Mozilla Firefox vulnerabilities

CVE-2023-6867 [MEDIUM] CWE-1021 CVE-2023-6867: The timing of a button click causing a popup to disappear was approximately the same length as the a The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.

CVE-2013-1717 [MEDIUM] CWE-264 CVE-2013-1717: Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable path

CVE-2024-2609 [MEDIUM] CWE-356 CVE-2024-2609: The permission prompt input delay could expire while the window is not in focus. This makes it vulne The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124, Firefox ESR < 115.10, and Thunderbird < 115.10.

CVE-2024-1550 [MEDIUM] CWE-1021 CVE-2024-1550: A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 1

CVE-2021-43532 [MEDIUM] CWE-601 CVE-2021-43532: The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embeddi The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. I

CVE-2022-45413 [MEDIUM] CWE-601 CVE-2022-45413: Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user Using the S.browser_fallback_url parameter parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.*This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 107.

CVE-2024-5698 [MEDIUM] CWE-1021 CVE-2024-5698: By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127.

CVE-2026-84136 [MEDIUM] CWE-79 CVE-2026-84136: Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox E Other issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVE-2023-4049 [MEDIUM] CWE-362 CVE-2023-4049: Race conditions in reference counting code were found through code inspection. These could have resu Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVE-2016-9071 [MEDIUM] CWE-254 CVE-2016-9071: Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to v Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.

CVE-2018-5107 [MEDIUM] CWE-59 CVE-2018-5107: The printing process can bypass local access protections to read files available through symlinks, b The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions. The printing process requires files in a specific format so arbitrary data cannot be read but it is possible that some local file information could be exposed. This vulnerability affects Firefox < 58.

CVE-2005-1154 [HIGH] CVE-2005-1154: Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary scr Firefox before 1.0.3 and Mozilla Suite before 1.7.7 allows remote attackers to execute arbitrary script in other domains via a setter function for a variable in the target domain, which is executed when the user visits that domain, aka "Cross-site scripting through global scope pollution."

CVE-2020-6812 [MEDIUM] CWE-200 CVE-2020-6812: The first time AirPods are connected to an iPhone, they become named after the user's name by defaul The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to sim

CVE-2018-5121 [MEDIUM] CWE-20 CVE-2018-5121: Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Internationalized Domain Name (IDN) this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox <

CVE-2017-7822 [MEDIUM] CVE-2017-7822: The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification. This might allow for the authentication key to be determined in some instances. This vulnerability affects Firefox < 56.

CVE-2020-6813 [MEDIUM] CVE-2020-6813: When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.

CVE-2025-0238 [MEDIUM] CWE-416 CVE-2025-0238: Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, lead Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

CVE-2026-113470 [MEDIUM] Mozilla Foundation Security Advisory 2026-116: CVE-2026-113470 Mozilla Foundation Security Advisory 2026-116 CVE: CVE-2026-113470 Product: Firefox Impact: high Fixed in: Firefox 158.0.2

CVE-2023-5722 [MEDIUM] CWE-203 CVE-2023-5722: Using iterative requests an attacker was able to learn the size of an opaque response, as well as th Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox < 119.

CVE-2008-5512 [MEDIUM] CWE-264 CVE-2008-5512: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Th Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute XPCNativeWrappers."