Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-26977By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar disp
- CVE-2020-26978Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as s
- CVE-2020-26979When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and
- CVE-2020-35111When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source
- CVE-2020-35112If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file
- CVE-2020-35113Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5.
- CVE-2020-35114Mozilla developers reported memory safety bugs present in Firefox 83.
- CVE-2020-26970When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one b
- CVE-2020-26969Mozilla developers reported memory safety bugs present in Firefox 82.
- CVE-2020-26968Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4.
- CVE-2020-26967When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with eleme
- CVE-2020-26966Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting
- CVE-2020-26965Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed
- CVE-2020-26964If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could
- CVE-2020-26963Repeated calls to the history and location interfaces could have been used to hang the browser.
- CVE-2020-26962Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated.
- CVE-2020-26961When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming f
- CVE-2020-26960If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a poten
- CVE-2020-26959During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corru
- CVE-2020-26958Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker.
- CVE-2020-26957OneCRL was non-functional in the new Firefox for Android due to a missing service initialization.
- CVE-2020-26956In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS.
- CVE-2020-26955When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download opera
- CVE-2020-26954When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de
- CVE-2020-26953It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phish
- CVE-2020-26952Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh
- CVE-2020-26951A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization.
- CVE-2020-26950In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi
- CVE-2020-6829When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the
- CVE-2020-15680If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken im