Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-12417Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a po
- CVE-2020-12415When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a su
- CVE-2020-12426Mozilla developers and community members reported memory safety bugs present in Firefox 77.
- CVE-2020-12418Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript.
- CVE-2020-12424When constructing a permission prompt for WebRTC, a URI was supplied from the content process.
- CVE-2018-12371An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM.
- CVE-2020-6830For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions.
- CVE-2020-6831A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC.
- CVE-2020-12387A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability.
- CVE-2020-12388The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
- CVE-2020-12389The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
- CVE-2020-12390Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks.
- CVE-2020-12391Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context.
- CVE-2020-12392The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the
- CVE-2020-12393The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the web
- CVE-2020-12394A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different o
- CVE-2020-12395Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7.
- CVE-2020-12396Mozilla developers and community members reported memory safety bugs present in Firefox 75.
- CVE-2020-12397By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird disp
- CVE-2020-6819Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free.
- CVE-2020-6820Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free.
- CVE-2020-6821When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification r
- CVE-2020-6822On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>.
- CVE-2020-6823A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promi
- CVE-2020-6824Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Fi
- CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74.
- CVE-2020-6825Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR
- CVE-2020-6827When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into dis
- CVE-2020-6828A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file
- CVE-2020-6805When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentia