Mozilla Security Vulnerabilities (CVEs)

This vulnerability involves uninitialized memory in the JavaScript Engine component of Mozilla products, which could allow an attacker to execute arbi...

This vulnerability allows attackers to cause denial-of-service through memory exhaustion in Firefox and Thunderbird's WebRender graphics component. It...

This CVE describes memory safety vulnerabilities in Firefox and Thunderbird that could allow memory corruption. With sufficient effort, attackers coul...

Firefox for Android displayed URLs incorrectly by truncating from the end instead of showing the origin first, potentially hiding malicious domains. T...

This vulnerability in Firefox for iOS allows malicious scripts to bypass the popup blocker, enabling attackers to open excessive new tabs. This could ...

This vulnerability in Focus for iOS allows attackers to execute malicious JavaScript by dragging specially crafted links to the URL bar, potentially l...

This vulnerability allows search terms to persist in the URL bar after navigating away from search pages, potentially exposing sensitive search querie...

This CVE describes memory safety bugs in multiple Mozilla products that could lead to memory corruption. With sufficient effort, attackers could poten...

This vulnerability in Thunderbird and Firefox allows attackers to bypass Cross-Origin Resource Sharing (CORS) protections using DNS rebinding attacks....

This vulnerability allows attackers to bypass Firefox for Android's external link prompt, potentially exposing users to security vulnerabilities or pr...

This vulnerability allows DNS requests to bypass SOCKS proxy configurations when Multi-Account Containers is enabled and either the domain name is inv...

This vulnerability in Firefox and Thunderbird allows saved files from the Network tab in Devtools to lack the .download extension, potentially causing...

This vulnerability in Firefox for macOS fails to warn users before opening files with the 'terminal' extension, bypassing security warnings. It affect...

Firefox incorrectly parses URLs in embed tags, rewriting them to youtube.com and bypassing website security checks that restrict embed domains. This a...

A privilege escalation vulnerability in Mozilla VPN on macOS allows a local user to gain root privileges. This affects macOS users running Mozilla VPN...

Memory safety vulnerabilities in Firefox and Thunderbird could allow attackers to corrupt memory and potentially execute arbitrary code. This affects ...

This vulnerability in Firefox and Thunderbird's 'Copy as cURL' feature allows command injection via insufficient newline character escaping. An attack...

This CVE describes an XS-Leaks (Cross-Site Leaks) vulnerability in Firefox and Thunderbird where script elements loading cross-origin resources genera...

This CVE describes memory safety bugs in Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could potenti...

This vulnerability allows unencrypted transmission of Server Name Indication (SNI) data even when encrypted DNS is enabled, potentially exposing which...

A double-free vulnerability in Thunderbird's WebRTC encoder initialization could cause memory corruption and potentially exploitable crashes. This aff...

This vulnerability in Thunderbird allows attackers to execute JavaScript in the file:/// context by crafting a malicious email attachment. When Thunde...

This vulnerability allows an attacker with control over a content process to abuse the privileged UITour actor, potentially leading to information dis...

This vulnerability in Thunderbird and Firefox allows attackers to trigger undefined behavior through XPath parsing, potentially leading to out-of-boun...

This vulnerability in Firefox and Thunderbird's 'copy as cURL' feature allows attackers to craft malicious commands with insufficient escaping of spec...

This CVE describes memory safety bugs in Mozilla Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could...

A memory safety vulnerability in Firefox ESR and Thunderbird could allow attackers to execute arbitrary code on affected systems. This affects Firefox...

This vulnerability allows a medium-integrity user process to interfere with Thunderbird's SYSTEM-level updater by manipulating file-locking behavior. ...

This vulnerability in Thunderbird email client causes misleading hover text when emails contain multiple attachments with external links. Only the las...

A race condition in Firefox's nsHttpTransaction component could allow memory corruption, potentially leading to arbitrary code execution. This affects...

This vulnerability allows JavaScript code to trigger a use-after-free condition during XSLT document transformations in Mozilla browsers and email cli...

This vulnerability allows attackers to craft URLs with specific Unicode characters that hide the true origin of web pages, enabling spoofing attacks. ...

This vulnerability allows an attacker to read 32 bits of sensitive data from the stack in JIT-compiled JavaScript functions. It affects Firefox web br...

This vulnerability allows file descriptors from the fork server to leak into web content processes, potentially enabling privilege escalation attacks....

This CVE describes memory safety bugs in Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could potenti...

This vulnerability in Thunderbird email client incorrectly displays signed OpenPGP messages as encrypted messages when crafted MIME emails claim to co...