Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-10290Opening links via the contextual menu in Focus for iOS would not update the toolbar UI correctly, allowing attackers to spoof websites
- CVE-2025-10535Information disclosure, mitigation bypass in the Privacy component in Firefox for Android
- CVE-2025-10534Spoofing issue in the Site Permissions component
- CVE-2025-10531Mitigation bypass in the Web Compatibility: Tooling component
- CVE-2025-10530Spoofing issue in the WebAuthn component in Firefox for Android
- CVE-2025-10537Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
- CVE-2025-10536Information disclosure in the Networking: Cache component
- CVE-2025-10532Incorrect boundary conditions in the JavaScript: GC component
- CVE-2025-10529Same-origin policy bypass in the Layout component
- CVE-2025-10528Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
- CVE-2025-10527Sandbox escape due to use-after-free in the Graphics: Canvas2D component
- CVE-2025-10533Integer overflow in the SVG component
- CVE-2025-55033Drag and drop gestures in Focus for iOS could allow JavaScript links to be executed incorrectly
- CVE-2025-55032Focus incorrectly ignores Content-Disposition headers for some MIME types
- CVE-2025-55029Malicious scripts could spam popups for denial of service attacks
- CVE-2025-55031Passkey phishing within Bluetooth range
- CVE-2025-55028JavaScript alerts could impede UI interaction or allow denial of service attacks
- CVE-2025-55030Content-Disposition headers incorrectly ignored for some MIME types
- CVE-2025-54145Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites
- CVE-2025-54144Internal Firefox open-text URL scheme allowed loading of arbitrary URLs
- CVE-2025-54143Sandboxed iframes could allow local downloads despite sandbox restrictions
- CVE-2025-8364Address bar spoofing using an blob URI on Firefox for Android
- CVE-2025-8042Sandboxed iframe could start downloads
- CVE-2025-8041Incorrect URL truncation in Firefox for Android
- CVE-2025-9184Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- CVE-2025-9187Memory safety bugs fixed in Firefox 142 and Thunderbird 142
- CVE-2025-9183Spoofing issue in the Address Bar component
- CVE-2025-9182Denial-of-service due to out-of-memory in the Graphics: WebRender component
- CVE-2025-9186Spoofing issue in the Address Bar component of Firefox Focus for Android
- CVE-2025-9185Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142