Mozilla Firefox Esr vulnerabilities

CVE-2018-5117 [MEDIUM] CVE-2018-5117: If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird <

CVE-2018-5168 [MEDIUM] CVE-2018-5168: Sites can bypass security checks on permissions to install lightweight themes by manipulating the "b Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and F

CVE-2019-11717 [MEDIUM] CWE-116 CVE-2019-11717: A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVE-2017-7764 [MEDIUM] CWE-20 CVE-2017-7764: Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unico Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syl

CVE-2019-17021 [MEDIUM] CWE-362 CVE-2019-17021: During the initialization of a new content process, a race condition occurs that can allow a content During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVE-2018-12381 [MEDIUM] CWE-610 CVE-2018-12381: Manually dragging and dropping an Outlook email message into the browser will trigger a page navigat Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpreted as a URL. *Note: this issue only affects Windows operating systems with Outlook installed. Other operating systems are not affected.*. This vulnerability affects Firefox ESR < 60.2 and Fi

CVE-2017-7763 [MEDIUM] CWE-20 CVE-2017-7763: Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for domain name spoofing attacks. Note: This attack only affects OS X operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVE-2023-6206 [MEDIUM] CWE-1021 CVE-2023-6206: The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking dela The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.

CVE-2024-11695 [MEDIUM] CWE-1021 CVE-2024-11695: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin o A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.

CVE-2023-4045 [MEDIUM] CWE-346 CVE-2023-4045: Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

CVE-2024-9398 [MEDIUM] CWE-203 CVE-2024-9398: By checking the result of calls to `window.open` with specifically set protocol handlers, an attacke By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

CVE-2026-84124 [MEDIUM] Mozilla Foundation Security Advisory 2026-85: CVE-2026-84124 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84124 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-12330 [MEDIUM] Mozilla Foundation Security Advisory 2026-59: CVE-2026-12330 Mozilla Foundation Security Advisory 2026-59 CVE: CVE-2026-12330 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.37

CVE-2026-113470 Mozilla Foundation Security Advisory 2026-113: CVE-2026-113470 Mozilla Foundation Security Advisory 2026-113 CVE: CVE-2026-113470 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 115.43.1

CVE-2026-109764 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109764 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109764 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-84136 Mozilla Foundation Security Advisory 2026-85: CVE-2026-84136 Mozilla Foundation Security Advisory 2026-85 CVE: CVE-2026-84136 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 153.2

CVE-2026-117998 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117998 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117998 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117880 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117880 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117880 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44

CVE-2026-117899 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117899 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117899 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-117891 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117891 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117891 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6