Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-9181Uninitialized memory in the JavaScript Engine component
- CVE-2025-9180Same-origin policy bypass in the Graphics: Canvas2D component
- CVE-2025-9179Sandbox escape due to invalid pointer in the Audio/Video: GMP component
- CVE-2025-8044Memory safety bugs fixed in Firefox 141 and Thunderbird 141
- CVE-2025-8043Incorrect URL truncation
- CVE-2025-8035Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- CVE-2025-8040Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- CVE-2025-8034Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- CVE-2025-8033Incorrect JavaScript state machine for generators
- CVE-2025-8039Search terms persisted in URL bar
- CVE-2025-8038CSP frame-src was not correctly enforced for paths
- CVE-2025-8032XSLT documents could bypass CSP
- CVE-2025-8031Incorrect URL stripping in CSP reports
- CVE-2025-8030Potential user-assisted code execution in “Copy as cURL” command
- CVE-2025-8037Nameless cookies shadow secure cookies
- CVE-2025-8036DNS rebinding circumvents CORS
- CVE-2025-8029javascript: URLs executed on object and embed tags
- CVE-2025-8028Large branch table could lead to truncated instruction
- CVE-2025-8027JavaScript engine only wrote partial return value to stack
- CVE-2025-6703transport/fc.rs: panic attempting to send MAX_DATA with value larger max varint
- CVE-2025-6436Memory safety bugs fixed in Firefox 140 and Thunderbird 140
- CVE-2025-6435Save as in Devtools could download files without sanitizing the extension
- CVE-2025-6434HTTPS-Only exception screen lacked anti-clickjacking delay
- CVE-2025-6433WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate
- CVE-2025-6432DNS Requests leaked outside of a configured SOCKS proxy
- CVE-2025-6431The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed
- CVE-2025-6428Firefox for Android opened URLs specified in a link querystring parameter
- CVE-2025-6427connect-src Content Security Policy restriction could be bypassed
- CVE-2025-6430Content-Disposition header ignored when a file is included in an embed or object tag
- CVE-2025-6429Incorrect parsing of URLs could have allowed embedding of youtube.com