Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Mozilla — Vulnerabilities & Security Advisories 2268

Browse all 2268 CVE security advisories affecting Mozilla. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Mozilla operates as a non-profit organization primarily known for developing the Firefox web browser and maintaining the Gecko rendering engine. Its software portfolio serves millions of users globally, focusing on open-source web technologies and privacy-centric browsing solutions. Historically, the codebase has been susceptible to a wide array of vulnerabilities, including remote code execution, cross-site scripting, and memory corruption issues such as buffer overflows. These flaws often stem from complex JavaScript engines and network stack implementations. While Mozilla maintains a robust security response team and regularly issues patches, the sheer volume of recorded Common Vulnerabilities and Exposures highlights the challenges inherent in maintaining large-scale, cross-platform applications. The organization continues to prioritize security audits and community-driven bug bounty programs to mitigate risks associated with its extensive feature set and widespread adoption.

CVE ID Title CVSS Severity Published
CVE-2025-3875 Sender Spoofing via Malformed From Header in Thunderbird — Thunderbird 4.3AI Medium AI 2025-05-14
CVE-2025-3859 Firefox Focus elide URL allows address bar spoofing — Focus 4.3AI Medium AI 2025-04-30
CVE-2025-4093 Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10 — Firefox 8.8 - 2025-04-29
CVE-2025-4092 Memory safety bugs fixed in Firefox 138 and Thunderbird 138 — Firefox 9.8 - 2025-04-29
CVE-2025-4091 Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10 — Firefox 9.8 - 2025-04-29
CVE-2025-4090 Leaked library paths in Thunderbird for Android — Firefox 4.3 - 2025-04-29
CVE-2025-4089 Potential local code execution in "copy as cURL" command — Firefox 7.8 - 2025-04-29
CVE-2025-4088 Cross-site request forgery via storage access API redirects — Firefox 8.8 - 2025-04-29
CVE-2025-4087 Unsafe attribute access during XPath parsing — Firefox 9.8 - 2025-04-29
CVE-2025-4086 Specially crafted filename could be used to obscure download type — Firefox 4.3 - 2025-04-29
CVE-2025-4085 Potential information leakage and privilege escalation in UITour actor — Firefox 8.0 - 2025-04-29
CVE-2025-4084 Potential local code execution in "copy as cURL" command — Firefox 7.8 - 2025-04-29
CVE-2025-4083 Process isolation bypass using "javascript:" URI links in cross-origin frames — Firefox 10.0 - 2025-04-29
CVE-2025-4082 WebGL shader attribute memory corruption in Thunderbird for macOS — Firefox 8.8 - 2025-04-29
CVE-2025-2817 Privilege escalation in Thunderbird Updater — Firefox 8.8 - 2025-04-29
CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL — Thunderbird 7.4AI High AI 2025-04-15
CVE-2025-3522 Leak of hashed Window credentials via crafted attachment URL — Thunderbird 7.1AI High AI 2025-04-15
CVE-2025-2830 Information Disclosure of /tmp directory listing — Thunderbird 4.3AI Medium AI 2025-04-15
CVE-2025-3608 Race condition in nsHttpTransaction could lead to memory corruption — Firefox 7.5AI High AI 2025-04-15
CVE-2025-3035 Tab title disclosure across pages when using AI chatbot — Firefox 5.3AI Medium AI 2025-04-01
CVE-2025-3034 Memory safety bugs fixed in Firefox 137 and Thunderbird 137 — Firefox 9.8 - 2025-04-01
CVE-2025-3033 Opening local .url files could lead to another file being opened — Firefox 8.8 - 2025-04-01
CVE-2025-3032 Leaking file descriptors from the fork server — Firefox 9.8 - 2025-04-01
CVE-2025-3031 JIT optimization bug with different stack slot sizes — Firefox 6.5 - 2025-04-01
CVE-2025-3030 Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 — Firefox 9.8 - 2025-04-01
CVE-2025-3029 URL Bar Spoofing via non-BMP Unicode characters — Firefox 4.3 - 2025-04-01
CVE-2025-3028 Use-after-free triggered by XSLTProcessor — Firefox 8.8 - 2025-04-01
CVE-2025-2857 Incorrect handle could lead to sandbox escapes — Firefox 9.6AI Critical AI 2025-03-27
CVE-2025-26696 Crafted email message incorrectly shown as being encrypted — Thunderbird 7.5 - 2025-03-10
CVE-2025-26695 Downloading of OpenPGP keys from WKD used incorrect padding — Thunderbird 5.3 - 2025-03-10

This page lists every published CVE security advisory associated with Mozilla. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.