FM
Product
Firefox Mobile
On CISA KEVExploited in the wild
87
CVEs
2
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 4High 17Medium 45Low 1
Watch
Add Firefox Mobile to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-81267 | 5.4 | Aug 31 | Stalled popup navigation could allow address bar origin spoofing in Firefox for iOS Affected: before 155.0 |
| CVE-2026-74975 | 5.4 | Aug 18 | Spoofing issue in the Downloads component in Firefox for Android Affected: before 154.0 |
| CVE-2026-14906 | 5.3 | Jul 13 | Malicious webpage titles could allow overwriting of bundled PDF resources when saving webpages as PDFs in Firefox for iOS Affected: before 152.4 |
| CVE-2020-6829 | 5.3 | Oct 28 | When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation Affected: before 80.0 |
| CVE-2020-12401 | 4.7 | Oct 8 | During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent… Affected: before 80.0 |
| CVE-2020-12400 | 4.7 | Oct 8 | When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack Affected: before 80.0 |
| CVE-2026-86853 | 4.3 | Sep 8 | Repeated external URL scheme launches could potentially cause a denial of service in Firefox for iOS Affected: before 155.1 |
| CVE-2026-84127 | 4.3 | Sep 1 | Information disclosure in the WebExtensions component in Firefox for Android Affected: before 155.0 |
| CVE-2026-53900 | 4.3 | Jun 16 | Cookie injection was possible when opening a PDF link Affected: before 152.0 |
| CVE-2024-38313 | 4.3 | Jun 13 | In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects… Affected: before 127.0 |
| CVE-2023-29538 | 4.3 | Jun 2 | Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request Affected: before 112.0 |
| CVE-2023-29533 | 4.3 | Jun 2 | A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and… Affected: before 112.0 |
| CVE-2022-38474 | 4.3 | Dec 22 | A website that had permission to access the microphone could record audio without the audio notification being shown Affected: before 104.0 |
| CVE-2020-26954 | 4.3 | Dec 9 | When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other… Affected: before 83.0 |
| CVE-2020-15668 | 4.3 | Oct 1 | A lock was missing when accessing a data structure and importing certificate information into the trust database Affected: before 80.0 |
| CVE-2020-12404 | 4.3 | Jul 9 | For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions Affected: before 26.0 |
| CVE-2020-15671 | 3.1 | Oct 1 | When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password… Affected: before 80.0 |
| CVE-2012-3979 | – | Aug 29 | Mozilla Firefox before 15.0 on Android does not properly implement unspecified callers of the __android_log_print function, which allows remote attackers to execute arbitrary code… Affected: 6.0.1; 6.0.2; 10.0; 10.0.1; 10.0.2; 10.0.3; +1 more |
| CVE-2012-1144 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1143 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1142 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1141 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1140 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1139 | – | Apr 25 | Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid stack… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1138 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1137 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1136 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1135 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1134 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1133 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1132 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1131 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit platforms allows remote attackers to cause a denial of service (invalid heap… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1130 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1129 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1128 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1127 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |
| CVE-2012-1126 | – | Apr 25 | FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and… Affected: through 10.0.3; 1.0; 4.0; 4.0; 4.0; 4.0; +11 more |