Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-6426No warning when opening executable terminal files on macOS
- CVE-2025-6425The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
- CVE-2025-6424Use-after-free in FontFaceSet
- CVE-2025-5986Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links
- CVE-2025-49710Integer overflow in OrderedHashTable
- CVE-2025-49709Memory corruption in canvas surfaces
- CVE-2025-5687Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below.
- CVE-2025-5272Memory safety bugs fixed in Firefox 139 and Thunderbird 139
- CVE-2025-5271Devtools' preview ignored CSP headers
- CVE-2025-5270SNI was sometimes unencrypted
- CVE-2025-5269Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11
- CVE-2025-5268Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
- CVE-2025-5267Clickjacking vulnerability could have led to leaking saved payment card details
- CVE-2025-5266Script element events leaked cross-origin resource status
- CVE-2025-5265Potential local code execution in “Copy as cURL” command
- CVE-2025-5264Potential local code execution in “Copy as cURL” command
- CVE-2025-5263Error handling for script execution was incorrectly isolated from web content
- CVE-2025-5262A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC.
- CVE-2025-5020Links using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addresses
- CVE-2025-4919Out-of-bounds access when optimizing linear sums
- CVE-2025-4918Out-of-bounds access when resolving Promise objects
- CVE-2025-3932Tracking Links in Attachments Bypassed Remote Content Blocking
- CVE-2025-3909JavaScript Execution via Spoofed PDF Attachment and file:/// Link
- CVE-2025-3875Sender Spoofing via Malformed From Header in Thunderbird
- CVE-2025-3859Firefox Focus elide URL allows address bar spoofing
- CVE-2025-4093Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
- CVE-2025-4092Memory safety bugs fixed in Firefox 138 and Thunderbird 138
- CVE-2025-4091Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10
- CVE-2025-4090Leaked library paths in Thunderbird for Android
- CVE-2025-4089Potential local code execution in "copy as cURL" command