Vulnerabilidades em Mozilla

2.105 resultados
Análise Vexday

Com 1.857 CVEs catalogadas e 189 classificadas como críticas, o histórico de vulnerabilidades da Mozilla reflete a complexidade de manter um navegador amplamente adotado. A taxa de exploração ativa — 9 entradas no CISA KEV, representando 0,48% do total — está em linha com a média geral do catálogo, o que indica um nível de exposição operacional compatível com o setor, sem desvio negativo expressivo. O tipo de falha mais recorrente é CWE-416 (use-after-free), uma classe de vulnerabilidade de memória com alto potencial de execução de código, e a CVE mais perigosa atualmente ativa, CVE-2016-9079, apresenta EPSS de 0,8792 — valor elevado que sugere probabilidade significativa de exploração continuada. Os 144 CVEs surgidos nos últimos 90 dias e a existência de 27 provas de conceito públicas reforçam a necessidade de monitoramento contínuo e priorização ágil de patches para ambientes que dependem de produtos Mozilla.

CVE-2022-34472MEDIUMIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrecEPSS 0.6%CVE-2025-5986MEDIUMUnsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksEPSS 0.6%CVE-2026-6746HIGHUse-after-free in the DOM: Core & HTML componentEPSS 0.6%CVE-2026-6754HIGHUse-after-free in the JavaScript Engine componentEPSS 0.6%CVE-2025-1017CRITICALMemory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7EPSS 0.6%CVE-2026-6747HIGHUse-after-free in the WebRTC componentEPSS 0.6%CVE-2024-5693MEDIUMOffscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of saEPSS 0.6%CVE-2024-5701CRITICALMemory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort soEPSS 0.6%CVE-2024-5695CRITICALIf an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been tEPSS 0.6%CVE-2026-4707HIGHIncorrect boundary conditions in the Graphics: Canvas2D componentEPSS 0.6%CVE-2024-6609HIGHMemory corruption in NSSEPSS 0.6%CVE-2026-2800CRITICALSpoofing issue in the WebAuthn component in Firefox for AndroidEPSS 0.6%CVE-2022-45411MEDIUMCross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization heaEPSS 0.6%CVE-2024-1550MEDIUMA malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-posEPSS 0.6%CVE-2024-8385CRITICALA difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. ThEPSS 0.6%CVE-2023-3482—When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a soEPSS 0.6%CVE-2023-4581—XLL file extensions were downloadable without warningsEPSS 0.6%CVE-2026-2805CRITICALInvalid pointer in the DOM: Core & HTML componentEPSS 0.6%CVE-2022-28283MEDIUMThe sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or otheEPSS 0.6%CVE-2022-22750MEDIUMBy generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged prEPSS 0.6%