Mozilla Firefox vulnerabilities

CVE-2016-1954 [HIGH] CWE-264 CVE-2016-1954: The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45 The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a

CVE-2026-109744 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109744 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109744 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2020-12419 [HIGH] CWE-416 CVE-2020-12419: When processing callbacks that occurred during window flushing in the parent process, the associated When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVE-2018-5130 [HIGH] CWE-20 CVE-2018-5130: When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstance When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.

CVE-2026-109746 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109746 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109746 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2017-5436 [HIGH] CWE-787 CVE-2017-5436: An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVE-2026-109757 Mozilla Foundation Security Advisory 2026-106: CVE-2026-109757 Mozilla Foundation Security Advisory 2026-106 CVE: CVE-2026-109757 Product: Firefox Impact: low Fixed in: Firefox 158

CVE-2013-5599 [CRITICAL] CVE-2013-5599: Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka pres Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or c

CVE-2013-5592 [CRITICAL] CVE-2013-5592: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remo Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

CVE-2019-17005 [HIGH] CWE-787 CVE-2019-17005: The plain text serializer used a fixed-size array for the number of <ol> elements it could process; The plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

CVE-2008-4064 [CRITICAL] CWE-399 CVE-2008-4064: Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to c Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to graphics rendering and (1) handling of a long alert messagebox in the cairo_surface_set_device_offset function, (2) integer ov

CVE-2019-17015 [HIGH] CWE-787 CVE-2019-17015: During the initialization of a new content process, a pointer offset can be manipulated leading to m During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVE-2021-38504 [HIGH] CWE-416 CVE-2021-38504: When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-aft When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVE-2008-4059 [HIGH] CWE-264 CVE-2008-4059: The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNa The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element.

CVE-2016-9894 [HIGH] CWE-119 CVE-2016-9894: A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers w A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.1.

CVE-2008-4060 [HIGH] CWE-264 CVE-2008-4060: Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey bef Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with chrome privileges, via vectors related to (1) the document.loadBindingDocument function and (2) XSLT.

CVE-2019-11756 [HIGH] CWE-416 CVE-2019-11756: Improper refcounting of soft token session objects could cause a use-after-free and crash (likely li Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnerability affects Firefox < 71.

CVE-2016-5283 [HIGH] CWE-284 CVE-2016-5283: Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted f Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

CVE-2012-1954 [CRITICAL] CWE-399 CVE-2012-1954: Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13 Use-after-free vulnerability in the nsDocument::AdoptNode function in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code via vector

CVE-2017-7773 [HIGH] CWE-119 CVE-2017-7773: Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/De Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.