Mozilla Firefox vulnerabilities

CVE-2026-2032 [MEDIUM] CWE-451 CVE-2026-2032: Malicious scripts that interrupt new tab page loading could cause desynchronization between the addr Malicious scripts that interrupt new tab page loading could cause desynchronization between the address bar and page content, allowing the attacker to spoof arbitrary HTML under a trusted domain. This vulnerability was fixed in Firefox for iOS 147.2.1.

CVE-2026-74973 [MEDIUM] CWE-362 CVE-2026-74973: Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 15 Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-109765 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109765 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109765 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109719 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109719 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109719 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2013-0751 [MEDIUM] CWE-264 CVE-2013-0751: Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a single IFRAME element, which allows remote attackers to obtain sensitive information or possibly conduct cross-site scripting (XSS) attacks via a crafted HTML document.

CVE-2013-1726 [MEDIUM] CWE-264 CVE-2013-1726: Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 2 Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature verification but before MAR use.

CVE-2005-2263 [MEDIUM] CVE-2005-2263: The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote att The InstallTrigger.install method in Firefox before 1.0.5 and Mozilla before 1.7.9 allows remote attackers to execute a callback function in the context of another domain by forcing a page navigation after the install method has been called, which causes the callback to be run in the context of the new page and results in a same origin violation.

CVE-2005-2395 [MEDIUM] CVE-2005-2395: Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication sche Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication scheme available as required by RFC2617, which might cause credentials to be sent in plaintext even if an encrypted channel is available.

CVE-2008-4065 [MEDIUM] CWE-79 CVE-2008-4065: Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey bef Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug."

CVE-2009-2975 [MEDIUM] CVE-2009-2975: Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configure Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly involving an incompletely configured protocol handler, does not properly implement setting the document.location property to a value specifying a protocol associated with an external application, which allows remote attackers to cause a denial of service (memory consumption) via vectors involvin

CVE-2015-0830 [MEDIUM] CWE-399 CVE-2015-0830: The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copyin The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content.

CVE-2014-1498 [MEDIUM] CWE-347 CVE-2014-1498: The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.

CVE-2005-0590 [MEDIUM] CVE-2005-0590: The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla The installation confirmation dialog in Firefox before 1.0.1, Thunderbird before 1.0.1, and Mozilla before 1.7.6 allows remote attackers to use InstallTrigger to spoof the hostname of the host performing the installation via a long "user:pass" sequence in the URL, which appears before the real hostname.

CVE-2008-2807 [MEDIUM] CWE-200 CVE-2008-2807: Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly handle an invalid .prope Mozilla Firefox before 2.0.0.15 and SeaMonkey before 1.1.10 do not properly handle an invalid .properties file for an add-on, which allows remote attackers to read uninitialized memory, as demonstrated by use of ISO 8859 encoding instead of UTF-8 encoding in a French .properties file.

CVE-2022-3266 [MEDIUM] CWE-125 CVE-2022-3266: An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

CVE-2010-1987 [MEDIUM] CVE-2010-1987: Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory Mozilla Firefox 3.6.3 on Windows XP SP3 allows remote attackers to cause a denial of service (memory consumption, out-of-bounds read, and application crash) via JavaScript code that appends long strings to the content of a P element, and performs certain other string concatenation and substring operations, related to the DoubleWideCharMappedString class in US

CVE-2024-6613 [MEDIUM] CWE-209 CVE-2024-6613: The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorr The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128 and Thunderbird < 128.

CVE-2007-4357 [MEDIUM] CVE-2007-4357: Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL. NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.

CVE-2010-0162 [MEDIUM] CWE-79 CVE-2010-0162: Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not pro Mozilla Firefox 3.0.x before 3.0.18 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, does not properly support the application/octet-stream content type as a protection mechanism against execution of web script in certain circumstances involving SVG and the EMBED element, which allows remote attackers to bypass the Same Origin Policy and conduct cro

CVE-2007-1762 [MEDIUM] CVE-2007-1762: Mozilla Firefox 2.0.0.1 through 2.0.0.3 does not canonicalize URLs before checking them against the Mozilla Firefox 2.0.0.1 through 2.0.0.3 does not canonicalize URLs before checking them against the phishing site blacklist, which allows remote attackers to bypass phishing protection via multiple / (slash) characters in the URL.