Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding.Check this weekEPSS 35.00%Jun 24, 2025
- Medium6.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so.Check this weekEPSS 25.00%Jun 24, 2025
- Medium4.3When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.Check this weekEPSS 23.00%Jun 24, 2025
- Medium6.1When a file download is specified via the header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerable to a cross-site scrCheck this weekEPSS 27.00%Jun 24, 2025
- Critical9.1An attacker was able to bypass the directive of a Content Security Policy by manipulating subdocuments.Check this weekEPSS 37.00%Jun 24, 2025
- Medium6.5Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an tag.Check this weekEPSS 36.00%Jun 24, 2025
- High8.8The executable file warning did not warn users before opening files with the extension.Check this weekEPSS 21.00%Jun 24, 2025
- Medium4.3An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/priCheck this weekEPSS 31.00%Jun 24, 2025
- Critical9.8A use-after-free in FontFaceSet resulted in a potentially exploitable crash.Check if you run itEPSS 4.39%Jun 24, 2025
- Critical9.8An integer overflow was present in used by the JavaScript engine.Check if you run itEPSS 0.74%Jun 11, 2025
- Critical9.8Certain canvas operations could have lead to memory corruption.Check if you run itEPSS 0.66%Jun 11, 2025
- High7.3Memory safety bugs present in Firefox 138 and Thunderbird 138.Check if you run itEPSS 0.33%May 27, 2025
- Medium6.5Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks.Check if you run itEPSS 0.30%May 27, 2025
- High7.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.Check if you run itEPSS 0.29%May 27, 2025
- High8.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.46%May 27, 2025
- High8.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.49%May 27, 2025
- Medium5.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.Check if you run itEPSS 0.27%May 27, 2025
- Medium4.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.Check if you run itEPSS 0.33%May 27, 2025
- Medium4.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code exeCheck if you run itEPSS 0.21%May 27, 2025
- Medium4.8Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execuCheck if you run itEPSS 0.29%May 27, 2025
- Medium4.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks.Check if you run itEPSS 0.25%May 27, 2025
- Medium4.3Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internCheck if you run itEPSS 0.24%May 21, 2025
- High8.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.Check if you run itEPSS 8.67%May 17, 2025
- Critical9.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object.Check if you run itEPSS 9.43%May 17, 2025
- None0.0Duplicate of CVE-2025-4919Check if you run itEPSS 0.00%May 17, 2025