Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, firefox esr, thunderbird +2 moreTruncation of a long URL could have allowed origin spoofing in a permission prompt. This...CVE-2024-10462Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header...CVE-2024-10461Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe origin of an external protocol handler prompt could have been obscured using a data: URL...CVE-2024-10460Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused a use-after-free when accessibility was enabled, leading to a...CVE-2024-10459Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA permission leak could have occurred from a trusted site to an untrusted site via `embed` or ...CVE-2024-10458Fix available7.5 High
- mozilla firefox, firefox for ios +1 moreOpening an external link to an HTTP website when Firefox iOS was previously closed and had an...CVE-2024-100049.1 Critical
- mozilla firefoxWhen manipulating the selection node cache, an attacker may have been able to cause unexpected...CVE-2024-9936Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreAn attacker was able to achieve code execution in the content process by exploiting a use-after...CVE-2024-9680In KEVPublic exploitFix availableEPSS 23.2%9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory...CVE-2024-9403Fix available7.3 High
- mozilla firefoxA specially crafted filename containing a large number of spaces could obscure the file's...CVE-2024-93955.3 Medium
- mozilla firefoxA user who enables full-screen mode on a specially crafted web page could potentially be...CVE-2024-93916.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of...CVE-2024-9402Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird...CVE-2024-9401Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA potential memory corruption vulnerability could be triggered if an attacker had the ability to...CVE-2024-9400Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA website configured to initiate a specially crafted WebTransport session could crash the Firefox...CVE-2024-9399Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreBy checking the result of calls to `window.open` with specifically set protocol handlers, an...CVE-2024-9398Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA missing delay in directory upload UI could have made it possible for an attacker to trick a...CVE-2024-9397Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt is currently unknown if this issue is exploitable but a condition may arise where the...CVE-2024-9396Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under...CVE-2024-9394Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under...CVE-2024-9393Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA compromised content process could have allowed for the arbitrary loading of cross-origin pages....CVE-2024-9392Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could write data to the user's clipboard, bypassing the user prompt, during a certain...CVE-2024-8900Fix available7.5 High
- mozilla firefox, firefox for android +1 moreUnder certain conditions, an attacker with the ability to redirect users to a malicious site via...CVE-2024-88976.1 Medium
- mozilla focus for ios, firefox focus +1 moreWebsites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This...CVE-2024-83994.7 Medium
- mozilla firefoxMemory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory...CVE-2024-8389Fix available9.8 Critical
- mozilla firefoxMultiple prompts and panels from both Firefox and the Android OS could be used to obscure the...CVE-2024-83885.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of...CVE-2024-8387Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreIf a site had been granted the permission to open popup windows, it could cause Select elements...CVE-2024-8386Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an...CVE-2024-8385Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreThe JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were...CVE-2024-8384Fix available9.8 Critical
- mozilla firefox, firefox esr +1 moreFirefox normally asks for confirmation before asking the operating system to find an application...CVE-2024-8383Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreInternal browser event interfaces were exposed to web content when privileged EventHandler...CVE-2024-8382Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA potentially exploitable type confusion could be triggered when looking up a property name on an...CVE-2024-8381Public exploitFix available9.8 Critical
- mozilla firefox for ios, firefox mobile +1 moreLong pressing on a download link could potentially allow Javascript commands to be executed...CVE-2024-431116.1 Medium
- mozilla firefox for ios, firefox mobile +1 moreThe contextual menu for links could provide an opportunity for cross-site scripting attacks This...CVE-2024-431136.1 Medium
- mozilla firefox for ios, firefox mobile +1 moreLong pressing on a download link could potentially provide a means for cross-site scripting This...CVE-2024-431126.1 Medium
- mozilla firefoxIncorrect garbage collection interaction could have led to a use-after-free. This vulnerability...CVE-2024-7530Fix available8.8 High
- mozilla firefox, firefox esr +1 moreCalling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can...CVE-2024-7531Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe date picker could partially obscure security prompts. This could be used by a malicious site...CVE-2024-7529Fix available6.5 Medium
- mozilla firefox, firefox mobile +1 moreA select option could partially obscure security prompts. This could be used by a malicious site...CVE-2024-7523Fix available8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreIncorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This...CVE-2024-7528Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreUnexpected marking work at the start of sweeping could have led to a use-after-free. This...CVE-2024-7527Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could...CVE-2024-7526Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIt was possible for a web extension with minimal permissions to create a `StreamFilter` which...CVE-2024-7525Fix available8.1 High
- mozilla firefox, firefox esr +1 moreFirefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced...CVE-2024-7524Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreEditor code failed to check an attribute value. This could have led to an out-of-bounds read....CVE-2024-7522Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIncomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability...CVE-2024-7521Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code...CVE-2024-7520Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreInsufficient checks when processing graphics shared memory could have led to memory corruption....CVE-2024-7519Fix available9.6 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreSelect options could obscure the fullscreen notification dialog. This could be used by a...CVE-2024-7518Fix available6.5 Medium
- Show moreLoading…