Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious command could be hidden in devtools output on WindowsCVE-2023-23599Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreArbitrary file read from GTK drag and drop on LinuxCVE-2023-23598Fix available6.5 Medium
- mozilla firefoxLogic bug in process allocation allowed to read arbitrary filesCVE-2023-23597Fix available6.5 Medium
- mozilla firefoxMozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory...CVE-2022-46885Fix available8.8 High
- mozilla firefoxMozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team...CVE-2022-46883Fix available8.8 High
- mozilla firefoxDuring startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow...CVE-2022-409616.5 Medium
- mozilla firefox, firefox mobile +1 moreA website that had permission to access the microphone could record audio without the audio...CVE-2022-384744.3 Medium
- mozilla firefoxWhen visiting a website with an overly long URL, the user interface would start to hang. Due to...CVE-2022-36317Fix available6.5 Medium
- mozilla firefox for ios, firefox mobile +1 moreInternal URLs are protected by a secret UUID key, which could have been leaked to web page...CVE-2022-317466.5 Medium
- mozilla firefoxWhen closed or sent to the background, Firefox for Android would not properly record and persist...CVE-2022-29910Fix available6.1 Medium
- mozilla firefoxUnder certain circumstances, a JavaScript alert (or prompt) could have been shown while another...CVE-2022-22762Fix available4.3 Medium
- mozilla firefoxWhen clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be...CVE-2022-22758Fix available8.8 High
- mozilla firefoxBy generally accepting and passing resource handles across processes, a compromised content...CVE-2022-22750Fix available6.5 Medium
- mozilla firefoxWhen scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do...CVE-2022-22749Fix available4.3 Medium
- mozilla firefoxIf Firefox was installed to a world-writable directory, a local privilege escalation could occur...CVE-2022-22736Fix available7.0 High
- mozilla firefox, firefox for ios +1 moreThe search term could have been specified externally to trigger SQL injection. This vulnerability...CVE-2022-18879.8 Critical
- mozilla firefoxIf a domain name contained a RTL character, it would cause the domain to be rendered to the right...CVE-2021-42214.3 Medium
- mozilla firefoxWhen transitioning in and out of fullscreen mode, a graphics object was not correctly protected;...CVE-2021-41286.5 Medium
- mozilla firefoxMozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the...CVE-2022-46879Fix available8.8 High
- mozilla firefox, debian linux +1 moreBy confusing the browser, the fullscreen notification could have been delayed or suppressed,...CVE-2022-46877Fix available4.3 Medium
- mozilla firefoxBecause Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who...CVE-2022-46873Fix available8.8 High
- mozilla firefox, debian linux +1 moreAn out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited...CVE-2022-46871Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA use-after-free in WebGL extensions could have led to a potentially exploitable crash. This...CVE-2022-46882Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn optimization in WebGL was incorrect in some cases, and could have led to memory corruption and...CVE-2022-46881Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA missing check related to tex units could have led to a use-after-free and potentially...CVE-2022-46880Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team...CVE-2022-46878Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .atloc and .ftploc files, which...CVE-2022-46875Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA file with a long filename could have had its filename truncated to remove the valid extension,...CVE-2022-46874Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker who compromised a content process could have partially escaped the sandbox to read...CVE-2022-46872Fix available8.6 High
- davidmoreno onion, mozilla firefox +1 moredavidmoreno onion Log response.c onion_response_flush allocation of resourcesCVE-2022-40663.5 Low
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in...CVE-2022-45421Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered...CVE-2022-45420Fix available6.5 Medium
- mozilla firefoxIf the user added a security exception for an invalid TLS certificate, opened an ongoing TLS...CVE-2022-454196.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have...CVE-2022-45418Fix available6.1 Medium
- mozilla firefoxService Workers did not detect Private Browsing Mode correctly in all cases, which could have led...CVE-2022-454174.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreKeyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread...CVE-2022-45416Fix available6.5 Medium
- mozilla firefoxWhen downloading an HTML file, if the title of the page was formatted as a filename with a...CVE-2022-454157.8 High
- mozilla firefoxUsing the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a...CVE-2022-45413Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be...CVE-2022-45412Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreCross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing...CVE-2022-45411Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the...CVE-2022-45410Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe garbage collector could have been aborted in several states and zones and <code>GCRuntime:...CVE-2022-45409Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popups that reuse windowName, an attacker can cause a window to go fullscreen...CVE-2022-45408Fix available6.5 Medium
- mozilla firefoxIf an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after...CVE-2022-454077.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may...CVE-2022-45406Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreFreeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have...CVE-2022-45405Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window...CVE-2022-45404Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreService Workers should not be able to infer information about opaque cross-origin responses; but...CVE-2022-45403Fix available6.5 Medium
- mozilla firefoxLogins saved by Firefox should be managed by the Password Manager component which uses encryption...CVE-2022-42931Fix available3.3 Low
- mozilla firefoxIf two Workers were simultaneously initializing their CacheStorage, a data race could have...CVE-2022-42930Fix available7.1 High
- Show moreLoading…