Vulnerabilities in mozilla

2,453 results
CVE-2026-2770HIGHUse-after-free in the DOM: Bindings (WebIDL) componentEPSS 0.7%CVE-2026-2766CRITICALUse-after-free in the JavaScript Engine: JIT componentEPSS 0.7%CVE-2023-25732HIGHWhen encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated pEPSS 0.7%CVE-2022-28289HIGHMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safetEPSS 0.7%CVE-2021-29965—A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords fEPSS 0.7%CVE-2026-2772HIGHUse-after-free in the Audio/Video: Playback componentEPSS 0.7%CVE-2026-2764CRITICALJIT miscompilation, use-after-free in the JavaScript Engine: JIT componentEPSS 0.7%CVE-2023-29539—When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL chaEPSS 0.7%CVE-2026-2765CRITICALUse-after-free in the JavaScript Engine componentEPSS 0.7%CVE-2026-2763CRITICALUse-after-free in the JavaScript Engine componentEPSS 0.7%CVE-2024-5690MEDIUMBy monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's EPSS 0.7%CVE-2021-23983—By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memoEPSS 0.7%CVE-2022-38473HIGHA cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). ThisEPSS 0.7%CVE-2021-29952—When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort maEPSS 0.7%CVE-2022-0566HIGHIt may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when procEPSS 0.7%CVE-2021-29983—Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: TEPSS 0.7%CVE-2025-0241HIGHMemory corruption when using JavaScript Text SegmentationEPSS 0.7%CVE-2024-10463HIGHVideo frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, FirefEPSS 0.7%CVE-2024-3854HIGHIn some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This vulnerability affectEPSS 0.7%CVE-2019-11695—A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be alloEPSS 0.7%