Mozilla Security Vulnerabilities (CVEs)

CVE-2023-25733 is a null pointer dereference vulnerability in Firefox's graphics subsystem where the return value from gfx::SourceSurfaceSkia::Map() w...

CVE-2023-32209 is a memory corruption vulnerability in Firefox where a maliciously crafted favicon could cause an out-of-memory crash. This affects Fi...

This vulnerability allows attackers to trigger denial of service conditions on Windows systems by exploiting protocol handlers ms-cxh and ms-cxh-full ...

This vulnerability in Firefox, Firefox ESR, and Thunderbird allows attackers to bypass popup notification delays, tricking users into granting permiss...

This vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird involves using an uninitialized value as a read limit when processing files, poten...

This vulnerability allows temporary permissions granted to local HTML files (loaded via file: URLs) to persist across different local files in the sam...

CVE-2023-28176 is a memory safety vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird that could allow memory corruption. With sufficient e...

This is a use-after-free vulnerability in Mozilla's memory manager that allows an attacker to cause incorrect pointer freeing, leading to memory corru...

This vulnerability allows attackers to perform reflected file download attacks by exploiting NULL character truncation in Firefox's Content-Dispositio...

This vulnerability allows attackers to execute arbitrary commands on Linux systems by tricking users into downloading malicious .desktop files through...

CVE-2023-29550 is a collection of memory safety bugs in Mozilla products that could lead to memory corruption. With sufficient effort, attackers could...

This vulnerability allows Firefox/Thunderbird extensions to bypass permission prompts when opening external schemes (like file://, mailto:, etc.), ena...

This vulnerability in Firefox's developer tools allows attackers to manipulate URL previews to overwrite global objects in privileged code. It affects...

This vulnerability allows attackers to craft malicious Windows .url shortcut files that, when downloaded and opened in Firefox on Windows, can trigger...

This vulnerability involves an invalid downcast from nsTextNode to SVGElement in Mozilla products, which could lead to undefined behavior including po...

This vulnerability is a use-after-free flaw in Firefox, Thunderbird, and Firefox ESR that occurs when failed module load requests aren't properly chec...

This vulnerability in Firefox Focus allows malicious websites to spoof browser interface elements by entering fullscreen mode without proper user noti...

CVE-2023-25745 is a memory safety vulnerability in Firefox that could allow memory corruption and potentially arbitrary code execution. It affects Fir...

This vulnerability allows an attacker to craft a malicious PKCS 12 certificate bundle that triggers arbitrary memory writes when processed by affected...

This CVE describes memory safety bugs in Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could potenti...

This CVE describes a regular expression denial of service (ReDoS) vulnerability in Mozilla's bleach library when parsing style attributes. Attackers c...

CVE-2022-21190 is a prototype pollution vulnerability in the convict configuration management library for Node.js that allows attackers to modify obje...

CVE-2022-29167 is a regular expression denial-of-service (ReDoS) vulnerability in the Hawk HTTP authentication library. Attackers can craft malicious ...

CVE-2022-22143 is a prototype pollution vulnerability in the convict configuration management library for Node.js. It allows attackers to modify objec...

This vulnerability in Firefox, Thunderbird, and Firefox ESR on macOS allows malicious .inetloc files to execute commands without displaying the standa...

This CVE describes memory safety bugs in Mozilla products that could lead to memory corruption. With sufficient effort, attackers could potentially ex...

This vulnerability involves an incorrect type conversion from 64-bit to 32-bit integers in Mozilla products, allowing memory corruption that could lea...

A use-after-free vulnerability in Mozilla's WebAssembly (wasm) implementation could allow an attacker to cause memory corruption and potentially execu...

Firefox and Thunderbird incorrectly accepted newline characters in HTTP/3 headers, interpreting them as separate headers. This allows attackers to per...

This CVE describes memory safety bugs in Mozilla Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could...

This CVE describes memory safety bugs in Mozilla Thunderbird and Firefox ESR that could lead to memory corruption. With sufficient effort, attackers c...

This vulnerability allows a malicious document to trigger a use-after-free condition during browser shutdown, leading to memory corruption and potenti...

This CVE describes memory safety bugs in Mozilla Firefox and Thunderbird that could lead to memory corruption. With sufficient effort, attackers could...

This vulnerability in Firefox and Thunderbird involves incorrect handling of inline list-item elements as block elements, leading to out-of-bounds mem...

CVE-2021-29990 is a memory corruption vulnerability in Firefox that could allow attackers to execute arbitrary code on affected systems. It affects Fi...

This vulnerability involves uninitialized memory in a canvas object in Mozilla Thunderbird and Firefox, which could lead to incorrect memory deallocat...

This vulnerability involves a memory corruption flaw in Mozilla's JavaScript engine caused by instruction reordering during garbage collection. Attack...

A race condition in the getaddrinfo function in Mozilla Thunderbird and Firefox on Linux systems could cause memory corruption and lead to a potential...

This vulnerability allows a malicious webpage to trigger a use-after-free memory corruption in Mozilla browsers when accessibility features are enable...

Firefox for Android versions before 90 automatically filled saved passwords on insecure (non-HTTPS) websites without requiring user interaction. This ...

This CVE describes memory safety bugs in Mozilla's code shared between Firefox and Thunderbird that could lead to memory corruption. With sufficient e...