Vendor
Mozilla
2,559 known vulnerabilities.
Products
2,559 results · Feed
-
Unscored —
Push notifications saved to disk unencrypted
Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.
-
Unscored —
Persisted search terms were formatted as URLs
Search queries in the default search engine could appear to have been the currently navigated URL if the search query itself was a well formed URL. This could have led to a site spoofing another if it had been maliciously set as the default search engine. Thi…
-
Unscored —
Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception
When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of M…
-
Unscored —
Memory corruption in JIT UpdateRegExpStatics
When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 1…
-
Unscored —
Integer Overflow in RecordedSourceSurfaceCreation
On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating syst…
-
Unscored —
Memory corruption in IPC FilePickerShownCallback
When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-fre…
-
Unscored —
Memory corruption in IPC ColorPickerShownCallback
When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-fr…
-
Unscored —
Memory corruption in IPC CanvasTranslator
When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2,…
-
Unscored —
A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune ti…
-
Unscored —
Memory safety bugs present in Firefox 115. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence…
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 10…
-
Unscored —
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no …
-
Unscored —
When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only…
-
Unscored —
Full screen notification obscured by external program
A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefo…
-
Unscored —
The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, any files in that …
-
Unscored —
Full screen notification obscured by file open dialog
A website could have obscured the full screen notification by using the file open dialog. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2.
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
Unscored —
File Extension Spoofing using the Text Direction Override Character
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show t…
-
Unscored —CVE-2023-37456 Public exploit
The session restore helper crashed whenever there was no parameter sent to the message handler. This vulnerability affe…
-
Unscored —
The permission request prompt from the site in the background tab was overlaid on top of the site in the foreground tab…
-
Unscored —
Use-after-free in workers
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
-
Unscored —
Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that …
-
Unscored —
A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confus…
-
Unscored —
A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and…
-
Unscored —
Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a…
-
Unscored —
The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firef…
-
Unscored —
A website could have obscured the fullscreen notification by using an option element by introducing lag via an expensiv…
-
High 7.8
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker t…
-
Unscored —
When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by usin…
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…