Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...CVE-2022-28289Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreDue to a layout change, iframe contents could have been rendered outside of its border. This...CVE-2022-28286Fix available5.4 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...CVE-2022-28285Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy using a link with <code>rel="localization"</code> a use-after-free could have been triggered...CVE-2022-28282Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register...CVE-2022-28281Public exploitFix available8.8 High
- mozilla firefox esr, thunderbird +1 moreAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a...CVE-2022-1196Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 more<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in...CVE-2022-1097Fix available6.5 Medium
- mozilla firefoxIn unusual circumstances, an individual thread may outlive the thread's manager during shutdown....CVE-2022-26385Fix available6.5 Medium
- mozilla firefoxWhile the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was...CVE-2022-26382Fix available4.3 Medium
- mozilla firefoxMozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety...CVE-2022-0843Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen installing an add-on, Firefox verified the signature before prompting the user; but while...CVE-2022-26387Fix available7.5 High
- mozilla firefox esr, thunderbird +1 morePreviously Firefox for macOS and Linux would download temporary files to a user-specific...CVE-2022-26386Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code>...CVE-2022-26384Fix available9.6 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resizing a popup after requesting fullscreen access, the popup would not display the...CVE-2022-26383Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading...CVE-2022-26381Fix available8.8 High
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...CVE-2022-26486In KEVFix available9.6 Critical
- mozilla firefox, firefox esr, firefox for android +4 more +6 moreRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...CVE-2022-26485In KEVPublic exploitFix availableEPSS 14.3%8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused...CVE-2022-22753Fix available7.1 High
- mozilla thunderbirdIt may be possible for an attacker to craft an email message that causes Thunderbird to perform...CVE-2022-0566Fix available8.8 High
- mozilla pollbotopen redirect in pollbotCVE-2022-0637Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present...CVE-2022-22764Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a...CVE-2022-22763Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly...CVE-2022-22761Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreWhen importing resources using Web Workers, error messages would distinguish the difference...CVE-2022-22760Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently...CVE-2022-22759Fix available9.6 Critical
- mozilla firefoxRemote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have...CVE-2022-22757Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user was convinced to drag and drop an image to their desktop or other folder, the resulting...CVE-2022-22756Fix available8.8 High
- mozilla firefoxBy using XSL Transforms, a malicious webserver could have served a user an XSL document that...CVE-2022-22755Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf a user installed an extension of a particular type, the extension could have auto-updated...CVE-2022-22754Fix available6.5 Medium
- mozilla firefoxMozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan...CVE-2022-0511Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreA race condition could have allowed bypassing the fullscreen notification which could have lead...CVE-2022-22746Fix available5.9 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped...CVE-2022-22744Fix available8.8 High
- mozilla firefoxMozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in...CVE-2022-22752Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele...CVE-2022-22751Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious websites could have confused Firefox into showing the wrong origin when asking to...CVE-2022-22748Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAfter accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the...CVE-2022-22747Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreSecuritypolicyviolation events could have leaked cross-origin information for frame-ancestors...CVE-2022-22745Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen navigating from inside an iframe while requesting fullscreen access, an attacker-controlled...CVE-2022-22743Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen inserting text while in edit mode, some characters might have lead to out-of-bounds memory...CVE-2022-22742Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreWhen resizing a popup while requesting fullscreen access, the popup would have become unable to...CVE-2022-22741Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreCertain network request objects were freed too early when releasing a network request handle....CVE-2022-22740Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreMalicious websites could have tricked users into accepting launching a program to handle an...CVE-2022-22739Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreApplying a CSS filter effect could have accessed out of bounds memory. This could have lead to a...CVE-2022-22738Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreConstructing audio sinks could have lead to a race condition when playing audio files and closing...CVE-2022-22737Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreIt was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox....CVE-2021-4140Fix available10.0 Critical
- mozilla thunderbirdWhen receiving an OpenPGP/MIME signed email message that contains an additional outer MIME...CVE-2021-4126Fix available6.5 Medium
- mozilla thunderbird, debian linux +1 moreThunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution...CVE-2021-43528Fix available6.5 Medium
- mozilla firefoxA Universal XSS vulnerability was present in Firefox for Android resulting from improper...CVE-2021-43530Public exploit6.1 Medium
- mozilla firefoxWhen a user loaded a Web Extensions context menu, the Web Extension could access the post...CVE-2021-435314.3 Medium
- mozilla firefoxThe 'Copy Image Link' context menu action would copy the final image URL after redirects. By...CVE-2021-435326.1 Medium
- Show moreLoading…