Mozilla
Page 5 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10531 | Medium | 5.4 | 2025-09-16 | Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10530 | Medium | 6.5 | 2025-09-16 | Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-10529 | Medium | 6.5 | 2025-09-16 | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. |
CVE-2025-10528 | High | 7.3 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3… |
CVE-2025-10527 | High | 7.1 | 2025-09-16 | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and… |
CVE-2025-10290 | Medium | 6.5 | 2025-09-16 | Opening links via the contextual menu in Focus iOS for certain URL schemes would fail to load but would not refresh the toolbar correctly, allowing attackers t… |
CVE-2025-9187 | Critical | 9.8 | 2025-08-19 | Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-9186 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142. |
CVE-2025-9185 | High | 8.1 | 2025-08-19 | Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunder… |
CVE-2025-9184 | High | 8.1 | 2025-08-19 | Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruptio… |
CVE-2025-9183 | Medium | 6.5 | 2025-08-19 | Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2. |
CVE-2025-9182 | High | 7.5 | 2025-08-19 | Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, a… |
CVE-2025-9181 | Medium | 6.5 | 2025-08-19 | Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, T… |
CVE-2025-9180 | High | 8.1 | 2025-08-19 | Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR… |
CVE-2025-9179 | Critical | 9.8 | 2025-08-19 | An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents sl… |
CVE-2025-8364 | Medium | 4.3 | 2025-08-19 | A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Androi… |
CVE-2025-8042 | Critical | 9.8 | 2025-08-19 | Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141. |
CVE-2025-8041 | Medium | 5.3 | 2025-08-19 | In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox… |
CVE-2025-55033 | Medium | 6.1 | 2025-08-19 | Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS attacks. This vulnerability… |
CVE-2025-55032 | Medium | 6.1 | 2025-08-19 | Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS… |
CVE-2025-55031 | Critical | 9.8 | 2025-08-19 | Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have… |
CVE-2025-55030 | Medium | 6.1 | 2025-08-19 | Firefox for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline rather than downloading, pot… |
CVE-2025-55029 | High | 7.5 | 2025-08-19 | Malicious scripts could bypass the popup blocker to spam new tabs, potentially resulting in denial of service attacks. This vulnerability was fixed in Firefox… |
CVE-2025-55028 | Medium | 6.5 | 2025-08-19 | Malicious scripts utilizing repetitive JavaScript alerts could prevent client user interaction in some scenarios and allow for denial of service attacks. This… |
CVE-2025-54145 | Critical | 9.1 | 2025-08-19 | The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme… |
CVE-2025-54144 | Medium | 5.4 | 2025-08-19 | The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a… |
CVE-2025-54143 | Critical | 9.8 | 2025-08-19 | Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vu… |
CVE-2025-8044 | Critical | 9.8 | 2025-07-22 | Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-8043 | Critical | 9.8 | 2025-07-22 | Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141. |
CVE-2025-8040 | High | 8.8 | 2025-07-22 | Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruptio… |
CVE-2025-8039 | High | 8.1 | 2025-07-22 | In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 1… |
CVE-2025-8038 | Critical | 9.8 | 2025-07-22 | Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141… |
CVE-2025-8037 | Critical | 9.1 | 2025-07-22 | Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie includ… |
CVE-2025-8036 | High | 8.1 | 2025-07-22 | Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Fire… |
CVE-2025-8035 | High | 8.8 | 2025-07-22 | Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of th… |
CVE-2025-8034 | High | 8.8 | 2025-07-22 | Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunder… |
CVE-2025-8033 | Medium | 6.5 | 2025-07-22 | The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in… |
CVE-2025-8032 | High | 8.1 | 2025-07-22 | XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13… |
CVE-2025-8031 | Critical | 9.8 | 2025-07-22 | The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability… |
CVE-2025-8030 | High | 8.1 | 2025-07-22 | Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in F… |
CVE-2025-8029 | High | 8.1 | 2025-07-22 | Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 14… |
CVE-2025-8028 | Critical | 9.8 | 2025-07-22 | On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect compu… |
CVE-2025-8027 | Medium | 6.5 | 2025-07-22 | On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulner… |
CVE-2025-6703 | Medium | 6.5 | 2025-06-26 | Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. |
CVE-2025-6436 | High | 8.1 | 2025-06-24 | Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-6435 | High | 8.1 | 2025-06-24 | If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file… |
CVE-2025-6434 | Medium | 4.3 | 2025-06-24 | The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker… |
CVE-2025-6433 | Critical | 9.8 | 2025-06-24 | If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would… |
CVE-2025-6432 | High | 8.6 | 2025-06-24 | When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not respondin… |
CVE-2025-6431 | Medium | 6.5 | 2025-06-24 | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed th… |
CVE-2025-6430 | Medium | 6.1 | 2025-06-24 | When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<… |
CVE-2025-6429 | Medium | 6.5 | 2025-06-24 | Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypas… |
CVE-2025-6428 | Medium | 4.3 | 2025-06-24 | When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing… |
CVE-2025-6427 | Critical | 9.1 | 2025-06-24 | An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connectio… |
CVE-2025-6426 | High | 8.8 | 2025-06-24 | The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of… |
CVE-2025-6425 | Medium | 4.3 | 2025-06-24 | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between cont… |
CVE-2025-6424 | Critical | 9.8 | 2025-06-24 | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.1… |
CVE-2025-5986 | Medium | 6.5 | 2025-06-11 | A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompti… |
CVE-2025-5687 | High | 7.8 | 2025-06-11 | A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating sy… |
CVE-2025-49710 | Critical | 9.8 | 2025-06-11 | An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4. |
CVE-2025-49709 | Critical | 9.8 | 2025-06-11 | Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4. |
CVE-2025-5272 | High | 7.3 | 2025-05-27 | Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-5271 | Medium | 6.5 | 2025-05-27 | Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thun… |
CVE-2025-5270 | High | 7.5 | 2025-05-27 | In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. |
CVE-2025-5269 | High | 8.1 | 2025-05-27 | Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort t… |
CVE-2025-5268 | High | 8.1 | 2025-05-27 | Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption… |
CVE-2025-5267 | Medium | 5.4 | 2025-05-27 | A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in… |
CVE-2025-5266 | Medium | 4.3 | 2025-05-27 | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed… |
CVE-2025-5265 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially lead… |
CVE-2025-5264 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leadin… |
CVE-2025-5263 | Medium | 4.3 | 2025-05-27 | Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed… |
CVE-2025-5262 | High | 7.5 | 2025-05-27 | A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memo… |
CVE-2025-5020 | Medium | 4.3 | 2025-05-21 | Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTT… |
CVE-2025-4919 | High | 8.8 | 2025-05-17 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 1… |
CVE-2025-4918 | Critical | 9.8 | 2025-05-17 | An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 1… |
CVE-2025-3932 | Medium | 6.5 | 2025-05-14 | It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accesse… |
CVE-2025-3909 | High | 8.1 | 2025-05-14 | Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested ema… |
CVE-2025-3875 | High | 7.5 | 2025-05-14 | Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From hea… |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-4093 | High | 8.1 | 2025-04-29 | Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort thi… |
CVE-2025-4092 | Medium | 6.5 | 2025-04-29 | Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-4091 | High | 8.1 | 2025-04-29 | Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-4090 | Medium | 5.3 | 2025-04-29 | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefo… |
CVE-2025-4089 | Medium | 5.1 | 2025-04-29 | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
CVE-2025-4088 | Medium | 6.5 | 2025-04-29 | A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invo… |
CVE-2025-4087 | Medium | 4.8 | 2025-04-29 | A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This cou… |
CVE-2025-4086 | Medium | 6.5 | 2025-04-29 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. … |
CVE-2025-4085 | High | 7.1 | 2025-04-29 | An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. Th… |
CVE-2025-4084 | Medium | 5.7 | 2025-04-29 | Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leadi… |
CVE-2025-4083 | Critical | 9.1 | 2025-04-29 | A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level docu… |
CVE-2025-4082 | Medium | 5.9 | 2025-04-29 | Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate… |
CVE-2025-2817 | High | 8.8 | 2025-04-29 | Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By… |
CVE-2025-3523 | Medium | 6.4 | 2025-04-15 | When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering ove… |
CVE-2025-3522 | Medium | 6.3 | 2025-04-15 | Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird a… |
CVE-2025-2830 | Medium | 6.3 | 2025-04-15 | By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when t… |
CVE-2025-3608 | Medium | 6.5 | 2025-04-15 | A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This… |
CVE-2025-3035 | Medium | 5.3 | 2025-04-01 | By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This v… |
CVE-2025-3034 | High | 8.1 | 2025-04-01 | Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-3033 | High | 7.7 | 2025-04-01 | After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
CVE-2025-3032 | High | 7.4 | 2025-04-01 | Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox… |