Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-1556The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior.
- CVE-2024-1555When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected.
- CVE-2024-1554The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may cont
- CVE-2024-1553Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7.
- CVE-2024-1552Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects
- CVE-2024-1551Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.
- CVE-2024-1550A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-pos
- CVE-2024-1549If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in us
- CVE-2024-1548A website could have obscured the fullscreen notification by using a dropdown select input element.
- CVE-2024-1547Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the vict
- CVE-2024-1546When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memo
- CVE-2024-0953When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the c
- CVE-2024-0754Some WASM source files could have caused a crash when loaded in devtools.
- CVE-2024-0752A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system.
- CVE-2024-0748A compromised content process could have updated the document URI.
- CVE-2024-0745The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow.
- CVE-2024-0744In some circumstances, JIT compiled code could have dereferenced a wild pointer value.
- CVE-2024-0743An unchecked return value in TLS handshake code could have caused a potentially exploitable crash.
- CVE-2024-0755Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6.
- CVE-2024-0753In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
- CVE-2024-0751A malicious devtools extension could have been used to escalate privileges.
- CVE-2024-0750A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
- CVE-2024-0749A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar.
- CVE-2024-0747When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Cont
- CVE-2024-0746A Linux user opening the print preview dialog could have caused the browser to crash.
- CVE-2024-0742It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timesta
- CVE-2024-0741An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.
- CVE-2024-0606An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to u
- CVE-2024-0605Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar.
- CVE-2023-6873Memory safety bugs present in Firefox 120.