Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-22751Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve
- CVE-2022-22750By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged pr
- CVE-2022-22749When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only a
- CVE-2022-22748Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL pr
- CVE-2022-22747After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash.
- CVE-2022-22746A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed
- CVE-2022-22745Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations.
- CVE-2022-22744The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell.
- CVE-2022-22743When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to l
- CVE-2022-22742When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable cra
- CVE-2022-22741When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode.
- CVE-2022-22740Certain network request objects were freed too early when releasing a network request handle.
- CVE-2022-22739Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol.
- CVE-2022-22738Applying a CSS filter effect could have accessed out of bounds memory.
- CVE-2022-22737Constructing audio sinks could have lead to a race condition when playing audio files and closing windows.
- CVE-2022-22736If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory
- CVE-2022-2226An OpenPGP digital signature includes information about the date when the signature was created.
- CVE-2022-2200If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading t
- CVE-2022-1887The search term could have been specified externally to trigger SQL injection.
- CVE-2022-1834When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird
- CVE-2022-1802If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution
- CVE-2022-1529An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t
- CVE-2022-1520When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may sho
- CVE-2022-1197When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key
- CVE-2022-1196After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable
- CVE-2022-1097<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading
- CVE-2022-0843Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97.
- CVE-2022-0566It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when proc
- CVE-2022-0517Mozilla VPN can load an OpenSSL configuration file from an unsecured directory.
- CVE-2022-0511Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzz