Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-5691By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would
- CVE-2024-5690By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's
- CVE-2024-5688If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.
- CVE-2024-5702Memory corruption in the networking stack could have led to a potentially exploitable crash.
- CVE-2024-5022The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affec
- CVE-2024-4778Memory safety bugs present in Firefox 125.
- CVE-2024-4776A file dialog shown while in full-screen mode could have resulted in the window remaining disabled.
- CVE-2024-4775An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and un
- CVE-2024-4774The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data mem
- CVE-2024-4773When a network error occurred during page load, the prior content could have remained in view with a blank URL bar.
- CVE-2024-4772An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values.
- CVE-2024-4771A memory allocation check was missing which would lead to a use-after-free if the allocation failed.
- CVE-2024-4766Different techniques existed to obscure the fullscreen notification in Firefox for Android.
- CVE-2024-4765Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's ma
- CVE-2024-4764Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free.
- CVE-2024-4777Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10.
- CVE-2024-4770When saving a page to PDF, certain font styles could have led to a potential use-after-free crash.
- CVE-2024-4769When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and n
- CVE-2024-4768A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions.
- CVE-2024-4767If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed.
- CVE-2024-4367A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.
- CVE-2024-3865Memory safety bugs present in Firefox 124.
- CVE-2024-3864Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9.
- CVE-2024-3302There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed.
- CVE-2024-3863The executable file warning was not presented when downloading .xrm-ms files.
- CVE-2024-3862The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment.
- CVE-2024-3861If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free.
- CVE-2024-3860An out-of-memory condition during object initialization could result in an empty shape list.
- CVE-2024-3859On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenTyp
- CVE-2024-3858It was possible to mutate a JavaScript object so that the JIT could crash while tracing it.