Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-28287In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash.
- CVE-2022-28286Due to a layout change, iframe contents could have been rendered outside of its border.
- CVE-2022-28285When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used.
- CVE-2022-28284SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstan
- CVE-2022-28283The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or othe
- CVE-2022-28282By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript ex
- CVE-2022-28281If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bou
- CVE-2022-26486An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape.
- CVE-2022-26485Removing an XSLT parameter during processing could have lead to an exploitable use-after-free.
- CVE-2022-26387When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the under
- CVE-2022-26386Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior w
- CVE-2022-26385In unusual circumstances, an individual thread may outlive the thread's manager during shutdown.
- CVE-2022-26384If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they wer
- CVE-2022-26383When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification.
- CVE-2022-26382While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts.
- CVE-2022-26381An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash.
- CVE-2022-2505Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102.
- CVE-2022-22764Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5.
- CVE-2022-22763When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible.
- CVE-2022-22762Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it.
- CVE-2022-22761Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was
- CVE-2022-22760When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> resp
- CVE-2022-22759If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document t
- CVE-2022-22758When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number.
- CVE-2022-22757Remote Agent, used in WebDriver, did not validate the Host or Origin headers.
- CVE-2022-22756If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an exe
- CVE-2022-22755By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within th
- CVE-2022-22754If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt wh
- CVE-2022-22753A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrar
- CVE-2022-22752Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95.