Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-3266An out-of-bounds read can occur when decoding H264 video.
- CVE-2022-31748Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs pr
- CVE-2022-31747Mozilla developers Andrew McCreight, Nicolas B.
- CVE-2022-31746Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header.
- CVE-2022-31745If array shift operations are not used, the Garbage Collector may have become confused about valid objects.
- CVE-2022-31744An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Conten
- CVE-2022-31743Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers.
- CVE-2022-31742An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between i
- CVE-2022-31741A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption.
- CVE-2022-31740On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploit
- CVE-2022-31739When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-
- CVE-2022-31738When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user c
- CVE-2022-31737A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash.
- CVE-2022-31736A malicious website could have learned the size of a cross-origin resource that supported Range requests.
- CVE-2022-3155When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file.
- CVE-2022-3034When receiving an HTML email that specified to load an <code>iframe</code> element from a remote location, a request to the remote document
- CVE-2022-3033If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>ht
- CVE-2022-3032When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner H
- CVE-2022-29918Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99.
- CVE-2022-29917Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox
- CVE-2022-29916Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables.
- CVE-2022-29915The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects.
- CVE-2022-29914When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoof
- CVE-2022-29913The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child proces
- CVE-2022-29912Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.
- CVE-2022-29911An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execu
- CVE-2022-29910When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only af
- CVE-2022-29909Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the exi
- CVE-2022-28289Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safet
- CVE-2022-28288Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present i