Thu, Mar 27 · 02:15 PM CDTCVE-2025-2857
10.0/10 · Must read/watchNVDvuln
Summary
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the
CVECVE-2025-2857
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 27 · 02:15 PM CDT
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-0247
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134.
CVECVE-2025-0247
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 07 · 04:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-1009
9.8/10 · Must read/watchNVDvuln
Summary
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1009
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-1016
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability w
CVECVE-2025-1016
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-1017
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128
CVECVE-2025-1017
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-1020
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135.
CVECVE-2025-1020
SeverityCRITICAL
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-1942
9.8/10 · Must read/watchNVDvuln
Summary
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
CVECVE-2025-1942
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-26319
9.8/10 · Must read/watchNVDvuln
Summary
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.
CVECVE-2025-26319
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 04 · 10:15 PM CST
ModifiedWed, Sep 30 · 05:10 PM CDT
CVE-2025-4918
9.8/10 · Must read/watchNVDvuln
Summary
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
CVECVE-2025-4918
SeverityCRITICAL
TypeUPDATED
PublishedSat, May 17 · 10:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-49709
9.8/10 · Must read/watchNVDvuln
Summary
Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.
CVECVE-2025-49709
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 11 · 12:15 PM CDT
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-49710
9.8/10 · Must read/watchNVDvuln
Summary
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.
CVECVE-2025-49710
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 11 · 12:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-54143
9.8/10 · Must read/watchNVDvuln
Summary
Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.
CVECVE-2025-54143
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 19 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-6424
9.8/10 · Must read/watchNVDvuln
Summary
A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVECVE-2025-6424
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 24 · 01:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-6433
9.8/10 · Must read/watchNVDvuln
Summary
If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability was fixed
CVECVE-2025-6433
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 24 · 01:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8028
9.8/10 · Must read/watchNVDvuln
Summary
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbir
CVECVE-2025-8028
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8031
9.8/10 · Must read/watchNVDvuln
Summary
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVECVE-2025-8031
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8038
9.8/10 · Must read/watchNVDvuln
Summary
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVECVE-2025-8038
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8043
9.8/10 · Must read/watchNVDvuln
Summary
Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.
CVECVE-2025-8043
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8044
9.8/10 · Must read/watchNVDvuln
Summary
Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141.
CVECVE-2025-8044
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-1941
9.1/10 · Must read/watchNVDvuln
Summary
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245). This vulnerability was fixed in Firefox 136.
CVECVE-2025-1941
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-4083
9.1/10 · Must read/watchNVDvuln
Summary
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR
CVECVE-2025-4083
SeverityCRITICAL
TypeUPDATED
PublishedTue, Apr 29 · 02:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-6427
9.1/10 · Must read/watchNVDvuln
Summary
An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVECVE-2025-6427
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 24 · 01:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-8037
9.1/10 · Must read/watchNVDvuln
Summary
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVECVE-2025-8037
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 22 · 09:15 PM CDT
ModifiedWed, Sep 30 · 06:10 PM CDT
CVE-2025-1010
8.8/10 · Worth your timeNVDvuln
Summary
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1010
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
CVE-2025-1011
8.8/10 · Worth your timeNVDvuln
Summary
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
CVECVE-2025-1011
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 04 · 02:15 PM CST
ModifiedWed, Sep 30 · 07:10 PM CDT
