Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-4088Cross-site request forgery via storage access API redirects
- CVE-2025-4087Unsafe attribute access during XPath parsing
- CVE-2025-4086Specially crafted filename could be used to obscure download type
- CVE-2025-4085Potential information leakage and privilege escalation in UITour actor
- CVE-2025-4084Potential local code execution in "copy as cURL" command
- CVE-2025-4083Process isolation bypass using "javascript:" URI links in cross-origin frames
- CVE-2025-4082WebGL shader attribute memory corruption in Thunderbird for macOS
- CVE-2025-2817Privilege escalation in Thunderbird Updater
- CVE-2025-3523User Interface (UI) Misrepresentation of attachment URL
- CVE-2025-2830Information Disclosure of /tmp directory listing
- CVE-2025-3522Leak of hashed Window credentials via crafted attachment URL
- CVE-2025-3608Race condition in nsHttpTransaction could lead to memory corruption
- CVE-2025-3035Tab title disclosure across pages when using AI chatbot
- CVE-2025-3034Memory safety bugs fixed in Firefox 137 and Thunderbird 137
- CVE-2025-3033Opening local .url files could lead to another file being opened
- CVE-2025-3032Leaking file descriptors from the fork server
- CVE-2025-3031JIT optimization bug with different stack slot sizes
- CVE-2025-3030Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9
- CVE-2025-3029URL Bar Spoofing via non-BMP Unicode characters
- CVE-2025-3028Use-after-free triggered by XSLTProcessor
- CVE-2025-2857Incorrect handle could lead to sandbox escapes
- CVE-2025-26695Downloading of OpenPGP keys from WKD used incorrect padding
- CVE-2025-26696Crafted email message incorrectly shown as being encrypted
- CVE-2025-27425QR code user confirmation bypass with invalid protocol
- CVE-2025-27424Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme
- CVE-2025-27426Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page
- CVE-2025-1943Memory safety bugs fixed in Firefox 136 and Thunderbird 136
- CVE-2025-1938Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8
- CVE-2025-1937Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
- CVE-2025-1936Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents