Vulnerabilities in mozilla
2,453 resultsCVE-2026-92240CRITICALOut-of-bounds read in IMAP response parserEPSS 0.6%CVE-2024-3852HIGHGetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, FireEPSS 0.6%CVE-2026-84637CRITICALCalendar invitation attachments could launch local executablesEPSS 0.6%CVE-2022-22755HIGHBy using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within thEPSS 0.6%CVE-2022-22746MEDIUMA race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedEPSS 0.6%CVE-2023-28161HIGHIf temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permisEPSS 0.6%CVE-2019-11754—When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious websiEPSS 0.6%CVE-2022-31738MEDIUMWhen exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user cEPSS 0.6%CVE-2023-25733HIGHThe return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference.EPSS 0.6%CVE-2023-4578—Error reporting methods in SpiderMonkey could have triggered an Out of Memory ExceptionEPSS 0.6%CVE-2026-16402CRITICALInteger overflow in the Graphics: ImageLib componentEPSS 0.6%CVE-2022-31744MEDIUMAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's ContenEPSS 0.6%CVE-2022-1887CRITICALThe search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.EPSS 0.6%CVE-2026-16395CRITICALInteger overflow in the Audio/Video componentEPSS 0.6%CVE-2026-16408CRITICALInteger overflow in the Audio/Video: Playback componentEPSS 0.6%CVE-2026-4723CRITICALUse-after-free in the JavaScript Engine componentEPSS 0.6%CVE-2024-7521CRITICALIncomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14,EPSS 0.6%CVE-2024-5692MEDIUMOn Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extEPSS 0.6%CVE-2024-9402CRITICALMemory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruptionEPSS 0.6%CVE-2023-6210—When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifrEPSS 0.6%