Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-37210A website could prevent a user from exiting full-screen mode via alert and prompt calls.
- CVE-2023-37209A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that
- CVE-2023-37206Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website.
- CVE-2023-37205The use of RTL Arabic characters in the address bar may have allowed for URL spoofing.
- CVE-2023-37204A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational funct
- CVE-2023-37203Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users int
- CVE-2023-3482When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a so
- CVE-2023-37211Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12.
- CVE-2023-37208When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code.
- CVE-2023-37207A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL.
- CVE-2023-37202Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment
- CVE-2023-37201An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS.
- CVE-2019-25136A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and a sandbox
- CVE-2023-34417Memory safety bugs present in Firefox 113.
- CVE-2023-34415When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that docu
- CVE-2023-25736An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior.
- CVE-2023-25733The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.
- CVE-2023-34416Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12.
- CVE-2023-34414The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialo
- CVE-2023-29546When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking
- CVE-2023-29534Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.
- CVE-2023-25747A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.
- CVE-2023-29545Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso
- CVE-2023-29542A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as
- CVE-2023-29532A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file o
- CVE-2023-29531An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable cr
- CVE-2023-32216Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team reported memory safety b
- CVE-2023-32214Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.
- CVE-2023-32210Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal.
- CVE-2023-32209A maliciously crafted favicon could have led to an out of memory crash.