Mozilla Firefox Esr vulnerabilities

CVE-2017-7782 [MEDIUM] CWE-269 CVE-2017-7782: An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated b An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.

CVE-2016-5294 [MEDIUM] CWE-20 CVE-2016-5294: The Mozilla Updater can be made to choose an arbitrary target working directory for output files res The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

CVE-2019-9817 [MEDIUM] CWE-346 CVE-2019-9817: Images from a different domain can be read using a canvas object in some circumstances. This could b Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVE-2026-109723 Mozilla Foundation Security Advisory 2026-108: CVE-2026-109723 Mozilla Foundation Security Advisory 2026-108 CVE: CVE-2026-109723 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.5

CVE-2026-117893 Mozilla Foundation Security Advisory 2026-119: CVE-2026-117893 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-117893 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44

CVE-2026-117862 Mozilla Foundation Security Advisory 2026-120: CVE-2026-117862 Mozilla Foundation Security Advisory 2026-120 CVE: CVE-2026-117862 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 153.6

CVE-2026-118027 Mozilla Foundation Security Advisory 2026-119: CVE-2026-118027 Mozilla Foundation Security Advisory 2026-119 CVE: CVE-2026-118027 Product: Firefox ESR Impact: low Fixed in: Firefox ESR 115.44

CVE-2026-12311 [MEDIUM] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12311 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12311 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2016-5293 [MEDIUM] CWE-20 CVE-2016-5293: When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hard When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

CVE-2017-7761 [MEDIUM] CWE-276 CVE-2017-7761: The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by n The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack r

CVE-2023-4054 [MEDIUM] CVE-2023-4054: When opening appref-ms files, Firefox did not warn the user that these files may contain malicious c When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1.

CVE-2024-5691 [MEDIUM] CWE-693 CVE-2024-5691: By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a b By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

CVE-2020-6797 [MEDIUM] CWE-20 CVE-2020-6797: By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbit By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating sy

CVE-2024-6601 [MEDIUM] CWE-367 CVE-2024-6601: A race condition could lead to a cross-origin container obtaining permissions of the top-level origi A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.

CVE-2026-12313 [MEDIUM] Mozilla Foundation Security Advisory 2026-58: CVE-2026-12313 Mozilla Foundation Security Advisory 2026-58 CVE: CVE-2026-12313 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.12

CVE-2026-15718 [MEDIUM] Mozilla Foundation Security Advisory 2026-70: CVE-2026-15718 Mozilla Foundation Security Advisory 2026-70 CVE: CVE-2026-15718 Product: Firefox ESR Impact: high Fixed in: Firefox ESR 140.13

CVE-2020-15650 [MEDIUM] CVE-2020-15650: Given an installed malicious file picker application, an attacker was able to overwrite local files Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

CVE-2022-36314 [MEDIUM] CWE-427 CVE-2022-36314: When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path th When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 102.1, Firefox < 103, and Thunderbird < 102.1.

CVE-2021-38508 [MEDIUM] CWE-1021 CVE-2021-38508: By displaying a form validity message in the correct location at the same time as a permission promp By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

CVE-2021-38506 [MEDIUM] CWE-1021 CVE-2021-38506: Through a series of navigations, Firefox could have entered fullscreen mode without notification or Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.