Skip to contentMozilla Firefox vulnerabilities
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed...CVE-2021-23988Fix available8.8 High
- mozilla firefoxA malicious extension with the 'search' permission could have installed a new search engine whose...CVE-2021-23986Fix available6.5 Medium
- mozilla firefoxIf an attacker is able to alter specific about:config values (for example malware running on the...CVE-2021-23985Fix available6.5 Medium
- mozilla firefox esr, thunderbird +1 moreAn out of date graphics library (Angle) likely contained vulnerabilities that could potentially...CVE-2021-4127Fix available9.8 Critical
- mozilla firefox, firefox esr +1 moreA transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an...CVE-2021-29955Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members reported memory safety bugs present in Firefox 86 and...CVE-2021-23987Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA malicious extension could have opened a popup window lacking an address bar. The title of the...CVE-2021-23984Fix available6.5 Medium
- mozilla firefoxBy causing a transition on a parent node by removing a CSS rule, an invalid property for a marker...CVE-2021-23983Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUsing techniques that built on the slipstream research, a malicious webpage could have scanned...CVE-2021-23982Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the...CVE-2021-23981Fix available8.1 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed...CVE-2021-23979Fix available8.8 High
- mozilla firefoxFirefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a...CVE-2021-23977Fix available5.3 Medium
- mozilla firefoxNavigations through the Android-specific `intent` URL scheme could have been misused to escape...CVE-2021-23957Fix available7.4 High
- mozilla firefoxAn XSS bug in internal error pages could have led to various spoofing attacks, including other...CVE-2021-23959Fix available6.1 Medium
- mozilla firefoxContext-specific code was included in a shared jump table; resulting in assertions being...CVE-2021-23970Fix available6.5 Medium
- mozilla firefoxWhen processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the...CVE-2021-23971Fix available6.5 Medium
- mozilla firefoxOne phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www...CVE-2021-23972Fix available8.8 High
- mozilla firefoxThe DOMParser API did not properly process '<noscript>' elements for escaping. This could be used...CVE-2021-23974Fix available6.1 Medium
- mozilla firefoxThe developer page about:memory has a Measure function for exploring what object types the...CVE-2021-23975Fix available6.5 Medium
- mozilla firefoxWhen accepting a malicious intent from other installed apps, Firefox for Android accepted...CVE-2021-23976Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some...CVE-2021-23978Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen trying to load a cross-origin resource in an audio/video context a decoding error may have...CVE-2021-23973Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAs specified in the W3C Content Security Policy draft, when creating a violation report, "User...CVE-2021-23969Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf Content Security Policy blocked frame navigation, the full destination of a redirect served in...CVE-2021-23968Fix available4.3 Medium
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed...CVE-2021-23965Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some...CVE-2021-23964Fix available8.8 High
- mozilla firefoxWhen sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC...CVE-2021-23963Fix available4.3 Medium
- mozilla firefoxIncorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a...CVE-2021-23962Fix available8.8 High
- mozilla firefox, debian linux +1 moreFurther techniques that built on the slipstream research combined with a malicious webpage could...CVE-2021-23961Fix available7.4 High
- mozilla firefox, firefox esr, thunderbird +2 morePerforming garbage collection on re-declared JavaScript variables resulted in a user-after-poison...CVE-2021-23960Fix available8.8 High
- mozilla firefoxThe browser could have been confused into transferring a screen sharing state into another tab,...CVE-2021-23958Fix available6.5 Medium
- mozilla firefoxAn ambiguous file picker design could have confused users who intended to select and upload a...CVE-2021-23956Fix available6.5 Medium
- mozilla firefoxThe browser could have been confused into transferring a pointer lock state into another tab,...CVE-2021-23955Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUsing the new logical assignment operators in a JavaScript switch statement could have caused a...CVE-2021-23954Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking...CVE-2021-23953Fix available4.3 Medium
- mozilla firefox, firefox mobile +1 moreWhen a malicious application installed on the user's device broadcast an Intent to Firefox for...CVE-2020-26975Fix available6.5 Medium
- mozilla firefox, firefox mobile +1 moreBy attempting to connect a website using an unresponsive port, an attacker could have controlled...CVE-2020-26977Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the...CVE-2020-35112Fix available8.8 High
- mozilla firefoxMozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed...CVE-2020-35114Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some...CVE-2020-35113Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest...CVE-2020-35111Fix available4.3 Medium
- mozilla firefoxWhen a user typed a URL in the address bar or the search bar and quickly hit the enter key, a...CVE-2020-26979Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreUsing techniques that built on the slipstream research, a malicious webpage could have exposed...CVE-2020-26978Fix available6.1 Medium
- mozilla firefox, debian linux +1 moreWhen a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the...CVE-2020-26976Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been...CVE-2020-26974Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCertain input to the CSS Sanitizer confused it, resulting in incorrect components being removed....CVE-2020-26973Fix available8.8 High
- mozilla firefoxThe lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former...CVE-2020-26972Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreCertain blit values provided by the user were not properly constrained leading to a heap buffer...CVE-2020-26971Fix available8.8 High
- mozilla firefox, firefox mobile +1 moreIf the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version...CVE-2020-26964Fix available6.8 Medium
- mozilla firefox, firefox mobile +1 moreOneCRL was non-functional in the new Firefox for Android due to a missing service initialization....CVE-2020-26957Fix available6.5 Medium
- Show moreLoading…