Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-13017Same-origin policy bypass in the DOM: Notifications component
- CVE-2025-13026Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2025-13025Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2025-13024JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2025-13016Incorrect boundary conditions in the JavaScript: WebAssembly component
- CVE-2025-13023Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2025-13022Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2025-13021Incorrect boundary conditions in the Graphics: WebGPU component
- CVE-2025-13015Spoofing issue in Firefox
- CVE-2025-13014Use-after-free in the Audio/Video component
- CVE-2025-13013Mitigation bypass in the DOM: Core & HTML component
- CVE-2025-13012Race condition in the Graphics component
- CVE-2025-12380Use-after-free in WebGPU internals triggered from a compromised child process
- CVE-2025-11720Spoofing risk in Android custom tabs
- CVE-2025-11718Address bar could be spoofed on Android using visibilitychange
- CVE-2025-11717The password edit screen was not hidden in Android card view
- CVE-2025-11721Memory safety bug fixed in Firefox 144 and Thunderbird 144
- CVE-2025-11719Use-after-free caused by the native messaging web extension API on Windows
- CVE-2025-11716Sandboxed iframes allowed links to open in external apps (Android only)
- CVE-2025-11715Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
- CVE-2025-11713Potential user-assisted code execution in “Copy as cURL” command
- CVE-2025-11712An OBJECT tag type attribute overrode browser behavior on web resources without a content-type
- CVE-2025-11708Use-after-free in MediaTrackGraphImpl::GetInstance()
- CVE-2025-11714Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
- CVE-2025-11711Some non-writable Object properties could be modified
- CVE-2025-11710Cross-process information leaked due to malicious IPC messages
- CVE-2025-11709Out of bounds read/write in a privileged process triggered by WebGL textures
- CVE-2025-10859Data stored in cookies for non-HTML content while browsing Incognito could be viewed after closing private tabs
- CVE-2025-11153JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2025-11152Sandbox escape due to integer overflow in the Graphics: Canvas2D component