Mozilla Firefox vulnerabilities

CVE-2026-100799 [MEDIUM] CWE-457 CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2026-100802 [MEDIUM] CWE-457 CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVE-2025-8364 [MEDIUM] CWE-451 CVE-2025-8364: A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potent A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 141.

CVE-2025-6428 [MEDIUM] CWE-601 CVE-2025-6428: When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL i When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.

CVE-2026-12303 [MEDIUM] CWE-125 CVE-2026-12303: Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-109767 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109767 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109767 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109777 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109777 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109777 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2022-36315 [MEDIUM] CWE-345 CVE-2022-36315: When loading a script with Subresource Integrity, attackers with an injection capability could trigg When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata. This vulnerability affects Firefox < 103.

CVE-2026-109771 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109771 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109771 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-109769 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109769 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109769 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2026-92070 [MEDIUM] CWE-200 CVE-2026-92070: Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Fir Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-12320 [MEDIUM] CWE-200 CVE-2026-12320: Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 15 Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-84137 [MEDIUM] CWE-346 CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firef Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.

CVE-2026-109779 [MEDIUM] Mozilla Foundation Security Advisory 2026-106: CVE-2026-109779 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109779 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2008-5016 [MEDIUM] CWE-399 CVE-2008-5016: The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonke The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an assertion failure or other consequences.

CVE-2008-5502 [MEDIUM] CWE-399 CVE-2008-5502: The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonke The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corruption, related to the GetXMLEntity and FastAppendChar functions.

CVE-2004-0762 [MEDIUM] CVE-2004-0762: Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to instal Mozilla before 1.7, Firefox before 0.9, and Thunderbird before 0.7, allow remote web sites to install arbitrary extensions by using interactive events to manipulate the XPInstall Security dialog box.

CVE-2008-0594 [MEDIUM] CVE-2008-0594: Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire c Mozilla Firefox before 2.0.0.12 does not always display a web forgery warning dialog if the entire contents of a web page are in a DIV tag that uses absolute positioning, which makes it easier for remote attackers to conduct phishing attacks.

CVE-2005-2266 [MEDIUM] CVE-2005-2266: Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other metho Firefox before 1.0.5 and Mozilla before 1.7.9 allows a child frame to call top.focus and other methods in a parent frame, even when the parent is in a different domain, which violates the same origin policy and allows remote attackers to steal sensitive information such as cookies and passwords from web sites whose child frames do not verify that they are in

CVE-2004-2227 [MEDIUM] CVE-2004-2227: Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it Mozilla Firefox before 1.0 truncates long filenames in the file download dialog box, which makes it easier for remote attackers to trick users into downloading files with dangerous extensions.