Skip to contentMozilla Firefox vulnerabilities
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the DOM: Notifications componentCVE-2025-13017Fix available8.1 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Graphics: WebGPU componentCVE-2025-130269.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Graphics: WebGPU componentCVE-2025-130257.5 High
- mozilla firefox, thunderbird +1 moreJIT miscompilation in the JavaScript Engine: JIT componentCVE-2025-130249.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript: WebAssembly componentCVE-2025-13016Fix available7.5 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to incorrect boundary conditions in the Graphics: WebGPU componentCVE-2025-130239.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Graphics: WebGPU componentCVE-2025-130229.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Graphics: WebGPU componentCVE-2025-130219.8 Critical
- mozilla firefoxSpoofing issue in FirefoxCVE-2025-13015Fix available3.4 Low
- mozilla firefox, thunderbird +1 moreUse-after-free in the Audio/Video componentCVE-2025-13014Fix available8.8 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the DOM: Core & HTML componentCVE-2025-13013Fix available6.1 Medium
- mozilla firefox, thunderbird +1 moreRace condition in the Graphics componentCVE-2025-13012Fix available7.5 High
- mozilla firefoxUse-after-free in WebGPU internals triggered from a compromised child processCVE-2025-12380Fix available9.8 Critical
- mozilla firefoxSpoofing risk in Android custom tabsCVE-2025-117208.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bug fixed in Firefox 144 and Thunderbird 144CVE-2025-117219.8 Critical
- mozilla firefoxAddress bar could be spoofed on Android using visibilitychangeCVE-2025-117186.5 Medium
- mozilla firefoxThe password edit screen was not hidden in Android card viewCVE-2025-117179.1 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free caused by the native messaging web extension API on WindowsCVE-2025-117199.8 Critical
- mozilla firefox, thunderbird +1 moreSandboxed iframes allowed links to open in external apps (Android only)CVE-2025-117166.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144CVE-2025-11715Fix available8.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144CVE-2025-11714Fix available8.8 High
- mozilla firefox, thunderbird +1 morePotential user-assisted code execution in “Copy as cURL” commandCVE-2025-11713Fix available8.1 High
- mozilla firefox, thunderbird +1 moreAn OBJECT tag type attribute overrode browser behavior on web resources without a content-typeCVE-2025-11712Fix available6.1 Medium
- mozilla firefox, thunderbird +1 moreSome non-writable Object properties could be modifiedCVE-2025-11711Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreCross-process information leaked due to malicious IPC messagesCVE-2025-11710Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreOut of bounds read/write in a privileged process triggered by WebGL texturesCVE-2025-11709Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in MediaTrackGraphImpl::GetInstance()CVE-2025-11708Fix available9.8 Critical
- mozilla firefox, firefox for ios +1 moreData stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabsCVE-2025-108594.0 Medium
- mozilla firefoxJIT miscompilation in the JavaScript Engine: JIT componentCVE-2025-111537.5 High
- mozilla firefoxSandbox escape due to integer overflow in the Graphics: Canvas2D componentCVE-2025-111528.6 High
- mozilla focus for ios, firefox focus +1 moreOpening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websitesCVE-2025-102906.5 Medium
- mozilla firefoxInformation disclosure, mitigation bypass in the Privacy component in Firefox for AndroidCVE-2025-105357.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Site Permissions componentCVE-2025-105348.1 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Web Compatibility: Tooling componentCVE-2025-105315.4 Medium
- mozilla firefox, thunderbird +1 moreSpoofing issue in the WebAuthn component in Firefox for AndroidCVE-2025-105306.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143CVE-2025-10537Fix available8.8 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: Cache componentCVE-2025-10536Fix available6.2 Medium
- mozilla firefox, thunderbird +1 moreInteger overflow in the SVG componentCVE-2025-10533Fix available8.8 High
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript: GC componentCVE-2025-10532Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Layout componentCVE-2025-10529Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D componentCVE-2025-10528Fix available7.3 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Graphics: Canvas2D componentCVE-2025-10527Fix available7.1 High
- mozilla focus for ios, firefox focus +1 moreDrag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectlyCVE-2025-550336.1 Medium
- mozilla focus for ios, firefox focus +1 moreFocus incorrectly ignores Content-Disposition headers for some MIME typesCVE-2025-550326.1 Medium
- mozilla firefox, firefox for ios +1 moreMalicious scripts could spam popups for denial of service attacksCVE-2025-550297.5 High
- mozilla firefox, firefox for ios, focus for ios +1 more +3 morePasskey phishing within Bluetooth rangeCVE-2025-550319.8 Critical
- mozilla firefox, firefox for ios +1 moreJavaScript alerts could impede UI interaction or allow denial of service attacksCVE-2025-550286.5 Medium
- mozilla firefox, firefox for ios +1 moreContent-Disposition headers incorrectly ignored for some MIME typesCVE-2025-550306.1 Medium
- mozilla firefoxAddress bar spoofing using an blob URI on Firefox for AndroidCVE-2025-83644.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142CVE-2025-9184Fix available8.1 High
- Show moreLoading…