# Mozilla Firefox. Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Spoofing issue in Firefox](https://agentprime.io/advisories/CVE-2025-13015.md) `CVE-2025-13015` · CVE record: Mozilla Firefox · CVSS 3.4 Low · Not analysed yet · Published 11 Nov 2025 · Tags: Authentication bypass - [Use-after-free in the Audio/Video component](https://agentprime.io/advisories/CVE-2025-13014.md) `CVE-2025-13014` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Memory corruption - [Mitigation bypass in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2025-13013.md) `CVE-2025-13013` · CVE record: Mozilla Firefox and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Authentication bypass - [Race condition in the Graphics component](https://agentprime.io/advisories/CVE-2025-13012.md) `CVE-2025-13012` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 11 Nov 2025 · Tags: Race condition - [Use-after-free in WebGPU internals triggered from a compromised child process](https://agentprime.io/advisories/CVE-2025-12380.md) `CVE-2025-12380` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2025 · Tags: Memory corruption - [Spoofing risk in Android custom tabs](https://agentprime.io/advisories/CVE-2025-11720.md) `CVE-2025-11720` · CVE record: Mozilla Firefox · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-451 - [Address bar could be spoofed on Android using visibilitychange](https://agentprime.io/advisories/CVE-2025-11718.md) `CVE-2025-11718` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-451 - [The password edit screen was not hidden in Android card view](https://agentprime.io/advisories/CVE-2025-11717.md) `CVE-2025-11717` · CVE record: Mozilla Firefox · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Information disclosure - [Memory safety bug fixed in Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11721.md) `CVE-2025-11721` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Use-after-free caused by the native messaging web extension API on Windows](https://agentprime.io/advisories/CVE-2025-11719.md) `CVE-2025-11719` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Sandboxed iframes allowed links to open in external apps (Android only)](https://agentprime.io/advisories/CVE-2025-11716.md) `CVE-2025-11716` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control - [Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11715.md) `CVE-2025-11715` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Potential user-assisted code execution in “Copy as cURL” command](https://agentprime.io/advisories/CVE-2025-11713.md) `CVE-2025-11713` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116 - [An OBJECT tag type attribute overrode browser behavior on web resources without a content-type](https://agentprime.io/advisories/CVE-2025-11712.md) `CVE-2025-11712` · CVE record: Mozilla Firefox and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116 - [Use-after-free in MediaTrackGraphImpl::GetInstance()](https://agentprime.io/advisories/CVE-2025-11708.md) `CVE-2025-11708` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11714.md) `CVE-2025-11714` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Some non-writable Object properties could be modified](https://agentprime.io/advisories/CVE-2025-11711.md) `CVE-2025-11711` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-591 - [Cross-process information leaked due to malicious IPC messages](https://agentprime.io/advisories/CVE-2025-11710.md) `CVE-2025-11710` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Information disclosure - [Out of bounds read/write in a privileged process triggered by WebGL textures](https://agentprime.io/advisories/CVE-2025-11709.md) `CVE-2025-11709` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2025-11153.md) `CVE-2025-11153` · CVE record: Mozilla Firefox · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2025 · Tags: Code injection - [Sandbox escape due to integer overflow in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-11152.md) `CVE-2025-11152` · CVE record: Mozilla Firefox · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2025 · Tags: Memory corruption - [Information disclosure, mitigation bypass in the Privacy component in Firefox for Android](https://agentprime.io/advisories/CVE-2025-10535.md) `CVE-2025-10535` · CVE record: Mozilla Firefox · CVSS 7.5 High · Not analysed yet · Published 16 Sept 2025 · Tags: Information disclosure - [Spoofing issue in the Site Permissions component](https://agentprime.io/advisories/CVE-2025-10534.md) `CVE-2025-10534` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2025 · Tags: Cross-site scripting (XSS) - [Mitigation bypass in the Web Compatibility: Tooling component](https://agentprime.io/advisories/CVE-2025-10531.md) `CVE-2025-10531` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Authentication bypass - [Spoofing issue in the WebAuthn component in Firefox for Android](https://agentprime.io/advisories/CVE-2025-10530.md) `CVE-2025-10530` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Authentication bypass - [Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143](https://agentprime.io/advisories/CVE-2025-10537.md) `CVE-2025-10537` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Information disclosure in the Networking: Cache component](https://agentprime.io/advisories/CVE-2025-10536.md) `CVE-2025-10536` · CVE record: Mozilla Firefox and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Information disclosure - [Incorrect boundary conditions in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2025-10532.md) `CVE-2025-10532` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-754 - [Same-origin policy bypass in the Layout component](https://agentprime.io/advisories/CVE-2025-10529.md) `CVE-2025-10529` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-942 - [Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-10528.md) `CVE-2025-10528` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-693 - [Sandbox escape due to use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-10527.md) `CVE-2025-10527` · CVE record: Mozilla Firefox and 1 more · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Integer overflow in the SVG component](https://agentprime.io/advisories/CVE-2025-10533.md) `CVE-2025-10533` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Address bar spoofing using an blob URI on Firefox for Android](https://agentprime.io/advisories/CVE-2025-8364.md) `CVE-2025-8364` · CVE record: Mozilla Firefox · CVSS 4.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-451 - [Sandboxed iframe could start downloads](https://agentprime.io/advisories/CVE-2025-8042.md) `CVE-2025-8042` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Broken access control - [Incorrect URL truncation in Firefox for Android](https://agentprime.io/advisories/CVE-2025-8041.md) `CVE-2025-8041` · CVE record: Mozilla Firefox · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-451 - [Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9184.md) `CVE-2025-9184` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9187.md) `CVE-2025-9187` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Spoofing issue in the Address Bar component](https://agentprime.io/advisories/CVE-2025-9183.md) `CVE-2025-9183` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-451 - [Denial-of-service due to out-of-memory in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2025-9182.md) `CVE-2025-9182` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2025 · Tags: Denial of service - [Spoofing issue in the Address Bar component of Firefox Focus for Android](https://agentprime.io/advisories/CVE-2025-9186.md) `CVE-2025-9186` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-451 - [Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9185.md) `CVE-2025-9185` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Uninitialized memory in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2025-9181.md) `CVE-2025-9181` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Same-origin policy bypass in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-9180.md) `CVE-2025-9180` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-346 - [Sandbox escape due to invalid pointer in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2025-9179.md) `CVE-2025-9179` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8044.md) `CVE-2025-8044` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Incorrect URL truncation](https://agentprime.io/advisories/CVE-2025-8043.md) `CVE-2025-8043` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-451 - [Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8035.md) `CVE-2025-8035` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8040.md) `CVE-2025-8040` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8034.md) `CVE-2025-8034` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Incorrect JavaScript state machine for generators](https://agentprime.io/advisories/CVE-2025-8033.md) `CVE-2025-8033` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Search terms persisted in URL bar](https://agentprime.io/advisories/CVE-2025-8039.md) `CVE-2025-8039` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Information disclosure - [CSP frame-src was not correctly enforced for paths](https://agentprime.io/advisories/CVE-2025-8038.md) `CVE-2025-8038` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-345 - [XSLT documents could bypass CSP](https://agentprime.io/advisories/CVE-2025-8032.md) `CVE-2025-8032` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-693 - [Incorrect URL stripping in CSP reports](https://agentprime.io/advisories/CVE-2025-8031.md) `CVE-2025-8031` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Broken access control - [Potential user-assisted code execution in “Copy as cURL” command](https://agentprime.io/advisories/CVE-2025-8030.md) `CVE-2025-8030` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Code injection - [Nameless cookies shadow secure cookies](https://agentprime.io/advisories/CVE-2025-8037.md) `CVE-2025-8037` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-614 - [DNS rebinding circumvents CORS](https://agentprime.io/advisories/CVE-2025-8036.md) `CVE-2025-8036` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-350 - [javascript: URLs executed on object and embed tags](https://agentprime.io/advisories/CVE-2025-8029.md) `CVE-2025-8029` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site scripting (XSS) - [Large branch table could lead to truncated instruction](https://agentprime.io/advisories/CVE-2025-8028.md) `CVE-2025-8028` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-1332 - [JavaScript engine only wrote partial return value to stack](https://agentprime.io/advisories/CVE-2025-8027.md) `CVE-2025-8027` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .