Mozilla Firefox for Android
33 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-8897 | unspecified – < 130.0.1 | Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be | MEDIUM 6.1 | 7.6 % | ||
| CVE-2023-29546 | unspecified – < 112 | When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-29534 | unspecified – < 112 | Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential use | CRITICAL 9.1 | 0.7 % | ||
| CVE-2023-25747 | unspecified – < 110.1.0 | A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug onl | HIGH 7.5 | 0.6 % | ||
| CVE-2023-29551 | unspecified – < 112 | Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so | HIGH 8.8 | 0.5 % | ||
| CVE-2023-29550 | unspecified – < 112 | Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29549 | unspecified – < 112 | Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vuln | MEDIUM 6.5 | 0.3 % | ||
| CVE-2023-29548 | unspecified – < 112 | A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Fo | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-29547 | unspecified – < 112 | When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have s | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-29544 | unspecified – < 112 | If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a | MEDIUM 6.5 | 0.5 % | ||
| CVE-2023-29543 | unspecified – < 112 | An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vect | HIGH 8.8 | 0.5 % | ||
| CVE-2023-29541 | unspecified – < 112 | Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled comm | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29540 | unspecified – < 112 | Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes wit | MEDIUM 6.1 | 0.3 % | ||
| CVE-2023-29539 | unspecified – < 112 | When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL cha | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29538 | unspecified – < 112 | Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> UR | MEDIUM 4.3 | 0.4 % | ||
| CVE-2023-29537 | unspecified – < 112 | Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vuln | HIGH 7.5 | 0.6 % | ||
| CVE-2023-29536 | unspecified – < 112 | An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertio | HIGH 8.8 | 0.7 % | ||
| CVE-2023-29535 | unspecified – < 112 | Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corrup | MEDIUM 6.5 | 0.7 % | ||
| CVE-2023-29533 | unspecified – < 112 | A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>win | MEDIUM 4.3 | 0.6 % | ||
| CVE-2022-26486 | unspecified – < 97.3.0 | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of atta | CRITICAL 9.6 | 2.4 % | KEV | |
| CVE-2022-26485 | unspecified – < 97.3.0 | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild ab | HIGH 8.8 | 14 % | KEV | |
| CVE-2022-1802 | unspecified – < 100.3.0 | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution | HIGH 8.8 | 28 % | ||
| CVE-2022-1529 | unspecified – < 100.3.0 | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t | HIGH 8.8 | 18 % | ||
| CVE-2021-29952 | unspecified – < 88.1.3 | When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort ma | HIGH 7.5 | 0.7 % | ||
| CVE-2021-29953 | unspecified – < 88.1.3 | A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another dom | MEDIUM 6.1 | 0.6 % | ||
| CVE-2020-6829 | unspecified – < 80 | When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the | MEDIUM 5.3 | 1.5 % | ||
| CVE-2020-12401 | unspecified – < 80 | During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultin | MEDIUM 4.7 | 0.3 % | ||
| CVE-2020-12400 | unspecified – < 80 | When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible tim | MEDIUM 4.7 | 0.3 % | ||
| CVE-2020-15664 | unspecified – < 80 | By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger | MEDIUM 6.5 | 1.4 % | ||
| CVE-2020-15666 | unspecified – < 80 | When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the M | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-15668 | unspecified – < 80 | A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects | MEDIUM 4.3 | 0.5 % | ||
| CVE-2020-15670 | unspecified – < 80 | Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption an | HIGH 8.8 | 1.1 % | ||
| CVE-2020-15671 | unspecified – < 80 | When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input | LOW 3.1 | 0.5 % |