Mozilla CVEs
2,561 CVEs and advisories name Mozilla as an affected vendor, 9 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-12405Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.
- CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users.
- CVE-2018-12402The internal WebBrowserPersist code does not use correct origin context for a resource being saved.
- CVE-2018-12401Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string.
- CVE-2018-12400In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode.
- CVE-2018-12399When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registe
- CVE-2018-12398By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security
- CVE-2018-12397A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websit
- CVE-2018-12396A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events.
- CVE-2018-12395By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.
- CVE-2018-12393A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 repres
- CVE-2018-12392When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable c
- CVE-2018-12391During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies.
- CVE-2018-12390Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2.
- CVE-2018-12389Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.
- CVE-2018-12388Mozilla developers and community members reported memory safety bugs present in Firefox 62.
- CVE-2018-18506When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this
- CVE-2018-18505An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endp
- CVE-2018-18503When JavaScript is used to create and manipulate an audio buffer, a potentially exploitable crash may occur because of a compartment mismatc
- CVE-2018-18502Mozilla developers and community members reported memory safety bugs present in Firefox 64.
- CVE-2018-18501Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4.
- CVE-2018-5188Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8.
- CVE-2018-5187Memory safety bugs present in Firefox 60 and Firefox ESR 60.
- CVE-2018-5186Memory safety bugs present in Firefox 60.
- CVE-2018-5156A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring.
- CVE-2018-12387A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer bei
- CVE-2018-12386A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write.
- CVE-2018-12385A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile
- CVE-2018-12383If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible
- CVE-2018-12382The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before