Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, thunderbird +1 moreUse-after-free caused by the native messaging web extension API on WindowsCVE-2025-117199.8 Critical
- mozilla firefox, thunderbird +1 moreSandboxed iframes allowed links to open in external apps (Android only)CVE-2025-117166.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144CVE-2025-11715Fix available8.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144CVE-2025-11714Fix available8.8 High
- mozilla firefox, thunderbird +1 morePotential user-assisted code execution in “Copy as cURL” commandCVE-2025-11713Fix available8.1 High
- mozilla firefox, thunderbird +1 moreAn OBJECT tag type attribute overrode browser behavior on web resources without a content-typeCVE-2025-11712Fix available6.1 Medium
- mozilla firefox, thunderbird +1 moreSome non-writable Object properties could be modifiedCVE-2025-11711Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreCross-process information leaked due to malicious IPC messagesCVE-2025-11710Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreOut of bounds read/write in a privileged process triggered by WebGL texturesCVE-2025-11709Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in MediaTrackGraphImpl::GetInstance()CVE-2025-11708Fix available9.8 Critical
- mozilla firefox, firefox for ios +1 moreData stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabsCVE-2025-108594.0 Medium
- mozilla firefoxJIT miscompilation in the JavaScript Engine: JIT componentCVE-2025-111537.5 High
- mozilla firefoxSandbox escape due to integer overflow in the Graphics: Canvas2D componentCVE-2025-111528.6 High
- mozilla focus for ios, firefox focus +1 moreOpening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websitesCVE-2025-102906.5 Medium
- mozilla firefoxInformation disclosure, mitigation bypass in the Privacy component in Firefox for AndroidCVE-2025-105357.5 High
- mozilla firefox, thunderbird +1 moreSpoofing issue in the Site Permissions componentCVE-2025-105348.1 High
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Web Compatibility: Tooling componentCVE-2025-105315.4 Medium
- mozilla firefox, thunderbird +1 moreSpoofing issue in the WebAuthn component in Firefox for AndroidCVE-2025-105306.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143CVE-2025-10537Fix available8.8 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: Cache componentCVE-2025-10536Fix available6.2 Medium
- mozilla firefox, thunderbird +1 moreInteger overflow in the SVG componentCVE-2025-10533Fix available8.8 High
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the JavaScript: GC componentCVE-2025-10532Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Layout componentCVE-2025-10529Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D componentCVE-2025-10528Fix available7.3 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the Graphics: Canvas2D componentCVE-2025-10527Fix available7.1 High
- mozilla focus for ios, firefox focus +1 moreDrag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectlyCVE-2025-550336.1 Medium
- mozilla focus for ios, firefox focus +1 moreFocus incorrectly ignores Content-Disposition headers for some MIME typesCVE-2025-550326.1 Medium
- mozilla firefox, firefox for ios +1 moreMalicious scripts could spam popups for denial of service attacksCVE-2025-550297.5 High
- mozilla firefox, firefox for ios, focus for ios +1 more +3 morePasskey phishing within Bluetooth rangeCVE-2025-550319.8 Critical
- mozilla firefox, firefox for ios +1 moreJavaScript alerts could impede UI interaction or allow denial of service attacksCVE-2025-550286.5 Medium
- mozilla firefox, firefox for ios +1 moreContent-Disposition headers incorrectly ignored for some MIME typesCVE-2025-550306.1 Medium
- mozilla firefoxAddress bar spoofing using an blob URI on Firefox for AndroidCVE-2025-83644.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142CVE-2025-9184Fix available8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 142 and Thunderbird 142CVE-2025-9187Fix available9.8 Critical
- mozilla firefoxSpoofing issue in the Address Bar componentCVE-2025-91836.5 Medium
- mozilla firefoxSpoofing issue in the Address Bar component of Firefox Focus for AndroidCVE-2025-91866.5 Medium
- mozilla firefox, thunderbird +1 moreDenial-of-service due to out-of-memory in the Graphics: WebRender componentCVE-2025-9182Fix available7.5 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142CVE-2025-9185Fix available8.1 High
- mozilla firefox, thunderbird +1 moreUninitialized memory in the JavaScript Engine componentCVE-2025-9181Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSame-origin policy bypass in the Graphics: Canvas2D componentCVE-2025-9180Fix available8.1 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to invalid pointer in the Audio/Video: GMP componentCVE-2025-9179Fix available9.8 Critical
- mozilla firefoxSandboxed iframe could start downloadsCVE-2025-80429.8 Critical
- mozilla firefoxIncorrect URL truncation in Firefox for AndroidCVE-2025-80415.3 Medium
- mozilla firefox, firefox for ios +1 moreScanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websitesCVE-2025-541459.1 Critical
- mozilla firefox, firefox for ios +1 moreInternal Firefox open-text URL scheme allowed loading of arbitrary URLsCVE-2025-541445.4 Medium
- mozilla firefox, firefox for ios +1 moreSandboxed iframes could allow local downloads despite sandbox restrictionsCVE-2025-541439.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 141 and Thunderbird 141CVE-2025-80449.8 Critical
- mozilla firefox, thunderbird +1 moreIncorrect URL truncationCVE-2025-80439.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141CVE-2025-8040Fix available8.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141CVE-2025-8035Fix available8.8 High
- Show moreLoading…