Mozilla Firefox Mobile vulnerabilities

CVE-2026-53899 [MEDIUM] CWE-345 CVE-2026-53899: Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a mali Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive cookies belonging to the target site. This vulnerability was fixed in Firefox for iOS 152.0.

CVE-2012-3979 [MEDIUM] CVE-2012-3979: Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __andr Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function, which allows remote attackers to execute arbitrary code via a crafted web page that calls the JavaScript dump function.

CVE-2020-15664 [MEDIUM] CWE-863 CVE-2020-15664: By holding a reference to the eval() function from an about:blank window, a malicious webpage could By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firef

CVE-2023-29548 [MEDIUM] CVE-2023-29548: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVE-2026-74951 [MEDIUM] CWE-1021 CVE-2026-74951: Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74980 [MEDIUM] CWE-1021 CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed i Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2020-15666 [MEDIUM] CWE-209 CVE-2020-15666: When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network a

CVE-2020-26975 [MEDIUM] CVE-2020-26975: When a malicious application installed on the user's device broadcast an Intent to Firefox for Andro When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating sys

CVE-2020-26977 [MEDIUM] CVE-2020-26977: By attempting to connect a website using an unresponsive port, an attacker could have controlled the By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar displayed the original domain. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.

CVE-2020-26957 [MEDIUM] CWE-665 CVE-2020-26957: OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. Th OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

CVE-2023-29546 [MEDIUM] CVE-2023-29546: When recording the screen while in Private Browsing on Firefox for Android the address bar and keybo When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. *This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.

CVE-2023-29549 [MEDIUM] CWE-326 CVE-2023-29549: Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incor Under certain circumstances, a call to the bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

CVE-2024-38312 [MEDIUM] CWE-922 CVE-2024-38312: When browsing private tabs, some data related to location history or webpage thumbnails could be per When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.

CVE-2020-15661 [MEDIUM] CWE-522 CVE-2020-15661: A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit c A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.

CVE-2020-26955 [MEDIUM] CWE-565 CVE-2020-26955: When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are

CVE-2023-29535 [MEDIUM] CVE-2023-29535: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctl Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVE-2020-15662 [MEDIUM] CVE-2020-15662: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.

CVE-2026-14906 [MEDIUM] CWE-434 CVE-2026-14906: Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bund Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4.

CVE-2020-12414 [MEDIUM] CWE-459 CVE-2020-12414: IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewC IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.

CVE-2023-29544 [MEDIUM] CWE-400 CVE-2023-29544: If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector c If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.