Advisories · Technology

Mozilla Firefox.

Every CVE that names Mozilla Firefox among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-13015 CVE record

CVSS 3.4 Low

Spoofing issue in Firefox
- Mozilla Firefox
- Authentication bypass
Not analysed yet 11 Nov 2025
CVE-2025-13014 CVE record

CVSS 8.8 High

Use-after-free in the Audio/Video component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 11 Nov 2025
CVE-2025-13013 CVE record

CVSS 6.1 Medium

Mitigation bypass in the DOM: Core & HTML component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 11 Nov 2025
CVE-2025-13012 CVE record

CVSS 7.5 High

Race condition in the Graphics component
- Mozilla Firefox
- Mozilla Thunderbird
- Race condition
Not analysed yet 11 Nov 2025
CVE-2025-12380 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in WebGPU internals triggered from a compromised child process
- Mozilla Firefox
- Memory corruption
Not analysed yet 28 Oct 2025
CVE-2025-11720 CVE record

CVSS 8.1 High

Spoofing risk in Android custom tabs
- Mozilla Firefox
- CWE-451
Not analysed yet 14 Oct 2025
CVE-2025-11718 CVE record

CVSS 6.5 Medium

Address bar could be spoofed on Android using visibilitychange
- Mozilla Firefox
- CWE-451
Not analysed yet 14 Oct 2025
CVE-2025-11717 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

The password edit screen was not hidden in Android card view
- Mozilla Firefox
- Information disclosure
Not analysed yet 14 Oct 2025
CVE-2025-11721 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bug fixed in Firefox 144 and Thunderbird 144
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11719 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free caused by the native messaging web extension API on Windows
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11716 CVE record

CVSS 6.5 Medium

Sandboxed iframes allowed links to open in external apps (Android only)
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 14 Oct 2025
CVE-2025-11715 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11713 CVE record

CVSS 8.1 High

Potential user-assisted code execution in “Copy as cURL” command
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-116
Not analysed yet 14 Oct 2025
CVE-2025-11712 CVE record

CVSS 6.1 Medium

An OBJECT tag type attribute overrode browser behavior on web resources without a content-type
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-116
Not analysed yet 14 Oct 2025
CVE-2025-11708 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use-after-free in MediaTrackGraphImpl::GetInstance()
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11714 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11711 CVE record

CVSS 6.5 Medium

Some non-writable Object properties could be modified
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-591
Not analysed yet 14 Oct 2025
CVE-2025-11710 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Cross-process information leaked due to malicious IPC messages
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 14 Oct 2025
CVE-2025-11709 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Out of bounds read/write in a privileged process triggered by WebGL textures
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 14 Oct 2025
CVE-2025-11153 CVE record

CVSS 7.5 High

JIT miscompilation in the JavaScript Engine: JIT component
- Mozilla Firefox
- Code injection
Not analysed yet 30 Sept 2025
CVE-2025-11152 CVE record

CVSS 8.6 High

Sandbox escape due to integer overflow in the Graphics: Canvas2D component
- Mozilla Firefox
- Memory corruption
Not analysed yet 30 Sept 2025
CVE-2025-10535 CVE record

CVSS 7.5 High

Information disclosure, mitigation bypass in the Privacy component in Firefox for Android
- Mozilla Firefox
- Information disclosure
Not analysed yet 16 Sept 2025
CVE-2025-10534 CVE record

CVSS 8.1 High

Spoofing issue in the Site Permissions component
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 16 Sept 2025
CVE-2025-10531 CVE record

CVSS 5.4 Medium

Mitigation bypass in the Web Compatibility: Tooling component
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 16 Sept 2025
CVE-2025-10530 CVE record

CVSS 6.5 Medium

Spoofing issue in the WebAuthn component in Firefox for Android
- Mozilla Firefox
- Mozilla Thunderbird
- Authentication bypass
Not analysed yet 16 Sept 2025
CVE-2025-10537 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Sept 2025
CVE-2025-10536 CVE record

CVSS 6.2 Medium

Information disclosure in the Networking: Cache component
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 16 Sept 2025
CVE-2025-10532 CVE record

CVSS 6.5 Medium

Incorrect boundary conditions in the JavaScript: GC component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-754
Not analysed yet 16 Sept 2025
CVE-2025-10529 CVE record

CVSS 6.5 Medium

Same-origin policy bypass in the Layout component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-942
Not analysed yet 16 Sept 2025
CVE-2025-10528 CVE record

CVSS 7.3 High

Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 16 Sept 2025
CVE-2025-10527 CVE record

CVSS 7.1 High

Sandbox escape due to use-after-free in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Sept 2025
CVE-2025-10533 CVE record

CVSS 8.8 High

Integer overflow in the SVG component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 16 Sept 2025
CVE-2025-8364 CVE record

CVSS 4.3 Medium

Address bar spoofing using an blob URI on Firefox for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 19 Aug 2025
CVE-2025-8042 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandboxed iframe could start downloads
- Mozilla Firefox
- Broken access control
Not analysed yet 19 Aug 2025
CVE-2025-8041 CVE record

CVSS 5.3 Medium

Incorrect URL truncation in Firefox for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 19 Aug 2025
CVE-2025-9184 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Aug 2025
CVE-2025-9187 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 142 and Thunderbird 142
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Aug 2025
CVE-2025-9183 CVE record

CVSS 6.5 Medium

Spoofing issue in the Address Bar component
- Mozilla Firefox
- CWE-451
Not analysed yet 19 Aug 2025
CVE-2025-9182 CVE record

CVSS 7.5 High

Denial-of-service due to out-of-memory in the Graphics: WebRender component
- Mozilla Firefox
- Mozilla Thunderbird
- Denial of service
Not analysed yet 19 Aug 2025
CVE-2025-9186 CVE record

CVSS 6.5 Medium

Spoofing issue in the Address Bar component of Firefox Focus for Android
- Mozilla Firefox
- CWE-451
Not analysed yet 19 Aug 2025
CVE-2025-9185 CVE record

CVSS 8.1 High

Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Aug 2025
CVE-2025-9181 CVE record

CVSS 6.5 Medium

Uninitialized memory in the JavaScript Engine component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Aug 2025
CVE-2025-9180 CVE record

CVSS 8.1 High

Same-origin policy bypass in the Graphics: Canvas2D component
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-346
Not analysed yet 19 Aug 2025
CVE-2025-9179 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Sandbox escape due to invalid pointer in the Audio/Video: GMP component
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 19 Aug 2025
CVE-2025-8044 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Memory safety bugs fixed in Firefox 141 and Thunderbird 141
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025
CVE-2025-8043 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect URL truncation
- Mozilla Firefox
- CWE-451
Not analysed yet 22 Jul 2025
CVE-2025-8035 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025
CVE-2025-8040 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025
CVE-2025-8034 CVE record

CVSS 8.8 High

Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025
CVE-2025-8033 CVE record

CVSS 6.5 Medium

Incorrect JavaScript state machine for generators
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025
CVE-2025-8039 CVE record

CVSS 8.1 High

Search terms persisted in URL bar
- Mozilla Firefox
- Mozilla Thunderbird
- Information disclosure
Not analysed yet 22 Jul 2025
CVE-2025-8038 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

CSP frame-src was not correctly enforced for paths
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-345
Not analysed yet 22 Jul 2025
CVE-2025-8032 CVE record

CVSS 8.1 High

XSLT documents could bypass CSP
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-693
Not analysed yet 22 Jul 2025
CVE-2025-8031 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Incorrect URL stripping in CSP reports
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 22 Jul 2025
CVE-2025-8030 CVE record

CVSS 8.1 High

Potential user-assisted code execution in “Copy as cURL” command
- Mozilla Firefox
- Mozilla Thunderbird
- Code injection
Not analysed yet 22 Jul 2025
CVE-2025-8037 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Nameless cookies shadow secure cookies
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-614
Not analysed yet 22 Jul 2025
CVE-2025-8036 CVE record

CVSS 8.1 High

DNS rebinding circumvents CORS
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-350
Not analysed yet 22 Jul 2025
CVE-2025-8029 CVE record

CVSS 8.1 High

javascript: URLs executed on object and embed tags
- Mozilla Firefox
- Mozilla Thunderbird
- Cross-site scripting (XSS)
Not analysed yet 22 Jul 2025
CVE-2025-8028 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Large branch table could lead to truncated instruction
- Mozilla Firefox
- Mozilla Thunderbird
- CWE-1332
Not analysed yet 22 Jul 2025
CVE-2025-8027 CVE record

CVSS 6.5 Medium

JavaScript engine only wrote partial return value to stack
- Mozilla Firefox
- Mozilla Thunderbird
- Memory corruption
Not analysed yet 22 Jul 2025