Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-45417Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk f
- CVE-2022-45416Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses.
- CVE-2022-45415When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the f
- CVE-2022-45414If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the P
- CVE-2022-45413Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cook
- CVE-2022-45412When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a s
- CVE-2022-45411Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization hea
- CVE-2022-45410When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took own
- CVE-2022-45409The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been cal
- CVE-2022-45408Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification p
- CVE-2022-45407If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potent
- CVE-2022-45406If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on
- CVE-2022-45405Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially explo
- CVE-2022-45404Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the
- CVE-2022-45403Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media c
- CVE-2022-42932Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3.
- CVE-2022-42931Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk.
- CVE-2022-42930If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component.
- CVE-2022-42929If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browse
- CVE-2022-42928Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corr
- CVE-2022-42927A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.
- CVE-2022-40962Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs
- CVE-2022-40961During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash.<br>
- CVE-2022-40960Concurrent use of the URL parser with non-UTF-8 data was not thread-safe.
- CVE-2022-40959During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permission
- CVE-2022-40958By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus ov
- CVE-2022-40957Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only aff
- CVE-2022-40956When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead.
- CVE-2022-38478Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12.
- CVE-2022-38477Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1.