Mozilla Firefox vulnerabilities

CVE-2024-11695 [MEDIUM] CWE-1021 CVE-2024-11695: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin o A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

CVE-2023-5723 [MEDIUM] CVE-2023-5723: An attacker with temporary script access to a site could have set a cookie containing invalid charac An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could have led to unknown errors. This vulnerability affects Firefox < 119.

CVE-2024-9398 [MEDIUM] CWE-203 CVE-2024-9398: By checking the result of calls to `window.open` with specifically set protocol handlers, an attacke By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVE-2026-12299 [MEDIUM] CWE-843 CVE-2026-12299: JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, F JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-0890 [MEDIUM] CWE-290 CVE-2026-0890: Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in F Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

CVE-2025-10531 [MEDIUM] CWE-288 CVE-2025-10531: Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firef Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

CVE-2026-12330 [MEDIUM] CWE-119 CVE-2026-12330: Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.

CVE-2024-3862 [MEDIUM] CWE-908 CVE-2024-3862: The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. This vulnerability affects Firefox < 125.

CVE-2026-6778 [MEDIUM] CWE-476 CVE-2026-6778: Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-12301 [MEDIUM] Mozilla Foundation Security Advisory 2026-57: CVE-2026-12301 Mozilla Foundation Security Advisory 2026-57 CVE: CVE-2026-12301 Product: Firefox Impact: high Fixed in: Firefox 152

CVE-2026-12300 [MEDIUM] Mozilla Foundation Security Advisory 2026-57: CVE-2026-12300 Mozilla Foundation Security Advisory 2026-57 CVE: CVE-2026-12300 Product: Firefox Impact: high Fixed in: Firefox 152

CVE-2026-6783 [MEDIUM] CWE-190 CVE-2026-6783: Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnera Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-6775 [MEDIUM] CWE-119 CVE-2026-6775: Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 a Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2026-6779 [MEDIUM] CWE-20 CVE-2026-6779: Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thun Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2014-1577 [MEDIUM] CVE-2014-1577: The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an i

CVE-2007-3285 [MEDIUM] CWE-264 CVE-2007-3285: Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type che Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.

CVE-2011-3062 [MEDIUM] CWE-682 CVE-2011-3062: Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attac Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

CVE-2014-1506 [MEDIUM] CWE-22 CVE-2014-1506: Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Androi Directory traversal vulnerability in Android Crash Reporter in Mozilla Firefox before 28.0 on Android allows attackers to trigger the transmission of local files to arbitrary servers, or cause a denial of service (application crash), via a crafted application that specifies Android Crash Reporter arguments.

CVE-2012-1942 [HIGH] CWE-264 CVE-2012-1942: The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMo The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context.

CVE-2011-0059 [MEDIUM] CWE-352 CVE-2011-0059: Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3. Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests that were initiated by a plugin and received a 307 redirect to a page on a different web site.