Mozilla

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally.

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into inclu

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially lea

By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab

Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption a

After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *

Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks.

An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed

Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs

A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a poten

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulner

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in o

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an Ope

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have l

Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. Thi

Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vul

Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption a

When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been b

A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used

Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could h

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retri

A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerabilit

It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering ga

On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can poten

An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Onl

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potenti

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the

Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption a

The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be l

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have b

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, a

The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and exp

Certificate length was not properly checked when added to a certificate store. In practice only trusted data was process

A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have result

A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135,

A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage t

An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash.

An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This v

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This v

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofi

Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption a

When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android

Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been b