Vulnerabilities in mozilla

2,453 results
CVE-2022-45407HIGHIf an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potentEPSS 0.7%CVE-2022-45404MEDIUMThrough a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing theEPSS 0.7%CVE-2023-25743—A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug onlyEPSS 0.6%CVE-2023-25742—When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affecEPSS 0.6%CVE-2021-29953—A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domEPSS 0.6%CVE-2023-32212—An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 1EPSS 0.6%CVE-2023-6872—Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a privatEPSS 0.6%CVE-2023-5722—Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary heaEPSS 0.6%CVE-2023-1945MEDIUMUnexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerabilEPSS 0.6%CVE-2020-26954—When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed deEPSS 0.6%CVE-2021-29954—Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. This vulneraEPSS 0.6%CVE-2023-6206—The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possibleEPSS 0.6%CVE-2019-11701—The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place aEPSS 0.6%CVE-2023-23598—Arbitrary file read from GTK drag and drop on LinuxEPSS 0.6%CVE-2023-23603MEDIUMCalls to console.log allowed bypassing Content Security Policy via format directiveEPSS 0.6%CVE-2026-2787HIGHUse-after-free in the DOM: Window and Location componentEPSS 0.6%CVE-2024-10458MEDIUMA permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects EPSS 0.6%CVE-2023-49060—An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. TEPSS 0.6%CVE-2023-37212—Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soEPSS 0.6%CVE-2024-7520HIGHA type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects FireEPSS 0.6%