Mozilla Firefox vulnerabilities

CVE-2015-4482 [MEDIUM] CWE-119 CVE-2015-4482: mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows loc mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.

CVE-2013-1671 [MEDIUM] CWE-20 CVE-2013-1671: Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attac Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site.

CVE-2015-7223 [MEDIUM] CWE-264 CVE-2015-7223: The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site.

CVE-2020-6810 [MEDIUM] CWE-290 CVE-2020-6810: After a website had entered fullscreen mode, it could have used a previously opened popup to obscure After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. This vulnerability affec

CVE-2013-1696 [MEDIUM] CWE-264 CVE-2013-1696: Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, whic Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.

CVE-2020-26963 [MEDIUM] CVE-2020-26963: Repeated calls to the history and location interfaces could have been used to hang the browser. This Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by introducing rate-limiting to these API calls. This vulnerability affects Firefox < 83.

CVE-2020-12404 [MEDIUM] CWE-79 CVE-2020-12404: For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.

CVE-2021-29962 [MEDIUM] CWE-404 CVE-2021-29962: Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.

CVE-2020-15665 [MEDIUM] CVE-2020-15665: Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to r Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80.

CVE-2013-5594 [MEDIUM] CWE-1021 CVE-2013-5594: Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding

CVE-2021-29958 [MEDIUM] CWE-862 CVE-2021-29958: When a download was initiated, the client did not check whether it was in normal or private browsing When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies being shared in normal browsing mode. This vulnerability affects Firefox for iOS < 34.

CVE-2021-24001 [MEDIUM] CWE-668 CVE-2021-24001: A compromised content process could have performed session history manipulations it should not have A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88.

CVE-2009-3274 [MEDIUM] CVE-2009-3274: Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and 3.0.14 and earlier 2.x and 3.x versions, on Linux uses a predictable /tmp pathname for files selected from the Downloads window, which allows local users to replace an arbitrary downloaded file by placing a file in a /tmp location before the download occurs, related to the Download Manager co

CVE-2022-22749 [MEDIUM] CWE-20 CVE-2022-22749: When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not p When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.

CVE-2021-4221 [MEDIUM] CWE-1007 CVE-2021-4221: If a domain name contained a RTL character, it would cause the domain to be rendered to the right of If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.**Note*: Due to a clerical error this advisory was not included in the original announcement, and was

CVE-2022-45417 [MEDIUM] CWE-1021 CVE-2022-45417: Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited in Private Browsing Mode. This would not have persisted them in a state where they would run again, but it would have leaked Private Browsing Mode details to disk. This vulnerability affects

CVE-2022-31745 [MEDIUM] CWE-129 CVE-2022-31745: If array shift operations are not used, the Garbage Collector may have become confused about valid o If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101.

CVE-2021-43531 [MEDIUM] CWE-346 CVE-2021-43531: When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect U When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redi

CVE-2024-38313 [MEDIUM] CWE-451 CVE-2024-38313: In certain scenarios a malicious website could attempt to display a fake location URL bar which coul In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.

CVE-2025-5020 [MEDIUM] CWE-939 CVE-2025-5020: Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attack Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139.