Firefox For Android (Mozilla) - vulnerabilities (CVEs)

33 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-09-17. Vendor: Mozilla.

CVEs of Firefox For Android

CVE-2024-8897 - CVSS 6.1 (medium), 2024-09-17: Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the…
CVE-2023-29534 - CVSS 9.1 (critical), 2023-06-19: Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and…
CVE-2023-25747 - CVSS 7.5 (high), 2023-06-19: A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox…
CVE-2023-29546 - CVSS 6.5 (medium), 2023-06-19: When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive…
CVE-2023-29551 - CVSS 8.8 (high), 2023-06-02: Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could…
CVE-2023-29533 - CVSS 4.3 (medium), 2023-06-02: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code>…
CVE-2023-29537 - CVSS 7.5 (high), 2023-06-02: Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects…
CVE-2023-29540 - CVSS 6.1 (medium), 2023-06-02: Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without…
CVE-2023-29544 - CVSS 6.5 (medium), 2023-06-02: If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially…
CVE-2023-29549 - CVSS 6.5 (medium), 2023-06-02: Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating…
CVE-2023-29536 - CVSS 8.8 (high), 2023-06-02: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory…
CVE-2023-29539 - CVSS 8.8 (high), 2023-06-02: When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could…
CVE-2023-29543 - CVSS 8.8 (high), 2023-06-02: An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This…
CVE-2023-29548 - CVSS 6.5 (medium), 2023-06-02: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android <…
CVE-2023-29535 - CVSS 6.5 (medium), 2023-06-02: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a…
CVE-2023-29538 - CVSS 4.3 (medium), 2023-06-02: Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load…
CVE-2023-29541 - CVSS 8.8 (high), 2023-06-02: Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This…
CVE-2023-29547 - CVSS 6.5 (medium), 2023-06-02: When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed.…
CVE-2023-29550 - CVSS 8.8 (high), 2023-06-02: Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough…
CVE-2022-26486 - CVSS 9.6 (critical), 2022-12-22: An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild…
CVE-2022-26485 - CVSS 8.8 (high), 2022-12-22: Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw.…
CVE-2022-1529 - CVSS 8.8 (high), 2022-12-22: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype…
CVE-2022-1802 - CVSS 8.8 (high), 2022-12-22: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of…
CVE-2021-29953 - CVSS 6.1 (medium), 2021-06-24: A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in…
CVE-2021-29952 - CVSS 7.5 (high), 2021-06-24: When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been…
CVE-2020-6829 - CVSS 5.3 (medium), 2020-10-28: When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during…
CVE-2020-12401 - CVSS 4.7 (medium), 2020-10-08: During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time…
CVE-2020-12400 - CVSS 4.7 (medium), 2020-10-08: When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side…
CVE-2020-15666 - CVSS 6.5 (medium), 2020-10-01: When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message.…
CVE-2020-15671 - CVSS 3.1 (low), 2020-10-01: When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting…
CVE-2020-15664 - CVSS 6.5 (medium), 2020-10-01: By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which…
CVE-2020-15670 - CVSS 8.8 (high), 2020-10-01: Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that…
CVE-2020-15668 - CVSS 4.3 (medium), 2020-10-01: A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and…