Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-8897Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be
- CVE-2024-7652Type Confusion in Async Generators in Javascript Engine
- CVE-2024-8394When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitab
- CVE-2024-8399Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.
- CVE-2024-8389Memory safety bugs present in Firefox 129.
- CVE-2024-8388Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing the transition to full
- CVE-2024-8387Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1.
- CVE-2024-8386If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform
- CVE-2024-8385A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability.
- CVE-2024-8384The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two pa
- CVE-2024-8383Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does no
- CVE-2024-8382Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events.
- CVE-2024-8381A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmen
- CVE-2024-43111Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi
- CVE-2024-43113The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129
- CVE-2024-43112Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129
- CVE-2024-7530Incorrect garbage collection interaction could have led to a use-after-free.
- CVE-2024-7523A select option could partially obscure security prompts.
- CVE-2024-7531Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge
- CVE-2024-7529The date picker could partially obscure security prompts.
- CVE-2024-7528Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free.
- CVE-2024-7527Unexpected marking work at the start of sweeping could have led to a use-after-free.
- CVE-2024-7526ANGLE failed to initialize parameters which lead to reading from uninitialized memory.
- CVE-2024-7525It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response
- CVE-2024-7524Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.
- CVE-2024-7522Editor code failed to check an attribute value.
- CVE-2024-7521Incomplete WebAssembly exception handing could have led to a use-after-free.
- CVE-2024-7520A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.
- CVE-2024-7519Insufficient checks when processing graphics shared memory could have led to memory corruption.
- CVE-2024-7518Select options could obscure the fullscreen notification dialog.