| CVE-2025-11717 |
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a…
|
9.1
Critical
|
Oct 14, 2025 |
| CVE-2025-11719 |
Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes…
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-11708 |
Use-after-free in MediaTrackGraphImpl::GetInstance()
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-11710 |
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks…
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-11709 |
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using…
|
9.8
Critical
|
Oct 14, 2025 |
| CVE-2025-8042 |
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads
|
9.8
Critical
|
Aug 19, 2025 |
| CVE-2025-9187 |
Memory safety bugs present in Firefox 141 and Thunderbird 141
|
9.8
Critical
|
Aug 19, 2025 |
| CVE-2025-9179 |
An attacker was able to perform memory corruption in the GMP process which processes encrypted media
|
9.8
Critical
|
Aug 19, 2025 |
| CVE-2025-8044 |
Memory safety bugs present in Firefox 140 and Thunderbird 140
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8043 |
Focus incorrectly truncated URLs towards the beginning instead of around the origin
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8031 |
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic…
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8038 |
Thunderbird ignored paths when checking the validity of navigations in a frame
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-8037 |
Setting a nameless cookie with an equals sign in the value shadowed other cookies
|
9.1
Critical
|
Jul 22, 2025 |
| CVE-2025-8028 |
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction…
|
9.8
Critical
|
Jul 22, 2025 |
| CVE-2025-6433 |
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a…
|
9.8
Critical
|
Jun 24, 2025 |
| CVE-2025-6427 |
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments
|
9.1
Critical
|
Jun 24, 2025 |
| CVE-2025-6424 |
A use-after-free in FontFaceSet resulted in a potentially exploitable crash
|
9.8
Critical
|
Jun 24, 2025 |
| CVE-2025-49710 |
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine
|
9.8
Critical
|
Jun 11, 2025 |
| CVE-2025-49709 |
Certain canvas operations could have lead to memory corruption
|
9.8
Critical
|
Jun 11, 2025 |
| CVE-2025-4918 |
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object
|
9.8
Critical
|
May 17, 2025 |
| CVE-2025-4083 |
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow…
|
9.1
Critical
|
Apr 29, 2025 |
| CVE-2025-2857 |
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in…
|
10.0
Critical
|
Mar 27, 2025 |
| CVE-2025-1942 |
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into…
|
9.8
Critical
|
Mar 4, 2025 |
| CVE-2025-1941 |
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been…
|
9.1
Critical
|
Mar 4, 2025 |
| CVE-2025-1020 |
Memory safety bugs present in Firefox 134 and Thunderbird 134
|
9.8
Critical
|
Feb 4, 2025 |