Mozilla
Page 6 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3031 | Medium | 6.5 | 2025-04-01 | An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. |
CVE-2025-3030 | High | 8.1 | 2025-04-01 | Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-3029 | High | 7.3 | 2025-04-01 | A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
CVE-2025-3028 | Medium | 6.5 | 2025-04-01 | JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firef… |
CVE-2025-2857 | Critical | 10.0 | 2025-03-27 | Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child proces… |
CVE-2025-26696 | High | 7.0 | 2025-03-10 | Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
CVE-2025-26695 | Medium | 5.3 | 2025-03-10 | When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emai… |
CVE-2025-27426 | Medium | 5.4 | 2025-03-04 | Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox fo… |
CVE-2025-27425 | Medium | 4.3 | 2025-03-04 | Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. T… |
CVE-2025-27424 | Medium | 4.3 | 2025-03-04 | Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS… |
CVE-2025-1943 | High | 8.2 | 2025-03-04 | Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-1942 | Critical | 9.8 | 2025-03-04 | When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability… |
CVE-2025-1941 | Critical | 9.1 | 2025-03-04 | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245… |
CVE-2025-1940 | High | 7.1 | 2025-03-04 | A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an ext… |
CVE-2025-1939 | Low | 3.9 | 2025-03-04 | Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into gran… |
CVE-2025-1938 | Medium | 6.5 | 2025-03-04 | Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-1937 | High | 7.5 | 2025-03-04 | Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of… |
CVE-2025-1936 | High | 7.3 | 2025-03-04 | jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but… |
CVE-2025-1935 | Medium | 4.3 | 2025-03-04 | A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR… |
CVE-2025-1934 | Medium | 6.5 | 2025-03-04 | It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was no… |
CVE-2025-1933 | High | 7.6 | 2025-03-04 | On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a di… |
CVE-2025-1932 | High | 8.1 | 2025-03-04 | An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This… |
CVE-2025-1931 | High | 7.5 | 2025-03-04 | It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerabil… |
CVE-2025-1930 | High | 8.8 | 2025-03-04 | On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led t… |
CVE-2025-1414 | Medium | 6.5 | 2025-02-18 | Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2025-1020 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-1019 | Medium | 4.3 | 2025-02-04 | The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack… |
CVE-2025-1018 | Medium | 5.3 | 2025-02-04 | The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential sp… |
CVE-2025-1017 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-1016 | Critical | 9.8 | 2025-02-04 | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bug… |
CVE-2025-1015 | Medium | 5.4 | 2025-02-04 | The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malici… |
CVE-2025-1014 | High | 8.8 | 2025-02-04 | Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Fir… |
CVE-2025-1013 | Medium | 6.5 | 2025-02-04 | A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vu… |
CVE-2025-1012 | High | 7.5 | 2025-02-04 | A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7… |
CVE-2025-1011 | High | 8.8 | 2025-02-04 | A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vul… |
CVE-2025-1010 | High | 8.8 | 2025-02-04 | An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefo… |
CVE-2025-1009 | Critical | 9.8 | 2025-02-04 | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135… |
CVE-2025-0510 | Medium | 6.5 | 2025-02-04 | Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vu… |
CVE-2025-23109 | Medium | 6.5 | 2025-01-11 | Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for i… |
CVE-2025-23108 | Medium | 4.3 | 2025-01-11 | Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnera… |
CVE-2025-0247 | Critical | 9.8 | 2025-01-07 | Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-0246 | Medium | 6.5 | 2025-01-07 | When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating sys… |
CVE-2025-0245 | Low | 3.3 | 2025-01-07 | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixe… |
CVE-2025-0244 | Medium | 5.3 | 2025-01-07 | When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other oper… |
CVE-2025-0243 | Medium | 5.1 | 2025-01-07 | Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-0242 | Medium | 6.5 | 2025-01-07 | Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bug… |
CVE-2025-0241 | High | 7.7 | 2025-01-07 | When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 1… |
CVE-2025-0240 | Medium | 4.0 | 2025-01-07 | Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability w… |
CVE-2025-0239 | Medium | 4.0 | 2025-01-07 | When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Fi… |
CVE-2025-0238 | Medium | 5.3 | 2025-01-07 | Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability… |
CVE-2025-0237 | Medium | 5.4 | 2025-01-07 | The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal bein… |
CVE-2024-53976 | Medium | 5.4 | 2024-11-26 | Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the… |
CVE-2024-53975 | Medium | 5.4 | 2024-11-26 | Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to, misleadingly, appear secure. This vul… |
CVE-2024-11708 | Medium | 6.5 | 2024-11-26 | Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox < 133 an… |
CVE-2024-11706 | Medium | 6.5 | 2024-11-26 | A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed o… |
CVE-2024-11705 | Critical | 9.1 | 2024-11-26 | `NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading… |
CVE-2024-11704 | Critical | 9.8 | 2024-11-26 | A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key c… |
CVE-2024-11703 | Medium | 5.7 | 2024-11-26 | On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox <… |
CVE-2024-11702 | High | 7.5 | 2024-11-26 | Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history… |
CVE-2024-11701 | Medium | 4.3 | 2024-11-26 | The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible sp… |
CVE-2024-11700 | High | 8.1 | 2024-11-26 | Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of… |
CVE-2024-11699 | High | 8.8 | 2024-11-26 | Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-11698 | Critical | 9.8 | 2024-11-26 | A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened durin… |
CVE-2024-11697 | High | 8.8 | 2024-11-26 | When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog. This could have l… |
CVE-2024-11696 | Medium | 5.4 | 2024-11-26 | The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an i… |
CVE-2024-11695 | Medium | 5.4 | 2024-11-26 | A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This… |
CVE-2024-11694 | Medium | 6.1 | 2024-11-26 | Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the W… |
CVE-2024-11693 | Critical | 9.8 | 2024-11-26 | The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating systems. Other operating… |
CVE-2024-11692 | Medium | 4.3 | 2024-11-26 | An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability… |
CVE-2024-11691 | High | 8.8 | 2024-11-26 | Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver… |
CVE-2023-2142 | Medium | 6.1 | 2024-11-26 | In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two… |
CVE-2023-1521 | High | 7.8 | 2024-11-26 | On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_P… |
CVE-2023-0163 | High | 8.4 | 2024-11-26 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Mozilla Convict. This allows an attacker to inject… |
CVE-2024-11159 | Medium | 4.3 | 2024-11-13 | Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird < 128.4.3 and Thunderbird <… |
CVE-2024-10941 | Medium | 6.5 | 2024-11-06 | A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126. |
CVE-2024-10474 | Medium | 6.5 | 2024-10-29 | Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL sa… |
CVE-2024-10468 | Medium | 5.3 | 2024-10-29 | Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 13… |
CVE-2024-10467 | High | 8.8 | 2024-10-29 | Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-10466 | High | 7.5 | 2024-10-29 | By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability… |
CVE-2024-10465 | Medium | 6.5 | 2024-10-29 | A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbir… |
CVE-2024-10464 | Medium | 6.5 | 2024-10-29 | Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing r… |
CVE-2024-10463 | Medium | 6.5 | 2024-10-29 | Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Th… |
CVE-2024-10462 | Medium | 6.5 | 2024-10-29 | Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird… |
CVE-2024-10461 | Medium | 6.1 | 2024-10-29 | In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could al… |
CVE-2024-10460 | Medium | 5.3 | 2024-10-29 | The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-10459 | High | 7.5 | 2024-10-29 | An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox <… |
CVE-2024-10458 | High | 7.5 | 2024-10-29 | A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Fire… |
CVE-2024-10004 | Critical | 9.1 | 2024-10-15 | Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon sho… |
CVE-2024-9936 | Medium | 6.5 | 2024-10-14 | When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vuln… |
CVE-2024-9680 | Critical | 9.8 | 2024-10-09 | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulner… |
CVE-2024-9403 | High | 7.3 | 2024-10-01 | Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2024-9402 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume tha… |
CVE-2024-9401 | Critical | 9.8 | 2024-10-01 | Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptio… |
CVE-2024-9400 | High | 8.8 | 2024-10-01 | A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. Th… |
CVE-2024-9399 | High | 7.5 | 2024-10-01 | A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulner… |
CVE-2024-9398 | Medium | 5.3 | 2024-10-01 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that… |
CVE-2024-9397 | Medium | 6.1 | 2024-10-01 | A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking. This vulnerabilit… |
CVE-2024-9396 | High | 8.8 | 2024-10-01 | It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. T… |
CVE-2024-9395 | Medium | 5.3 | 2024-10-01 | A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affec… |
CVE-2024-9394 | High | 7.5 | 2024-10-01 | An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to a… |