Mozilla Firefox vulnerabilities

CVE-2022-46877 [MEDIUM] CWE-79 CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulti By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.

CVE-2023-6135 [MEDIUM] CWE-203 CVE-2023-6135: Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack c Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.

CVE-2023-5729 [MEDIUM] CVE-2023-5729: A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. Th A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. This could have obscured the fullscreen notification and could have been leveraged in a spoofing attack. This vulnerability affects Firefox < 119.

CVE-2023-5726 [MEDIUM] CVE-2023-5726: A website could have obscured the full screen notification by using the file open dialog. This could A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. *Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

CVE-2021-23963 [MEDIUM] CWE-281 CVE-2021-23963: When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.

CVE-2023-32212 [MEDIUM] CVE-2023-32212: An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerabilit An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVE-2023-32205 [MEDIUM] CVE-2023-32205: In multiple cases browser prompts could have been obscured by popups controlled by content. These co In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11.

CVE-2024-0742 [MEDIUM] CVE-2024-0742: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

CVE-2023-29533 [MEDIUM] CVE-2023-29533: A website could have obscured the fullscreen notification by using a combination of <code>window.ope A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thun

CVE-2022-26382 [MEDIUM] CWE-203 CVE-2022-26382: While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was re While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98.

CVE-2023-29538 [MEDIUM] CWE-668 CVE-2023-29538: Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instea Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

CVE-2024-5689 [MEDIUM] CVE-2024-5689: In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay th In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and direct the user to a replica Firefox Screenshots page that could be used for phishing. This vulnerability affects Firefox < 127.

CVE-2024-11701 [MEDIUM] CWE-290 CVE-2024-11701: The incorrect domain may have been displayed in the address bar during an interrupted navigation att The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.

CVE-2024-4766 [MEDIUM] CVE-2024-4766: Different techniques existed to obscure the fullscreen notification in Firefox for Android. These c Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.

CVE-2024-31393 [MEDIUM] CVE-2024-31393: Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions an Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS < 124.

CVE-2026-84126 [MEDIUM] CWE-120 CVE-2026-84126: Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

CVE-2022-29915 [MEDIUM] CWE-346 CVE-2022-29915: The Performance API did not properly hide the fact whether a request cross-origin resource has obser The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100.

CVE-2026-109742 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109742 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109742 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109751 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109751 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109751 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-96869 [MEDIUM] CWE-200 CVE-2026-96869: Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153. Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.