Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-3857The JIT created incorrect code for arguments in certain cases.
- CVE-2024-3856A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array.
- CVE-2024-3855In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads.
- CVE-2024-3854In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads.
- CVE-2024-3853A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started.
- CVE-2024-3852GetBoundName could return the wrong version of an object when JIT optimizations were applied.
- CVE-2024-31392If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status Thi
- CVE-2024-31393Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerabilit
- CVE-2024-29944An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent proce
- CVE-2024-29943An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.
- CVE-2024-2616To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue.
- CVE-2024-2615Memory safety bugs present in Firefox 123.
- CVE-2024-2614Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8.
- CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash.
- CVE-2024-2612If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leverag
- CVE-2024-2611A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions.
- CVE-2024-2610Using a markup injection an attacker could have stolen nonce values.
- CVE-2024-2609The permission prompt input delay could expire while the window is not in focus.
- CVE-2023-5388NSS was susceptible to a timing side-channel attack when performing RSA decryption.
- CVE-2024-2608`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows,
- CVE-2024-2607Return registers were overwritten which could have allowed an attacker to execute arbitrary code.
- CVE-2024-2606Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values.
- CVE-2024-2605An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox.
- CVE-2024-1936The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's
- CVE-2024-26281Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin site
- CVE-2024-26282Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page.
- CVE-2024-26283An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F
- CVE-2024-1563An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F
- CVE-2024-26284Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a
- CVE-2024-1557Memory safety bugs present in Firefox 122.