Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-28159The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or
- CVE-2023-25752When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds.
- CVE-2023-25751Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly.
- CVE-2023-25750Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode.
- CVE-2023-25749Android applications with unpatched vulnerabilities can be launched from a browser using Intents, exposing users to these vulnerabilities.
- CVE-2023-25748By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potential user confusion or
- CVE-2023-25746Memory safety bugs present in Firefox ESR 102.7.
- CVE-2023-25745Memory safety bugs present in Firefox 109.
- CVE-2023-25744Mmemory safety bugs present in Firefox 109 and Firefox ESR 102.7.
- CVE-2023-25743A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only
- CVE-2023-25742When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash.
- CVE-2023-25741When dragging and dropping an image cross-origin, the image's size could potentially be leaked.
- CVE-2023-25740After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to un
- CVE-2023-25739Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoa
- CVE-2023-25738Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid valu
- CVE-2023-25737An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior.
- CVE-2023-25735Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment
- CVE-2023-25734After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to
- CVE-2023-25732When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated p
- CVE-2023-25731Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially be used to overwrite
- CVE-2023-25730A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode i
- CVE-2023-25729Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to ope
- CVE-2023-25728The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction
- CVE-2023-23606Memory safety bugs fixed in Firefox 109
- CVE-2023-23605Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7
- CVE-2023-23604Creation of duplicate SystemPrincipal from less secure contexts
- CVE-2023-23603Calls to console.log allowed bypassing Content Security Policy via format directive
- CVE-2023-23602Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers
- CVE-2023-23601URL being dragged from cross-origin iframe into same tab triggers navigation
- CVE-2023-23600Notification permissions persisted between Normal and Private Browsing on Android