Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-6206The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts.
- CVE-2023-6205It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.
- CVE-2023-6204On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the
- CVE-2023-5758When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scrip
- CVE-2023-5732Address bar spoofing via bidirectional characters
- CVE-2023-5731Memory safety bugs present in Firefox 118.
- CVE-2023-5730Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3.
- CVE-2023-5729A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt.
- CVE-2023-5728During garbage collection extra operations were performed on a object that should not be.
- CVE-2023-5727The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a
- CVE-2023-5726A website could have obscured the full screen notification by using the file open dialog.
- CVE-2023-5725A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive use
- CVE-2023-5724Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash.
- CVE-2023-5723An attacker with temporary script access to a site could have set a cookie containing invalid characters using `document.cookie` that could
- CVE-2023-5722Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary hea
- CVE-2023-5721It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient acti
- CVE-2023-42808Common Voice Cross-site Scripting vulnerability
- CVE-2023-5175During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed from a different codep
- CVE-2023-5173In a non-standard configuration of Firefox, an integer overflow could have occurred based on network traffic (possibly under influence of a
- CVE-2023-5172A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential use-after-free and
- CVE-2023-5170In canvas rendering, a compromised content process could have caused a surface to change unexpectedly, leading to a memory leak of a privile
- CVE-2023-5176Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.
- CVE-2023-5174If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in
- CVE-2023-5171During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes,
- CVE-2023-5169A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a pote
- CVE-2023-5168A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a poten
- CVE-2023-4104An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitra
- CVE-2023-4585Memory safety bugs fixed in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2
- CVE-2023-4584Memory safety bugs fixed in Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2
- CVE-2023-4583Browsing Context potentially not cleared when closing Private Window