Search for packages
| purl | pkg:deb/debian/firefox-esr@115.14.0esr-1~deb11u1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-13he-qsr4-h3d4
Aliases: CVE-2026-4709 |
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-18my-61hh-n3gb
Aliases: CVE-2025-1934 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-1fv1-edht-ufag
Aliases: CVE-2026-4715 |
Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-1hay-xe3q-gyb4
Aliases: CVE-2026-2789 |
Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-1jqj-tqfp-73f7
Aliases: CVE-2025-14325 |
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-1u8u-pnq3-t7ae
Aliases: CVE-2026-2757 |
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-1v2s-g46y-ybdc
Aliases: CVE-2026-2792 |
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-1xcg-n9k4-tqc4
Aliases: CVE-2025-1011 |
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-1zf8-qjts-9fbc
Aliases: CVE-2024-11704 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-23eu-22t2-cydd
Aliases: CVE-2026-4714 |
Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-26d3-ctnj-7kbh
Aliases: CVE-2026-4691 |
Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-289s-f2w6-53g9
Aliases: CVE-2026-4716 |
Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-2ejc-7bd5-qkbf
Aliases: CVE-2025-3028 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-2j6k-5q8j-3fbc
Aliases: CVE-2024-9680 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-351y-4nek-u3aw
Aliases: CVE-2026-4698 |
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-3ayf-d2s1-67ff
Aliases: CVE-2024-8382 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 202 other vulnerabilities. |
|
VCID-3gmj-y8qd-ufej
Aliases: CVE-2026-2787 |
Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-3grf-hwk1-3fh8
Aliases: CVE-2026-4719 |
Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-3kd3-hwzv-efbn
Aliases: CVE-2026-4721 |
Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 3 other vulnerabilities. |
|
VCID-3qfb-sxha-v3cw
Aliases: CVE-2025-10529 |
Same-origin policy bypass in the Layout component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-3sg3-9yx7-fufa
Aliases: CVE-2026-2790 |
Same-origin policy bypass in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-3xgu-7evz-mffw
Aliases: CVE-2026-4705 |
Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-43nm-4qjy-vfgj
Aliases: CVE-2025-8028 |
On arm64, a WASM br_table instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. |
Affected by 124 other vulnerabilities. |
|
VCID-4bw1-v6ze-kbds
Aliases: CVE-2025-13018 |
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-4byg-5gy3-kkff
Aliases: CVE-2025-8031 |
The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. |
Affected by 124 other vulnerabilities. |
|
VCID-4g7u-xmdq-mkdn
Aliases: CVE-2025-14328 |
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-4gsx-puz4-a3f1
Aliases: CVE-2025-11708 |
Use-after-free in MediaTrackGraphImpl::GetInstance() |
Affected by 41 other vulnerabilities. |
|
VCID-4kd3-95cm-g3fc
Aliases: CVE-2025-13019 |
Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-4q6w-tdk9-d3an
Aliases: CVE-2026-4720 |
Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 3 other vulnerabilities. |
|
VCID-4xqc-36jb-63c2
Aliases: CVE-2026-2786 |
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-4zjw-4gjw-pqh1
Aliases: CVE-2025-0242 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-59wd-mtjt-4ban
Aliases: CVE-2025-11714 |
Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-5dw5-vpt8-zqbz
Aliases: CVE-2026-5731 |
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 202 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-5ept-fu7g-8kes
Aliases: CVE-2026-2780 |
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-5j6z-g7gt-qyea
Aliases: CVE-2024-11694 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-5kwn-x8e4-ukgq
Aliases: CVE-2025-14333 |
Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-646f-ndeq-5bee
Aliases: CVE-2026-4687 |
Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-66z1-8zeg-9qh1
Aliases: CVE-2025-10528 |
Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-675n-7uzz-pqdj
Aliases: CVE-2026-4688 |
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-6bbw-b3rx-a7hj
Aliases: CVE-2024-10462 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-6cx1-8t9m-u3av
Aliases: CVE-2026-0886 |
Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-6fsa-bnes-tkff
Aliases: CVE-2026-2765 |
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-6jw1-pere-ruee
Aliases: CVE-2025-11715 |
Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-77y6-jskt-qucb
Aliases: CVE-2025-59375 |
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
Affected by 3 other vulnerabilities. |
|
VCID-7eu3-hxbk-8fd7
Aliases: CVE-2025-1935 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-7q66-66b2-kucc
Aliases: CVE-2025-5266 |
Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. |
Affected by 124 other vulnerabilities. |
|
VCID-7v6j-9uuc-qkc8
Aliases: CVE-2025-4919 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. |
Affected by 124 other vulnerabilities. |
|
VCID-7wmw-hpfw-vuaa
Aliases: CVE-2026-2761 |
Sandbox escape in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-7wvh-upas-2bgh
Aliases: CVE-2024-9394 |
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. |
Affected by 124 other vulnerabilities. |
|
VCID-84jf-84jx-3fgj
Aliases: CVE-2025-14323 |
Privilege escalation in the DOM: Notifications component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-8hm6-nz5h-yfcm
Aliases: CVE-2025-4918 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. |
Affected by 124 other vulnerabilities. |
|
VCID-8k4z-rq29-mqg5
Aliases: CVE-2024-11697 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-8qyy-e4jt-rbc4
Aliases: CVE-2026-4695 |
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-8san-ze3j-dqdx
Aliases: CVE-2025-3030 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-8u4y-zrhv-8fe9
Aliases: CVE-2026-0887 |
Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-8vka-qus2-tbhj
Aliases: CVE-2026-2447 |
Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, Firefox ESR < 115.32.1, Thunderbird < 140.7.2, and Thunderbird < 147.0.2. |
Affected by 3 other vulnerabilities. |
|
VCID-8xek-k5y2-6bfp
Aliases: CVE-2026-4689 |
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-8zy6-g8kn-hbdc
Aliases: CVE-2026-2775 |
Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-93au-w2zh-3yhg
Aliases: CVE-2025-10533 |
Integer overflow in the SVG component. This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-95vw-esba-23a2
Aliases: CVE-2025-1937 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-962a-dwqf-3ycg
Aliases: CVE-2025-13016 |
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-98mt-7srw-qfh4
Aliases: CVE-2025-5283 |
A vulnerability has been discovered in libvpx, which could lead to execution of arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-9ag7-z86d-nba9
Aliases: CVE-2026-5734 |
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 202 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-9rm3-u7dy-zuhu
Aliases: CVE-2025-9180 |
Same-origin policy bypass in the Graphics: Canvas2D component. |
Affected by 124 other vulnerabilities. |
|
VCID-9zxb-j4ep-n7g9
Aliases: CVE-2026-2791 |
Mitigation bypass in the Networking: Cache component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-a8vw-n16x-duee
Aliases: CVE-2025-5264 |
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. |
Affected by 124 other vulnerabilities. |
|
VCID-a98z-hwzc-wkcj
Aliases: CVE-2026-0882 |
Use-after-free in the IPC component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-aemu-emvp-hkfh
Aliases: CVE-2024-10460 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-as4y-nhw6-akfx
Aliases: CVE-2025-4087 |
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. |
Affected by 124 other vulnerabilities. |
|
VCID-azdd-vdn3-kffy
Aliases: CVE-2026-2758 |
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-b3rg-quvp-2uha
Aliases: CVE-2025-4083 |
A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. |
Affected by 124 other vulnerabilities. |
|
VCID-b4bq-q3ga-3ff1
Aliases: CVE-2026-4707 |
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-b5jm-57h2-2qcs
Aliases: CVE-2026-2764 |
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-b6sf-z5tm-4uau
Aliases: CVE-2026-4696 |
Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-b8dx-232z-qbbc
Aliases: CVE-2026-2779 |
Incorrect boundary conditions in the Networking: JAR component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-bjny-apx2-8ba1
Aliases: CVE-2024-11695 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-bwk4-hqx8-97dy
Aliases: CVE-2024-10459 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-bzgb-mdsk-yua6
Aliases: CVE-2025-1009 |
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. |
Affected by 124 other vulnerabilities. |
|
VCID-c6rx-p235-9bdz
Aliases: CVE-2025-10537 |
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-cpez-x3zd-p7bu
Aliases: CVE-2026-2785 |
Invalid pointer in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-cypj-1jsu-cbh5
Aliases: CVE-2025-1016 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-db28-rbyf-1qf4
Aliases: CVE-2025-14329 |
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-dcjm-7xcr-ayew
Aliases: CVE-2025-5268 |
Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-ddwf-z514-hbbj
Aliases: CVE-2025-10536 |
Information disclosure in the Networking: Cache component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-deth-9krh-kufj
Aliases: CVE-2026-0890 |
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-dgwm-n1zx-qkbq
Aliases: CVE-2025-13012 |
Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-dh5k-q87q-4qfs
Aliases: CVE-2024-11696 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-dp5j-4mzw-pqer
Aliases: CVE-2025-4093 |
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-ds2y-kn7q-vuct
Aliases: CVE-2024-10464 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-dxwp-5jfs-nuew
Aliases: CVE-2026-2778 |
Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-e2k8-m9sm-8uek
Aliases: CVE-2026-4699 |
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-e7jk-vs8y-fyhr
Aliases: CVE-2025-13020 |
Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-f1zm-g4es-vfbz
Aliases: CVE-2025-0239 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-f2tn-1hq4-uffa
Aliases: CVE-2025-9179 |
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. |
Affected by 124 other vulnerabilities. |
|
VCID-f5w8-j656-akf4
Aliases: CVE-2025-1017 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-ffd7-y29n-6fan
Aliases: CVE-2025-8032 |
XSLT document loading did not correctly propagate the source document which bypassed its CSP. |
Affected by 124 other vulnerabilities. |
|
VCID-ft6u-geds-fua9
Aliases: CVE-2026-4702 |
JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-g3n8-mvdt-cqdj
Aliases: CVE-2025-3029 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-gcnq-avax-aqcv
Aliases: CVE-2026-2776 |
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-gkva-6cu9-7keg
Aliases: CVE-2026-4692 |
Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-gph4-xa9p-73fr
Aliases: CVE-2025-4091 |
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-grjt-j4at-pqbp
Aliases: CVE-2024-11692 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-h2gc-zk2a-1fg6
Aliases: CVE-2026-0884 |
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-h9em-p9se-rucn
Aliases: CVE-2025-14321 |
Use-after-free in the WebRTC: Signaling component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-hccf-ueut-vugw
Aliases: CVE-2025-14322 |
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-hetc-sghb-1fcx
Aliases: CVE-2024-8384 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 202 other vulnerabilities. |
|
VCID-hfp7-jaxc-2khq
Aliases: CVE-2025-9181 |
Uninitialized memory in the JavaScript Engine component. |
Affected by 124 other vulnerabilities. |
|
VCID-hfx8-7x82-zqfk
Aliases: CVE-2024-10466 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-hsc9-up4x-nbgs
Aliases: CVE-2026-2762 |
Integer overflow in the JavaScript: Standard Library component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-hshc-4xnc-gug4
Aliases: CVE-2026-4704 |
Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-hstd-23qm-bqdg
Aliases: CVE-2026-4717 |
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-j1hb-8jjy-tqgq
Aliases: CVE-2026-4693 |
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-j5k8-ztxb-uffb
Aliases: CVE-2025-0238 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-j6w1-yhc3-uqfw
Aliases: CVE-2025-6425 |
An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. |
Affected by 124 other vulnerabilities. |
|
VCID-jm7w-hqzq-tqde
Aliases: CVE-2025-8029 |
Thunderbird executed javascript: URLs when used in object and embed tags. |
Affected by 124 other vulnerabilities. |
|
VCID-jt6f-rpfx-7kbj
Aliases: CVE-2024-8383 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 202 other vulnerabilities. |
|
VCID-jybh-8px4-pqau
Aliases: CVE-2026-0885 |
Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-ka9e-ps8e-ryc8
Aliases: CVE-2024-9392 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-kdwy-7p45-hbcs
Aliases: CVE-2025-13015 |
Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-kk2m-2mxz-sbex
Aliases: CVE-2025-14327 |
Spoofing issue in the Downloads Panel component. This vulnerability affects Firefox < 146, Thunderbird < 146, Firefox ESR < 140.7, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-kkgh-a9hg-fud8
Aliases: CVE-2025-11710 |
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. |
Affected by 41 other vulnerabilities. |
|
VCID-kuwd-6tcg-fuha
Aliases: CVE-2026-4713 |
Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-kx3j-abfc-qfh2
Aliases: CVE-2024-9393 |
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. |
Affected by 124 other vulnerabilities. |
|
VCID-m3mp-su9k-sfhs
Aliases: CVE-2026-2763 |
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-m6uv-91wz-xfdv
Aliases: CVE-2026-4700 |
Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-m93r-91y4-xyaz
Aliases: CVE-2025-1010 |
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. |
Affected by 124 other vulnerabilities. |
|
VCID-menq-g5ce-1yd8
Aliases: CVE-2026-2793 |
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-mm6w-kpe8-4kg3
Aliases: CVE-2026-4684 |
Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-mn6j-2wd1-ukfb
Aliases: CVE-2026-2774 |
Integer overflow in the Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-mrb2-hz9y-4ufp
Aliases: CVE-2025-6430 |
When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack. |
Affected by 124 other vulnerabilities. |
|
VCID-ms9h-982a-pkdu
Aliases: CVE-2025-1014 |
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. |
Affected by 124 other vulnerabilities. |
|
VCID-mw96-qtnz-gqdx
Aliases: CVE-2024-10465 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-n2hq-1ck4-ayhp
Aliases: CVE-2025-5263 |
Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. |
Affected by 124 other vulnerabilities. |
|
VCID-n4hu-b1t6-xkay
Aliases: CVE-2024-10458 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-ndd4-kd1y-z7ep
Aliases: CVE-2026-0878 |
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-nhsr-4zux-2bck
Aliases: CVE-2026-2769 |
Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-nkpq-9gd6-nuc4
Aliases: CVE-2026-0891 |
Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 41 other vulnerabilities. |
|
VCID-ntqr-ptmu-yuen
Aliases: CVE-2026-2767 |
Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-nvsz-9s3r-nbhq
Aliases: CVE-2026-4718 |
Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-p9zh-7wyj-hffm
Aliases: CVE-2026-2771 |
Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-pcgf-xtfq-6ugb
Aliases: CVE-2025-14330 |
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-pcrz-f3nj-kybr
Aliases: CVE-2025-1938 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-pemg-ndu8-wbbc
Aliases: CVE-2026-0879 |
Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-pj4h-ff45-e3ez
Aliases: CVE-2025-1013 |
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. |
Affected by 124 other vulnerabilities. |
|
VCID-psc3-4ssv-wyb5
Aliases: CVE-2025-8027 |
On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. |
Affected by 124 other vulnerabilities. |
|
VCID-q1pv-avug-juef
Aliases: CVE-2026-2777 |
Privilege escalation in the Messaging System component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-q9f4-zumy-wbfy
Aliases: CVE-2025-8034 |
Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-qbzp-euvv-q7c7
Aliases: CVE-2026-5732 |
Affected by 202 other vulnerabilities. Affected by 1 other vulnerability. |
|
|
VCID-qeh2-jn2v-9ug7
Aliases: CVE-2025-11709 |
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. |
Affected by 41 other vulnerabilities. |
|
VCID-qgvy-hzsx-hkge
Aliases: CVE-2025-13014 |
Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-qkks-24cp-gqg2
Aliases: CVE-2026-4706 |
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-qm8f-f8nr-qba9
Aliases: CVE-2026-0880 |
Sandbox escape due to integer overflow in the Graphics component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-qta2-8rnt-k7d1
Aliases: CVE-2026-2788 |
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-qtcm-9z3v-dydn
Aliases: CVE-2025-0241 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-qz95-5z9e-7qb7
Aliases: CVE-2025-8033 |
The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. |
Affected by 124 other vulnerabilities. |
|
VCID-r29z-4m4j-8kft
Aliases: CVE-2025-6424 |
A use-after-free in FontFaceSet resulted in a potentially exploitable crash. |
Affected by 124 other vulnerabilities. |
|
VCID-r7ss-g876-c7fg
Aliases: CVE-2025-0237 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-r7vt-w149-9bfn
Aliases: CVE-2026-2773 |
Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-rcg4-7hjg-v7du
Aliases: CVE-2024-10463 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-rg63-avu7-2bdc
Aliases: CVE-2025-10527 |
Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-rkj9-dd18-xka9
Aliases: CVE-2025-5267 |
A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. |
Affected by 124 other vulnerabilities. |
|
VCID-rp5h-ym8y-skbw
Aliases: CVE-2026-4701 |
Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-ruc1-kmaz-fkbb
Aliases: CVE-2025-10532 |
Incorrect boundary conditions in the JavaScript: GC component. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3. |
Affected by 41 other vulnerabilities. |
|
VCID-s89g-7f5f-5qd2
Aliases: CVE-2025-6429 |
Thunderbird could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. |
Affected by 124 other vulnerabilities. |
|
VCID-sg2y-gfue-6qam
Aliases: CVE-2024-10461 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-sgwe-9xfj-6kav
Aliases: CVE-2026-2783 |
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-ss9j-7jd7-nbf1
Aliases: CVE-2026-2770 |
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-t2c3-smqc-zkba
Aliases: CVE-2026-0877 |
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 147, Firefox ESR < 115.32, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-t4t3-5pt5-ayds
Aliases: CVE-2026-4685 |
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-t9cw-yjar-ckfd
Aliases: CVE-2025-11712 |
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. |
Affected by 41 other vulnerabilities. |
|
VCID-te1e-sjsk-bfd8
Aliases: CVE-2026-2768 |
Sandbox escape in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-tgpf-32kg-rqc2
Aliases: CVE-2025-0240 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-tgsj-hp8b-27f9
Aliases: CVE-2025-11711 |
There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. |
Affected by 41 other vulnerabilities. |
|
VCID-tkzd-c11q-3qaf
Aliases: CVE-2025-14331 |
Same-origin policy bypass in the Request Handling component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-u3j3-fc4f-7ff7
Aliases: CVE-2026-4686 |
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-ud33-vgxh-8khj
Aliases: CVE-2026-2766 |
Use-after-free in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-ukf2-qcjg-u7bg
Aliases: CVE-2025-0243 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-ukut-zyjx-93gq
Aliases: CVE-2025-13013 |
Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-upvn-56py-8ud7
Aliases: CVE-2025-1933 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-ux24-3d83-23c6
Aliases: CVE-2024-8381 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 202 other vulnerabilities. |
|
VCID-vcnn-u8k9-8ubs
Aliases: CVE-2025-8035 |
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-vdpy-f9d9-pfac
Aliases: CVE-2024-10467 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-vszp-vyxy-f7g7
Aliases: CVE-2026-2781 |
Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-vz6w-wghm-nqaq
Aliases: CVE-2025-9185 |
Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-w4u8-25rz-gqeq
Aliases: CVE-2026-2782 |
Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-w6j3-6a6j-uqf1
Aliases: CVE-2025-1931 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-w7gj-shrq-3fcz
Aliases: CVE-2024-11699 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-wagm-cq36-k7g3
Aliases: CVE-2026-2760 |
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-wmyy-2cg3-wyhc
Aliases: CVE-2026-4697 |
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-wqw2-gjvu-6qbu
Aliases: CVE-2026-4690 |
Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-wvx2-pba2-sqha
Aliases: CVE-2026-4708 |
Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-wwdh-xmux-3qdq
Aliases: CVE-2026-2759 |
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-wwkc-4c69-cbea
Aliases: CVE-2026-2784 |
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-wz6r-xzm9-m7hp
Aliases: CVE-2025-13017 |
Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5. |
Affected by 41 other vulnerabilities. |
|
VCID-xcbn-tkgg-4ben
Aliases: CVE-2026-2772 |
Use-after-free in the Audio/Video: Playback component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. |
Affected by 41 other vulnerabilities. |
|
VCID-xghm-4ygw-tkb2
Aliases: CVE-2025-14324 |
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 146, Firefox ESR < 115.31, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird < 140.6. |
Affected by 41 other vulnerabilities. |
|
VCID-y45y-r8h7-6yez
Aliases: CVE-2025-5269 |
Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. |
Affected by 124 other vulnerabilities. |
|
VCID-y7sk-dmau-4fam
Aliases: CVE-2025-1936 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-yfwd-x224-3qe6
Aliases: CVE-2025-8030 |
Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. |
Affected by 124 other vulnerabilities. |
|
VCID-yjc2-2whn-uug5
Aliases: CVE-2026-4694 |
Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-ymak-rv52-h7a5
Aliases: CVE-2026-4710 |
Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. |
Affected by 3 other vulnerabilities. |
|
VCID-ymu8-mjph-f7a4
Aliases: CVE-2025-1012 |
A race during concurrent delazification could have led to a use-after-free. |
Affected by 124 other vulnerabilities. |
|
VCID-z6yt-va55-s3ey
Aliases: CVE-2024-9401 |
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-z8cr-rten-qqg2
Aliases: CVE-2025-1932 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
|
VCID-zdxh-fp2e-47dd
Aliases: CVE-2026-0883 |
Information disclosure in the Networking component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. |
Affected by 41 other vulnerabilities. |
|
VCID-zefw-etrb-z3fu
Aliases: CVE-2024-43097 |
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to arbitrary code execution. |
Affected by 124 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-11pv-s4za-tbch | A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. |
CVE-2024-4768
|
| VCID-135c-h34e-tye5 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40957
|
| VCID-13hn-7fbd-mfhq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1553
|
| VCID-1hak-cqnh-tqay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45406
|
| VCID-1vpc-vfey-qkb6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25732
|
| VCID-2648-ggwp-cyfv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25735
|
| VCID-2pvz-3cmq-53dk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7519
|
| VCID-2tts-gwgd-zqcz | A vulnerability has been discovered in NSS, which can lead to the recovery of private data. |
CVE-2023-5388
|
| VCID-2zdh-azdw-tuav | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-2609
|
| VCID-32pc-j3he-pffx | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4055
|
| VCID-362f-1bn1-mbg5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46882
|
| VCID-37ud-wx7n-mqhs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42927
|
| VCID-3pvs-3ppc-r7a5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3857
|
| VCID-3vbp-2h4f-7bav | A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. |
CVE-2024-2611
|
| VCID-41g2-dvb2-yqhg | Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2024-2614
|
| VCID-43dj-vtap-2qd2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32206
|
| VCID-46cy-x3cp-tke5 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0743
|
| VCID-4f4y-p7h8-dygq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5728
|
| VCID-4g3s-bh4t-qqhc | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6867
|
| VCID-4m2d-td6c-ukd4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40958
|
| VCID-4nqf-nxkj-x3g4 | GetBoundName could return the wrong version of an object when JIT optimizations were applied. |
CVE-2024-3852
|
| VCID-4q6h-ac7c-6fav | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42928
|
| VCID-4z8m-8jr8-pqh6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32212
|
| VCID-52ha-qvpu-ruc8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37208
|
| VCID-58mr-4qat-sfet | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could arbitrary code execution. |
CVE-2024-29944
|
| VCID-5hzf-gdbj-8ud8 | Double Free There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. |
CVE-2023-1999
|
| VCID-5qf5-d44c-t7gu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6862
|
| VCID-697p-cpq8-1qax | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32205
|
| VCID-6b6h-x2km-u7fb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1549
|
| VCID-6tm9-1vsh-1qa3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4047
|
| VCID-73wu-d7y3-7bge | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-1945
|
| VCID-75sb-xb3r-3fa8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4573
|
| VCID-77u8-v9gs-sfca | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25728
|
| VCID-782n-nc6m-13ec | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1551
|
| VCID-7b8k-mgs3-cud5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29550
|
| VCID-7t2x-pksm-ubgy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45416
|
| VCID-7vfx-u76f-ubet | By tricking the browser with a X-Frame-Options header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. |
CVE-2024-5691
|
| VCID-7vk4-9vwa-pbe9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45418
|
| VCID-7x5h-kej1-e3ef | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0751
|
| VCID-7zqn-1txc-r3d2 | When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. |
CVE-2024-4770
|
| VCID-878b-mn4w-wkg4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4049
|
| VCID-87mf-fznn-m3gy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6205
|
| VCID-89es-k3ja-1be1 | PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF ### Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with `isEvalSupported` set to `true` (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. ### Patches The patch removes the use of `eval`: https://github.com/mozilla/pdf.js/pull/18015 ### Workarounds Set the option `isEvalSupported` to `false`. ### References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645 |
CVE-2024-4367
GHSA-wgrm-67xf-hhpq |
| VCID-8dgu-ppan-9ub2 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4048
|
| VCID-8fny-dsut-7ba3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5171
|
| VCID-8m89-ma2u-5fgu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5730
|
| VCID-8q1b-fdq4-aqha | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45405
|
| VCID-8s22-tw1u-7kbw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45411
|
| VCID-8sba-dejt-vqfp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3861
|
| VCID-8v6z-1ktm-jygr | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23602
|
| VCID-957q-jagj-9kg7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7527
|
| VCID-9e85-bdkj-zyf3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25751
|
| VCID-9saf-1zax-5ycy | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2023-6865
|
| VCID-9the-k9nt-4bdg | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-34416
|
| VCID-9ym2-agp7-budj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23601
|
| VCID-9z3s-qfbc-vbdc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6859
|
| VCID-a8gt-y9j7-zuhs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29548
|
| VCID-abt2-6a7f-pfba | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3864
|
| VCID-ag5p-n7es-v7gh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28176
|
| VCID-ag97-q79a-xbgb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23605
|
| VCID-ajzf-jj8y-3ue3 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25729
|
| VCID-an3w-wb6n-zuee | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45410
|
| VCID-apes-5sa9-w7gd | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0755
|
| VCID-aquh-9cjg-wyey | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46877
|
| VCID-as8g-vnyj-u7hk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29539
|
| VCID-aufc-f7tk-h7hj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25746
|
| VCID-b3jt-7h5q-vqgd | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1546
|
| VCID-b3zg-y242-xybq | If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. |
CVE-2024-4767
|
| VCID-b5y9-qmw5-nkbv | If an attacker could find a way to trigger a particular code path in SafeRefPtr, it could have triggered a crash or potentially be leveraged to achieve code execution. |
CVE-2024-2612
|
| VCID-b9aw-u5wp-6uhk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5693
|
| VCID-bapg-hzuc-ykby | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4575
|
| VCID-bc7q-srps-sfd7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29541
|
| VCID-bshu-jxhj-27b8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5700
|
| VCID-bw96-5g6y-j3c4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6860
|
| VCID-bxrh-7kwf-p3at | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40956
|
| VCID-c5b5-beuj-z3gh | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40959
|
| VCID-cgvg-aj53-kkbp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-0767
|
| VCID-ch3v-nq5w-3fg4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37202
|
| VCID-cj16-a2tv-cqd7 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4574
|
| VCID-cmr4-6stm-jfe9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7524
|
| VCID-e4nx-qfam-cfaj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46872
|
| VCID-e6bs-vk6j-h3e6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6206
|
| VCID-esw4-827s-u3f1 | When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin. |
CVE-2024-4769
|
| VCID-f4xy-kftc-mug2 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32207
|
| VCID-f6qv-znt2-2bd5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6863
|
| VCID-f81v-9fv8-93cd | Out-of-bounds Write Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
CVE-2023-5217
GHSA-qqvq-6xgj-jw8g |
| VCID-fpw1-j3wb-xfd5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45408
|
| VCID-frvc-mqhd-eydh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6601
|
| VCID-fwr3-cgq1-a3b4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6204
|
| VCID-fxnj-rr7h-ryb5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46880
|
| VCID-g1af-pkh5-xygt | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25742
|
| VCID-g24d-23zk-6fgn | AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding() and AppendEncodedCharacters() could have experienced integer overflows, causing underallocation of an output buffer leading to an out of bounds write. |
CVE-2024-2608
|
| VCID-g5z1-9an3-aubs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5732
|
| VCID-ghqe-gsw9-c3e4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32211
|
| VCID-gpjz-649k-f3he | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-5696
|
| VCID-gret-hn3p-5kbk | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7531
|
| VCID-gs3s-s4zk-fyh4 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37201
|
| VCID-h5ub-djvf-nffv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3302
|
| VCID-hgy1-3pbq-s3ch | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42932
|
| VCID-hp32-swmr-qqdy | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46878
|
| VCID-j1yh-f1np-wbcv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4584
|
| VCID-jzte-jqk6-7ya6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5169
|
| VCID-kf1h-zg32-1yh4 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40960
|
| VCID-kfxp-azcd-2yej | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46871
|
| VCID-krq5-4j17-vfg9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28164
|
| VCID-kskc-agaw-8bcr | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6857
|
| VCID-ku26-71r1-vfem | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3854
|
| VCID-m26q-fgjn-yugu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25730
|
| VCID-m2sr-re2h-3baq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4050
|
| VCID-m9h1-aw7r-jqb2 | An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. |
CVE-2024-7652
|
| VCID-mc6m-8uzs-pkgu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25744
|
| VCID-mfs8-2vzs-pybf | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-3859
|
| VCID-mh92-65bz-43ds | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5721
|
| VCID-mj7n-8hf6-2qar | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5724
|
| VCID-mm7x-rfzg-uqfc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45404
|
| VCID-mwj3-wa1g-buay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37207
|
| VCID-n8gb-hpjb-v7a5 | Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. |
CVE-2024-2607
|
| VCID-ngja-2eff-h7hk | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-34414
|
| VCID-pepm-1t68-uuf1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6864
|
| VCID-pse8-xnc7-gkbv | Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. |
CVE-2024-2610
|
| VCID-pvvt-h3mh-33eb | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0741
|
| VCID-pybb-2ny2-quas | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6209
|
| VCID-q494-zvyn-quge | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46881
|
| VCID-qdqj-rhcr-wbca | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6856
|
| VCID-qy44-ubss-x7et | Multiple vulnerabilities have been found in Mozilla Thunderbird, the world of which could result in arbitrary code execution. |
CVE-2022-40962
|
| VCID-rafq-49c4-u7g6 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32215
|
| VCID-rarq-q7qa-nud7 | Multiple vulnerabilities have been found in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-32213
|
| VCID-rbna-kkn2-2baj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5176
|
| VCID-rbuu-mph9-7uay | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1550
|
| VCID-s556-eg79-77gu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7522
|
| VCID-s95f-9g8b-s3es | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. |
CVE-2024-5690
|
| VCID-sfyj-m6xa-8bbc | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4581
|
| VCID-sh7r-dftz-kyhn | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4045
|
| VCID-ss1w-euua-83gz | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1552
|
| VCID-su89-u51g-z3hs | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23598
|
| VCID-svqy-5b6h-7yfj | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6603
|
| VCID-t4rc-yuj8-n7au | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0746
|
| VCID-t52p-7rr7-57ax | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6604
|
| VCID-t8gg-ptc1-qfdw | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4056
|
| VCID-tce3-s87t-2qh8 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25737
|
| VCID-tegn-2y58-t3de | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7521
|
| VCID-tps4-kxe2-5ugb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6858
|
| VCID-tutg-2zzk-4uam | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6207
|
| VCID-u9pc-4b61-gkeg | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could lead to remote code execution. |
CVE-2024-5702
|
| VCID-uh95-a456-7kbx | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0747
|
| VCID-uuxf-cyfq-p3e2 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45412
|
| VCID-uvzd-dxhu-hydg | An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. |
CVE-2022-3266
|
| VCID-v789-nhyw-wugk | If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. |
CVE-2024-5688
|
| VCID-vcf2-b7mj-tfg4 | To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. |
CVE-2024-2616
|
| VCID-vdzj-kqfy-d3b7 | libwebp: OOB write in BuildHuffmanTable Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2023-4863
GHSA-j7hp-h8jx-5ppr |
| VCID-vjw1-g5kk-zuda | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-4046
|
| VCID-vma9-r6uy-p7c1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6208
|
| VCID-vmm4-dq3p-kqhu | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-37211
|
| VCID-vwkf-9gfp-d3cy | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0749
|
| VCID-w1cg-up6a-7ycg | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-28162
|
| VCID-w2xw-eupp-cqgf | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25739
|
| VCID-w794-gqex-83du | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-6602
|
| VCID-w814-2cmz-ruhz | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29535
|
| VCID-wcfk-t1kd-2kgv | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-25752
|
| VCID-xan8-8fq6-yfgd | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0742
|
| VCID-xevc-xbcg-1yct | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7526
|
| VCID-xg25-xm9t-cfb8 | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0750
|
| VCID-xyqa-esey-73e1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7525
|
| VCID-y3v2-cyyc-yyep | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45403
|
| VCID-y8xv-ss2c-4bhk | Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2024-0753
|
| VCID-yb18-qe5e-dbck | Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. |
CVE-2024-4777
|
| VCID-yc74-5kag-2bdn | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45409
|
| VCID-yd2q-assr-v3er | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6212
|
| VCID-ydz6-761h-jbeq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45421
|
| VCID-yhj1-h62u-mud5 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29533
|
| VCID-yjyu-u73t-u7bh | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-29536
|
| VCID-yuhg-jeet-cffp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-45420
|
| VCID-yxdd-fgbw-rug1 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2023-23603
|
| VCID-yxy6-s185-myc9 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could result in arbitrary code execution. |
CVE-2022-46874
|
| VCID-z2t7-sc17-abfs | Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in arbitrary code execution. |
CVE-2022-42929
|
| VCID-z52c-v64a-nyhb | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1548
|
| VCID-z5ts-p4r1-bkh6 | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-1547
|
| VCID-z6kw-szww-7feq | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2024-7529
|
| VCID-zhu4-sy56-1yea | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-6861
|
| VCID-zqpe-9hvc-vkbp | Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution. |
CVE-2023-5725
|