-wyh7 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12422
|
| VCID-wa6g-22qn-j3g2 | In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. |
CVE-2025-8041
|
| VCID-wagm-cq36-k7g3 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2760
|
| VCID-wavp-f4kn-j3cm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11727
|
| VCID-waz9-711c-u3a6 | Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. |
CVE-2025-23108
|
| VCID-wb1a-t7x7-gkcp | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34485
|
| VCID-wcfk-t1kd-2kgv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25752
|
| VCID-wd3w-em5q-y7cj | A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. |
CVE-2019-11750
|
| VCID-wffz-7y83-qkbm | Mozilla developers and community members Kan-Ru Chen, Christian Holler, and Tyson Smith reported memory safety bugs present in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2016-9080
|
| VCID-wfkr-weku-fudt | Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. *Note: this issue only affects Firefox on Windows operating systems.* |
CVE-2019-11751
|
| VCID-wfn6-c2ap-y3g4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7810
|
| VCID-wfqy-u76t-ybgb | Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* |
CVE-2025-2857
|
| VCID-wgxa-54sd-rqd6 | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-2836
|
| VCID-wj3c-xpra-vffj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12376
|
| VCID-wj4m-sy94-kya8 | Mozilla developers and community members Calixte Denizet, Christian Holler, Sebastian Hengst, Jason Kratzer, Tyson Smith, Ryan VanderMeulen, Noemi Erli, Karl Tomlinson, Philipp, Gary Kwong, and Ronald Crane reported memory safety bugs present in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-5126
|
| VCID-wjru-492x-fqge | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-32208
|
| VCID-wk26-kc1d-9qcy | Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2020-15657
|
| VCID-wk3d-jxen-bbe5 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-32216
|
| VCID-wmyy-2cg3-wyhc | Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4697
|
| VCID-wp86-tmxj-nfer | In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. |
CVE-2018-5165
|
| VCID-wpm1-y59u-zkgu | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6807
|
| VCID-wpvp-c7aw-qfhw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11761
|
| VCID-wqj4-21mt-nbay | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42930
|
| VCID-wqpr-2514-u7d4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11713
|
| VCID-wqw2-gjvu-6qbu | Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4690
|
| VCID-wsdd-t7d2-gbda | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-24713
GHSA-m5pq-gvj9-9vr8 |
| VCID-wsjn-nkrs-vkgw | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. |
CVE-2025-4089
|
| VCID-wsr5-q3ht-pfh2 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23963
|
| VCID-wvnu-ttd2-akgx | The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purposes. This issue allows for a non-persistent denial of service (DOS) attack by a malicious site which links to these pages. |
CVE-2018-18510
|
| VCID-wvx2-pba2-sqha | Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4708
|
| VCID-wwck-cpa8-y3c5 | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9792
|
| VCID-wwdh-xmux-3qdq | Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2759
|
| VCID-wwgd-pew4-zkf5 | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-18505
|
| VCID-wwjw-cqjk-8qe2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7828
|
| VCID-wwkc-4c69-cbea | Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2784
|
| VCID-wxt9-u43n-2qhs | When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites.*Note: This issue only affected Firefox for Android. Other operating systems are unaffected.* |
CVE-2020-26954
|
| VCID-wxx1-uk1t-8khg | When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* |
CVE-2025-6428
|
| VCID-wz6r-xzm9-m7hp | Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
CVE-2025-13017
|
| VCID-wzt1-wzps-kqbr | Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to opened privileged about: or file: locations. |
CVE-2018-18497
|
| VCID-wzxk-316c-xqcg | When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.*This bug only affects Firefox for Windows. Other operating systems are unaffected.* |
CVE-2022-31739
|
| VCID-x12h-hqf2-37cc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2019-17016
|
| VCID-x21e-e2q4-a3au | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-37206
|
| VCID-x4bd-bxc4-x3hk | WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user privileges without explicit user consent. |
CVE-2018-5105
|
| VCID-x4gg-h5q9-ufbc | An issue with incorrect ownership model of privateBrowsing information exposed through developer tools. This can result in a non-exploitable crash when manually triggered during debugging. |
CVE-2017-5468
|
| VCID-x4sm-zyc1-ffd4 | Multiple vulnerabilities have been found in Mozilla Thunderbird and Firefox, the worst of which could lead to the execution of arbitrary code. |
CVE-2019-9796
|
| VCID-x4v4-7y4q-mfbs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6868
|
| VCID-x4vq-y6b6-dqf6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6806
|
| VCID-x4zd-xhwx-hqg3 | A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. |
CVE-2020-15661
|
| VCID-x5gg-np6m-s7c9 | Multiple vulnerabilities have been reported in the SeaMonkey project, some of which may allow the remote execution of arbitrary code. |
CVE-2006-6498
|
| VCID-x6h2-249d-nugj | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address |
CVE-2024-38313
|
| VCID-x74h-4fwa-jqet | Documents formed using data: URLs in an object element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. |
CVE-2020-12391
|
| VCID-x7r6-efsn-sqhx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-3031
|
| VCID-x8eu-wc55-mkcw | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4340
|
| VCID-x8sj-apw2-e3h6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29981
|
| VCID-x8yg-mxu2-63gz | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0748
|
| VCID-xa7t-851a-efey | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22758
|
| VCID-xan8-8fq6-yfgd | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0742
|
| VCID-xas7-eyfb-ayex | When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. |
CVE-2020-15675
|
| VCID-xbv2-t3r6-y3f9 | Mozilla developers and community members Calixte Denizet, Christian Holler, Alex Gaynor, Yoshi Huang, Bob Clary, Nils Ohlmeier, Jason Kratzer, Jesse Ruderman, Philipp, Mike Taylor, Marcia Knous, Paul Adenot, Randell Jesup, JW Wang, Tyson Smith, Emilio Cobos Álvarez, Ted Campbell, Stephen Fewer, Tristan Bourvon, and Jet Villegas reported memory safety bugs present in Firefox 57. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2018-5090
|
| VCID-xcbn-tkgg-4ben | Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
CVE-2026-2772
|
| VCID-xcze-cha6-3qcd | Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability affects Firefox < 145 and Thunderbird < 145. |
CVE-2025-13021
|
| VCID-xevc-xbcg-1yct | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7526
|
| VCID-xewd-ab7q-5bfs | Vulnerabilities in Mozilla Firefox allow privilege escalations for JavaScript code, cross site scripting attacks, HTTP response smuggling and possibly the execution of arbitrary code. |
CVE-2006-2776
|
| VCID-xg25-xm9t-cfb8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0750
|
| VCID-xghm-4ygw-tkb2 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
CVE-2025-14324
|
| VCID-xhnt-7q7n-qbd2 | If Media Capture and Streams API permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. |
CVE-2018-5142
|
| VCID-xhqj-w1vr-17ch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6824
|
| VCID-xmnb-bf3j-hkgp | A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mode. *Note: This issue only affects Firefox for Android. Other operating systems are not affected.* |
CVE-2017-5394
|
| VCID-xn3a-bun2-vkhy | If a document’s Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for <link> elements instead of one. One of these requests includes the referrer instead of respecting the set policy to not include a referrer on requests. |
CVE-2017-7842
|
| VCID-xn67-qscw-nuet | The Mozilla Foundation has reported numerous security vulnerabilities related to Mozilla SeaMonkey. |
CVE-2006-3807
|
| VCID-xn7v-f68w-5uc3 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11716
|
| VCID-xp3b-fyfq-xbbq | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22741
|
| VCID-xpjd-99qz-vbbc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34483
|
| VCID-xq67-wxrq-m7hf | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-5170
|
| VCID-xqzs-zt6z-dbew | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-12394
|
| VCID-xr9m-xumu-xben | In some cases search terms persisted in the URL bar even after navigating away from the search page. |
CVE-2025-8039
|
| VCID-xrg1-azru-5qf1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4051
|
| VCID-xspq-dfwk-27gq | Mozilla developer Johann Hofmann reported that unsanitized output in the browser UI can lead to arbitrary code execution. This issue did not affect Firefox for Android or Firefox 52 ESR. |
CVE-2018-5124
|
| VCID-xt5q-bfq6-73bn | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2019-11743
|
| VCID-xtch-eqwb-s3ag | The Mozilla Foundation has reported multiple security vulnerabilities related to Mozilla Thunderbird. |
CVE-2006-4567
|
| VCID-xud3-4s7g-rkcv | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43537
|
| VCID-xueh-djk7-63gx | A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is mitigated by the requirement that the user enter the Blob URL manually in order for the access violation to occur. |
CVE-2018-5108
|
| VCID-xwva-p4mz-tyh4 | In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. |
CVE-2025-5270
|
| VCID-xxhb-q6ax-bbga | The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab. |
CVE-2023-37455
|
| VCID-xyqa-esey-73e1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7525
|
| VCID-xztj-hyqy-gug6 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5472
|
| VCID-xzxb-5pq8-9bfd | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7801
|
| VCID-y12a-2bn1-vkdz | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22759
|
| VCID-y14s-zt8p-syby | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-5125
|
| VCID-y2dd-vp7y-5ka1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5444
|
| VCID-y2pv-1tm3-nqak | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-29959
|
| VCID-y3v2-cyyc-yyep | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45403
|
| VCID-y43f-tmvr-hqas | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22747
|
| VCID-y6u5-993n-5qdw | Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a large number of IMG elements in which the SRC attribute is a mailto URI. NOTE: another researcher found that the web page caused a temporary browser slowdown instead of a crash. |
CVE-2006-2332
|
| VCID-y7rn-wb1d-vbdg | The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. *Note: This attack only affects Windows operating systems. Other operating systems are unaffected.* |
CVE-2017-7765
|
| VCID-y7sk-dmau-4fam | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1936
|
| VCID-y7u2-9qe6-17g4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23960
|
| VCID-y7wn-9j43-jba3 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-22742
|
| VCID-y8vr-48q8-a3aj | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6800
|
| VCID-y8xv-ss2c-4bhk | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0753
|
| VCID-y92g-afff-2ua7 | The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. *Note: This attack requires an attacker have local system access and only affects OS X and Linux. Windows systems are not affected.* |
CVE-2017-7836
|
| VCID-y953-gsyt-cqag | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could arbitrary code execution. |
CVE-2024-29943
|
| VCID-yaew-dtry-pkfv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5433
|
| VCID-yaz5-6485-u7c1 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7818
|
| VCID-yb18-qe5e-dbck | Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2024-4777
|
| VCID-yc74-5kag-2bdn | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45409
|
| VCID-ycua-7k2y-rqfr | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23953
|
| VCID-yd2q-assr-v3er | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6212
|
| VCID-ydz6-761h-jbeq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45421
|
| VCID-ye9r-gnzm-sqe2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-2200
|
| VCID-yegk-sgdn-z3ae | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5296
|
| VCID-yehu-smcf-myhs | A potential integer overflow in the DoCrypt function of WebCrypto was identified. If a means was found of exploiting it, it could result in an out-of-bounds write. |
CVE-2018-5122
|
| VCID-yfmg-82tr-gfec | The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.* |
CVE-2021-38510
|
| VCID-yfwd-x224-3qe6 | Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. |
CVE-2025-8030
|
| VCID-yg7c-ar4c-w3fn | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2020-16012
|
| VCID-ygrd-4scr-wkau | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4053
|
| VCID-yhj1-h62u-mud5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29533
|
| VCID-yjc2-2whn-uug5 | Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4694
|
| VCID-yjyu-u73t-u7bh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29536
|
| VCID-yk2z-f6vu-93fb | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7800
|
| VCID-ykzd-mar6-r3c5 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2017-7819
|
| VCID-ym7a-e9b5-5ygm | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-12359
|
| VCID-ymak-rv52-h7a5 | Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
CVE-2026-4710
|
| VCID-ymu8-mjph-f7a4 | A race during concurrent delazification could have led to a use-after-free. |
CVE-2025-1012
|
| VCID-ynpp-5b2m-bues | A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. |
CVE-2018-5148
|
| VCID-yp2g-rueg-4bcv | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-23973
|
| VCID-ypav-ujzc-9qdf | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-0296
|
| VCID-yq6p-sv1g-m3bj | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-18493
|
| VCID-yr3c-1cqv-n3bw | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2020-6812
|
| VCID-ysg5-wc3n-fbgw | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-9893
|
| VCID-yu6u-82qg-mqft | Mozilla developers Jason Kratzer, Boris Zbarsky, Tyson Smith, and Alexandru Michis reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2020-6815
|
| VCID-yuex-f2ae-ffft | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-43542
|
| VCID-yuhg-jeet-cffp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45420
|
| VCID-yust-3g8v-muas | The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* |
CVE-2024-3863
|
| VCID-ywys-vj5p-ubbe | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1968
|
| VCID-yx45-47gm-jkde | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-32209
|
| VCID-yxag-tqku-w7fz | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-3482
|
| VCID-yxdd-fgbw-rug1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23603
|
| VCID-yxy6-s185-myc9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46874
|
| VCID-yy4z-p3f1-qbbc | An issue where a <select> dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. |
CVE-2016-9076
|
| VCID-yzz5-as7s-nkaf | On pages containing an iframe, the data: protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. *Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not support the modal dialog functionality.* |
CVE-2017-7815
|
| VCID-z19z-zu3b-5khe | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2021-4129
|
| VCID-z1a8-kgzw-vygg | When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. |
CVE-2020-26979
|
| VCID-z23q-ts2f-17a3 | Normally Mozilla-based clients prevent web content from linking to local files but Eric Foley reports a partial bypass of this restriction by using Windows filename syntax (on a Windows computer) rather than a file:/// URL as the SRC= attribute. The image will not be loaded on the web page--it will appear as a broken image--but if a user can be convinced to right-click and select "View Image" then the content will be loaded. Since the image will replace the current document attacker script cannot be run on it. Loading a local file at a known location is about the extent of this attack.If the local file is a media file an external helper program may be launched to play the media depending on your settings. The action will be the same as if you had clicked on a remote link of the same media type and does not present any additional risk. Local files identified as executable will never be opened in this way, with "executable" broadly defined on windows to include many scriptable document formats with a history of being abused.By referencing a local device rather than a file this could be used as a limited denial-of-service attack to hang the browser. |
CVE-2006-1942
|
| VCID-z29z-sf3c-3ubb | When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. |
CVE-2021-43533
|
| VCID-z2t7-sc17-abfs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42929
|
| VCID-z3k2-uhun-pyh3 | A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks. |
CVE-2019-11699
|
| VCID-z3r1-zkkw-8fhq | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-7756
|
| VCID-z4ad-5vm8-t3g2 | Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code. |
CVE-2016-1966
|
| VCID-z4ej-1821-k7dp | Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2026-0892
|
| VCID-z4hp-wpp1-17bu | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5460
|
| VCID-z52c-v64a-nyhb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1548
|
| VCID-z5mk-4spk-1yc1 | Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. |
CVE-2017-7813
|
| VCID-z5ts-p4r1-bkh6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1547
|
| VCID-z6kw-szww-7feq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7529
|
| VCID-z6yt-va55-s3ey | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-9401
|
| VCID-z7sd-q1rk-jqa7 | Multiple vulnerabilities have been found in Graphite, the worst of which could lead to the remote execution of arbitrary code. |
CVE-2017-7773
|
| VCID-z86r-71n4-p7aj | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5267
|
| VCID-z8c2-d83h-jua8 | Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. |
CVE-2024-11702
|
| VCID-z8cr-rten-qqg2 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
CVE-2025-1932
|
| VCID-z8f3-t842-8bfc | Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird the worst of which could lead to the execution of arbitrary code. |
CVE-2016-5270
|
| VCID-zb8g-djya-63hr | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox < 148 and Thunderbird < 148. |
CVE-2026-2800
|
| VCID-zbpq-qcww-6yg1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2019-17026
|
| VCID-zcdh-q78g-x7gr | If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through invalid credentials or locations. These messages cannot be immediately dismissed, allowing for a denial of service (DOS) attack. |
CVE-2019-9809
|
| VCID-zcuv-sdrv-1ffy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2021-38491
|
| VCID-zdbt-zhtq-xfhj | Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect Firefox running on other operating systems. |
CVE-2025-11713
|
| VCID-zdxh-fp2e-47dd | Information disclosure in the Networking component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
CVE-2026-0883
|
| VCID-zfek-fku3-2ydv | Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. |
CVE-2006-1738
|
| VCID-zgdf-pv3w-vqeb | A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. |
CVE-2020-15651
|
| VCID-zgsr-7exy-uycp | When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. |
CVE-2019-11733
|
| VCID-zh2m-qyw5-dkgn | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-17011
|
| VCID-zh6f-rvv2-sbfu | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to the execution of arbitrary code. |
CVE-2018-5102
|
| VCID-zhen-yj1c-u3d6 | Mozilla developers and community members Christian Holler, Jason Kratzer, Tobias Schneider, Tyson Smith, David Keeler, Nicolas B. Pierron, Mike Hommey, Ronald Crane, Tooru Fujisawa, and Philipp reported memory safety bugs present in Firefox 55. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. |
CVE-2017-7811
|
| VCID-zhu4-sy56-1yea | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6861
|
| VCID-zjn8-79ab-tqd3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5726
|
| VCID-zkss-5b75-e3c2 | Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs |
CVE-2025-10859
|
| VCID-znhp-5tbq-kbav |
CVE-2022-2205
|
|
| VCID-zpx3-dck3-6bfy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2018-6126
|
| VCID-zpz5-xyxk-4fby | If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. |
CVE-2017-5419
|
| VCID-zqpe-9hvc-vkbp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5725
|
| VCID-zr38-6kvs-ckdh | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5440
|
| VCID-zstj-sux9-ubdd | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2019-17010
|
| VCID-ztmj-vavn-8kdf | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. |
CVE-2022-26383
|
| VCID-zudh-fjan-hqf1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-29915
|
| VCID-zv75-mvuu-fka9 | If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". |
CVE-2025-6433
|
| VCID-zv7m-qhq6-v3aw | On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a null is found. This can potentially contain private data from the local system. *Note: This attack only affects Windows operating systems. Other operating systems are not affected.* |
CVE-2017-7790
|
| VCID-zvd4-whm3-bqcr | As part of the Firefox 1.5.0.2 release we fixed several crash bugs to improve the stability of the product, with a particular focus on finding crashes caused by DHTML. Some of these crashes showed evidence of memory corruption that we presume could be exploited to run arbitrary code with enough effort.Thunderbird shares the browser engine with Firefox and could be vulnerable if JavaScript were to be enabled in mail. This is not the default setting and we strongly discourage users from running JavaScript in mail. |
CVE-2006-1724
|
| VCID-zveb-b3t7-7yfg | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7528
|
| VCID-zvtk-5z63-k3dt | Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. |
CVE-2022-31746
|
| VCID-zxn1-pdzk-sfdb | WebRTC can use a WrappedI420Buffer pixel buffer but the owning image object can be freed while it is still in use. This can result in the WebRTC encoder using uninitialized memory, leading to a potentially exploitable crash. |
CVE-2018-5160
|
| VCID-zxu9-sqnm-gqht | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-29544
|
| VCID-zyae-qg8a-6yby | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code. |
CVE-2022-34482
|
| VCID-zycf-ufab-8yfb | The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is manipulated to update this unprotected location and the updated maintenance service in the unprotected location has been altered, the altered maintenance service can run with elevated privileges during the update process due to a lack of integrity checks. This allows for privilege escalation if the executable has been replaced locally. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* |
CVE-2019-11753
|
| VCID-zyvs-3qte-yyf4 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2023-28161
|
| VCID-zyxf-mxw2-4yc1 | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code. |
CVE-2017-5439
|