Mozilla Firefox vulnerabilities

CVE-2015-7217 [MEDIUM] CWE-119 CVE-2015-7217: The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly ena The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.

CVE-2025-8041 [MEDIUM] CWE-451 CVE-2025-8041: In the address bar, Firefox for Android truncated the display of URLs from the end instead of priori In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.

CVE-2026-6777 [MEDIUM] CWE-20 CVE-2026-6777: Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunde Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CVE-2025-0243 [MEDIUM] CWE-787 CVE-2025-0243: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderb

CVE-2015-0822 [MEDIUM] CWE-200 CVE-2015-0822: The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Th The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code.

CVE-2005-2706 [MEDIUM] CVE-2005-2706: Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript w Firefox before 1.0.7 and Mozilla before Suite 1.7.12 allows remote attackers to execute Javascript with chrome privileges via an about: page such as about:mozilla.

CVE-2011-3062 [MEDIUM] CWE-682 CVE-2011-3062: Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attac Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

CVE-2012-4205 [MEDIUM] CWE-352 CVE-2012-4205: Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system pr Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.

CVE-2016-1523 [MEDIUM] CVE-2016-1523: The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozi The SillMap::readFace function in FeatureMap.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font.

CVE-2026-109721 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109721 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109721 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-113400 Mozilla Foundation Security Advisory 2026-111: CVE-2026-113400 Mozilla Foundation Security Advisory 2026-111 CVE: CVE-2026-113400 Product: Firefox Impact: low Fixed in: Firefox 158.0.1

CVE-2016-9077 [HIGH] CWE-362 CVE-2016-9077: Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50.

CVE-2026-109731 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109731 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109731 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-117967 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117967 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117967 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117928 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117928 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117928 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117965 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117965 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117965 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117921 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117921 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117921 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117992 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117992 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117992 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117941 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117941 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117941 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117868 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117868 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117868 Product: Firefox Impact: low Fixed in: Firefox 159