Mozilla Firefox Mobile vulnerabilities

CVE-2012-1139 [CRITICAL] CWE-119 CVE-2012-1139: Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and othe Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid stack read operation and memory corruption) or possibly execute arbitrary code via crafted glyph data in a BDF font.

CVE-2012-1129 [CRITICAL] CWE-119 CVE-2012-1129: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font.

CVE-2023-29539 [HIGH] CWE-476 CVE-2023-29539: When handling the filename directive in the Content-Disposition header, the filename would be trunca When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for An

CVE-2012-1135 [CRITICAL] CWE-119 CVE-2012-1135: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the NPUSHB and NPUSHW instructions in a TrueType font.

CVE-2012-1138 [CRITICAL] CWE-119 CVE-2012-1138: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the MIRP instruction in a TrueType font.

CVE-2012-1128 [CRITICAL] CWE-119 CVE-2012-1128: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.

CVE-2012-1140 [CRITICAL] CWE-119 CVE-2012-1140: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted PostScript font object.

CVE-2012-1137 [CRITICAL] CWE-119 CVE-2012-1137: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted header in a BDF font.

CVE-2012-1130 [CRITICAL] CWE-119 CVE-2012-1130: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a PCF font.

CVE-2026-16373 [HIGH] CWE-200 CVE-2026-16373: Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2020-15670 [HIGH] CWE-362 CVE-2020-15670: Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.

CVE-2023-29543 [HIGH] CWE-416 CVE-2023-29543: An attacker could have caused memory corruption and a potentially exploitable use-after-free of a po An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

CVE-2012-1131 [CRITICAL] CWE-119 CVE-2012-1131: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit platforms allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors related to the cell table of a font.

CVE-2024-7523 [HIGH] CWE-1021 CVE-2024-7523: A select option could partially obscure security prompts. This could be used by a malicious site to A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129.

CVE-2023-25747 [HIGH] CWE-416 CVE-2023-25747: A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on And A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.

CVE-2023-29537 [HIGH] CWE-362 CVE-2023-29537: Multiple race conditions in the font initialization could have led to memory corruption and executio Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

CVE-2021-29993 [HIGH] CVE-2021-29993: Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cau Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92.

CVE-2020-6830 [HIGH] CWE-200 CVE-2020-6830: For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code ca For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.

CVE-2026-16404 [HIGH] CWE-290 CVE-2026-16404: Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.

CVE-2020-26964 [MEDIUM] CVE-2020-26964: If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version pri If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however,