Mozilla Firefox vulnerabilities

CVE-2009-0356 [MEDIUM] CVE-2009-0356: Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about Mozilla Firefox before 3.0.6 and SeaMonkey do not block links to the (1) about:plugins and (2) about:config URIs from .desktop files, which allows user-assisted remote attackers to bypass the Same Origin Policy and execute arbitrary code with chrome privileges via vectors involving the URL field in a Desktop Entry section of a .desktop file, related to repres

CVE-2023-6867 [MEDIUM] CWE-1021 CVE-2023-6867: The timing of a button click causing a popup to disappear was approximately the same length as the a The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.

CVE-2017-7770 [MEDIUM] CWE-20 CVE-2017-7770: A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then ent A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered. This would allow a malicious site to displayed a spoofed addressbar, showing the location of an arbitrary website instead of the one loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is

CVE-2024-1550 [MEDIUM] CWE-1021 CVE-2024-1550: A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 1

CVE-2021-43532 [MEDIUM] CWE-601 CVE-2021-43532: The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embeddi The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. I

CVE-2022-45413 [MEDIUM] CWE-601 CVE-2022-45413: Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user Using the S.browser_fallback_url parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 107.

CVE-2024-5698 [MEDIUM] CWE-1021 CVE-2024-5698: By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127.

CVE-2016-9071 [MEDIUM] CWE-254 CVE-2016-9071: Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to v Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.

CVE-2024-4769 [MEDIUM] CWE-351 CVE-2024-4769: When importing resources using Web Workers, error messages would distinguish the difference between When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

CVE-2018-5173 [MEDIUM] CWE-20 CVE-2018-5173: The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This

CVE-2018-5107 [MEDIUM] CWE-59 CVE-2018-5107: The printing process can bypass local access protections to read files available through symlinks, b The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requires files in a specific format so arbitrary data cannot be read but it is possible that some local file information could be exposed. This vulnerability affects Firefox < 58.

CVE-2018-5121 [MEDIUM] CWE-20 CVE-2018-5121: Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Internationalized Domain Name (IDN) this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox <

CVE-2017-7822 [MEDIUM] CVE-2017-7822: The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. This vulnerability affects Firefox < 56.

CVE-2017-7815 [MEDIUM] CWE-20 CVE-2017-7815: On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Jav On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view. Note: This attack only affects installations with e10 multiprocess turned off. Installations with e10s turned on do not s

CVE-2007-0994 [MEDIUM] CWE-94 CVE-2007-0994: A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allows remote attackers to execute arbitrary JavaScript as the user via an HTML mail message with a javascript: URI in an (1) img, (2) link, or (3) style tag, which bypasses the access checks and executes code with chrom

CVE-2025-0238 [MEDIUM] CWE-416 CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, lead Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

CVE-2023-5722 [MEDIUM] CWE-203 CVE-2023-5722: Using iterative requests an attacker was able to learn the size of an opaque response, as well as th Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox < 119.

CVE-2026-2804 [MEDIUM] CWE-416 CVE-2026-2804: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

CVE-2026-9078 [MEDIUM] CWE-451 CVE-2026-9078: Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names ( Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portions of the displayed domain, causing attacker-controlled sites to appear as trusted origins. This vulnerability was fixed in Firefox for iOS 151.1.

CVE-2026-0886 [MEDIUM] CWE-119 CVE-2026-0886: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147 Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.