Mozilla Firefox vulnerabilities

CVE-2026-117894 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117894 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117894 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-117932 Mozilla Foundation Security Advisory 2026-118: CVE-2026-117932 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-117932 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118005 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118005 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118005 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118014 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118014 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118014 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118012 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118012 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118012 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118013 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118013 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118013 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118015 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118015 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118015 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118017 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118017 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118017 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118016 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118016 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118016 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118020 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118020 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118020 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118021 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118021 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118021 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2026-118019 Mozilla Foundation Security Advisory 2026-118: CVE-2026-118019 Mozilla Foundation Security Advisory 2026-118 CVE: CVE-2026-118019 Product: Firefox Impact: low Fixed in: Firefox 159

CVE-2014-1582 [MEDIUM] CWE-310 CVE-2014-1582: The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly conside The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary reco

CVE-2013-1689 [MEDIUM] CWE-20 CVE-2013-1689: Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), rel Mozilla Firefox 20.0a1 and earlier allows remote attackers to cause a denial of service (crash), related to event handling with frames.

CVE-2014-1530 [MEDIUM] CWE-79 CVE-2014-1530: The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbir The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.

CVE-2006-0297 [MEDIUM] CVE-2006-0297: Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, Multiple integer overflows in Mozilla Firefox 1.5, Thunderbird 1.5 if Javascript is enabled in mail, and SeaMonkey before 1.0 might allow remote attackers to execute arbitrary code via the (1) EscapeAttributeValue in jsxml.c for E4X, (2) nsSVGCairoSurface::Init in SVG, and (3) nsCanvasRenderingContext2D.cpp in Canvas.

CVE-2013-5611 [MEDIUM] CVE-2013-5611: Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation.

CVE-2016-2833 [MEDIUM] CWE-79 CVE-2016-2833: Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java a Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted applet.

CVE-2010-1125 [MEDIUM] CWE-200 CVE-2010-1125: The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMo The JavaScript implementation in Mozilla Firefox 3.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the focus method.

CVE-2010-3399 [MEDIUM] CVE-2010-3399: The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11 The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerabilit