Vulnerabilities in mozilla
2,453 resultsCVE-2022-45411MEDIUMCross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization heaEPSS 0.6%CVE-2024-3856HIGHA use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects FirEPSS 0.6%CVE-2022-29911MEDIUMAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execuEPSS 0.6%CVE-2020-12397—By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird dispEPSS 0.6%CVE-2025-9179CRITICALSandbox escape due to invalid pointer in the Audio/Video: GMP componentEPSS 0.6%CVE-2023-25752—When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may haEPSS 0.6%CVE-2019-11762—If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/EPSS 0.6%CVE-2026-74988CRITICALInternally found bugs fixed in Firefox ESR 153.1 and Firefox 154EPSS 0.6%CVE-2024-2611MEDIUMA missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerabilEPSS 0.6%CVE-2023-25747HIGHA potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.
*This bug onlEPSS 0.6%CVE-2022-45420MEDIUMUse tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resultingEPSS 0.6%CVE-2024-7527HIGHUnexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR <EPSS 0.6%CVE-2022-34475MEDIUMSVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitEPSS 0.6%CVE-2022-46883HIGHMozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in FirEPSS 0.6%CVE-2026-8956CRITICALInteger overflow in the Networking: JAR componentEPSS 0.6%CVE-2021-24000—A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they wEPSS 0.6%CVE-2025-5986MEDIUMUnsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksEPSS 0.6%CVE-2018-5109—An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow tEPSS 0.6%CVE-2024-2609MEDIUMThe permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websiEPSS 0.6%CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%