Skip to contentMozilla Firefox For vulnerabilities
- mozilla firefox for ios, firefox mobile +1 moreAn attacker could have accessed internal pages or data by ex-filtrating a security key from...CVE-2023-490609.8 Critical
- mozilla firefox for ios, firefox mobile +1 moreWhen opening a page in reader mode, the redirect URL could have caused attacker-controlled script...CVE-2023-57586.1 Medium
- mozilla firefox, firefox for ios +1 moreThe session restore helper crashed whenever there was no parameter sent to the message handler....CVE-2023-37456Public exploit6.5 Medium
- mozilla firefox, firefox for ios +1 moreThe permission request prompt from the site in the background tab was overlaid on top of the site...CVE-2023-374555.4 Medium
- mozilla firefox for android, focus for android, firefox focus +1 more +3 moreWhen recording the screen while in Private Browsing on Firefox for Android the address bar and...CVE-2023-295466.5 Medium
- mozilla firefox for android, focus for android, firefox focus +1 more +3 moreDifferent techniques existed to obscure the fullscreen notification in Firefox and Focus for...CVE-2023-295349.1 Critical
- mozilla firefox for android, firefox mobile +1 moreA potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on...CVE-2023-257477.5 High
- mozilla firefox, firefox for android, focus +2 more +4 moreMozilla developers Randell Jesup, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team...CVE-2023-29551Fix available8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the...CVE-2023-29549Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreWhen a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain...CVE-2023-29547Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreIf multiple instances of resource exhaustion occurred at the incorrect time, the garbage...CVE-2023-29544Fix available6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a...CVE-2023-29543Fix available8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUsing a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to...CVE-2023-29540Fix available6.1 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI...CVE-2023-29538Fix available4.3 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreMultiple race conditions in the font initialization could have led to memory corruption and...CVE-2023-29537Fix available7.5 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreMozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the...CVE-2023-29550Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result....CVE-2023-29548Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFirefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be...CVE-2023-29541Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreWhen handling the filename directive in the Content-Disposition header, the filename would be...CVE-2023-29539Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn attacker could cause the memory manager to incorrectly free a pointer that addresses attacker...CVE-2023-29536Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreFollowing a Garbage Collector compaction, weak maps may have been accessed before they were...CVE-2023-29535Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreA website could have obscured the fullscreen notification by using a combination of <code>window...CVE-2023-29533Fix available4.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreScanning a QR code that contained a javascript: URL would have resulted in the Javascript being...CVE-2019-170036.1 Medium
- mozilla firefox for ios, firefox mobile +1 moreInternal URLs are protected by a secret UUID key, which could have been leaked to web page...CVE-2022-317466.5 Medium
- mozilla firefox, firefox for ios +1 moreThe search term could have been specified externally to trigger SQL injection. This vulnerability...CVE-2022-18879.8 Critical
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...CVE-2022-1802Public exploitFix availableEPSS 28.5%8.8 High
- mozilla firefox, firefox esr, firefox for android +1 more +3 moreAn attacker could have sent a message to the parent process where the contents were used to...CVE-2022-1529Fix availableEPSS 17.6%8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...CVE-2022-26486In KEVFix available9.6 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...CVE-2022-26485In KEVPublic exploitFix availableEPSS 14.3%8.8 High
- mozilla firefox, firefox for android +1 moreA malicious webpage could have forced a Firefox for Android user into executing attacker...CVE-2021-299536.1 Medium
- mozilla firefox, firefox for ios +1 moreWhen a download was initiated, the client did not check whether it was in normal or private...CVE-2021-299584.3 Medium
- mozilla firefox, firefox for android +1 moreWhen Web Render components were destructed, a race condition could have caused undefined behavior...CVE-2021-29952Fix available7.5 High
- mozilla firefox for android, firefox mobile +1 moreWhen typing in a password under certain conditions, a race may have occured where the...CVE-2020-156713.1 Low
- mozilla firefox, firefox esr, firefox for android +2 more +4 moreMozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these...CVE-2020-15670Fix available8.8 High
- mozilla firefox, firefox for android, firefox mobile +2 moreA lock was missing when accessing a data structure and importing certificate information into the...CVE-2020-15668Fix available4.3 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen trying to load a non-video in an audio/video context the exact status code (200, 302, 404,...CVE-2020-15666Fix available6.5 Medium
- mozilla firefox, firefox esr, firefox for android +2 more +4 moreBy holding a reference to the eval() function from an about:blank window, a malicious webpage...CVE-2020-15664Fix available6.5 Medium
- mozilla firefox, firefox for ios +1 moreA unicode RTL order character in the downloaded file name can be used to change the file's name...CVE-2020-156514.3 Medium
- mozilla firefox, firefox for +1 moreA Content Provider in Firefox for Android allowed local files accessible by the browser to be...CVE-2020-156477.4 High
- mozilla firefox for ios, firefox mobile +1 moreA rogue webpage could override the injected WKUserScript used by the download feature, this...CVE-2020-156626.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreA rogue webpage could override the injected WKUserScript used by the logins autofill, this...CVE-2020-156616.5 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen performing EC scalar point multiplication, the wNAF point multiplication algorithm was used;...CVE-2020-6829Fix available5.3 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreDuring ECDSA signature generation, padding applied in the nonce designed to ensure constant-time...CVE-2020-12401Fix available4.7 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen converting coordinates from projective to affine, the modular inversion was not performed in...CVE-2020-12400Fix available4.7 Medium
- mozilla firefox for ios, firefox mobile +1 moreIndexedDB should be cleared when leaving private browsing mode and it is not, the API for...CVE-2020-124146.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreFor native-to-JS bridging the app requires a unique token to be passed that ensures non-app code...CVE-2020-124044.3 Medium
- mozilla firefox for ios, firefox mobile +1 moreFor native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code...CVE-2020-68307.5 High