Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-10941A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash.
- CVE-2024-10474Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circum
- CVE-2024-10468Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash.
- CVE-2024-10467Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3.
- CVE-2024-10466By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive.
- CVE-2024-10465A clipboard "paste" button could persist across tabs which allowed a spoofing attack.
- CVE-2024-10464Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser.
- CVE-2024-10463Video frames could have been leaked between origins in some situations.
- CVE-2024-10462Truncation of a long URL could have allowed origin spoofing in a permission prompt.
- CVE-2024-10461In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a downl
- CVE-2024-10460The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`.
- CVE-2024-10459An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash.
- CVE-2024-10458A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements.
- CVE-2024-10004Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in t
- CVE-2024-9936When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitab
- CVE-2024-9680An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.
- CVE-2024-9403Memory safety bugs present in Firefox 130.
- CVE-2024-9395A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog.
- CVE-2024-9391A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode.
- CVE-2024-9402Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2.
- CVE-2024-9401Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2.
- CVE-2024-9400A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during
- CVE-2024-9399A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service con
- CVE-2024-9398By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application whi
- CVE-2024-9397A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking
- CVE-2024-9396It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to m
- CVE-2024-9394An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.
- CVE-2024-9393An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.
- CVE-2024-9392A compromised content process could have allowed for the arbitrary loading of cross-origin pages.
- CVE-2024-8900An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events.