Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

63 results · page 1 of 2

Oct 27, 2026Spoofing issue in the Downloads component in Firefox for Android.CVE-2026-118018 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 159.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 29, 2026Spoofing issue in the Downloads component in Firefox for Android.CVE-2026-100823 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 157.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 15, 2026Privilege escalation in Firefox for Android.CVE-2026-92033 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 1, 2026Information disclosure in the WebExtensions component in Firefox for Android.CVE-2026-84127 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 1, 2026Privilege escalation in Firefox for Android.CVE-2026-84117 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Clickjacking issue in the Downloads component in Firefox for Android.CVE-2026-74980 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Spoofing issue in the Downloads component in Firefox for Android.CVE-2026-74975 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.4
Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 18, 2026Clickjacking issue in Firefox for Android.CVE-2026-74951 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 4, 2026Information disclosure in Firefox for Android and Firefox Focus for Android.CVE-2026-18809 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Information disclosure in Firefox for Android and Firefox Focus for Android. This vulnerability was fixed in Firefox 153.0.3.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 21, 2026Spoofing issue in Firefox for Android.CVE-2026-16404 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.4
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 21, 2026Clickjacking issue in the WebExtensions component in Firefox for Android.CVE-2026-16397 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jul 21, 2026Information disclosure in the Privacy component in Firefox for Android.CVE-2026-16373 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
May 19, 2026Spoofing issue in the Toolbar component in Firefox for Android.CVE-2026-8951 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Apr 21, 2026Mitigation bypass in Firefox for Android.CVE-2026-6756 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Mar 10, 2026Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android.CVE-2026-3845 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 24, 2026Spoofing issue in the WebAuthn component in Firefox for Android.CVE-2026-2800 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 16, 2025Information disclosure, mitigation bypass in the Privacy component in Firefox for Android.CVE-2025-10535 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 16, 2025Spoofing issue in the WebAuthn component in Firefox for Android.CVE-2025-10530 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 19, 2025Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads.CVE-2025-8042 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 19, 2025In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin.CVE-2025-8041 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 24, 2025When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so.CVE-2025-6431 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 24, 2025When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing aCVE-2025-6428 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Sep 17, 2024Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the adCVE-2024-8897 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be able to spoof the address bar contents. This can lead to a malicious site to appear to have the same URL as the trusted site. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 130.0.1.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
May 14, 2024Different techniques existed to obscure the fullscreen notification in Firefox for Android.CVE-2024-4766 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org bugzilla.mozilla.org
Jun 19, 2023When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive informatiCVE-2023-29546 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking sensitive information. *This bug only affects Firefox for Android. Other operating systems are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 19, 2023Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android.CVE-2023-29534 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.1
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox and Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 112 and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org bugzilla.mozilla.org
Jun 19, 2023A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.CVE-2023-25747 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Memory safety bugs present in Firefox 111.CVE-2023-29551 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm.CVE-2023-29549 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed.CVE-2023-29547 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitCVE-2023-29544 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector.CVE-2023-29543 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-topCVE-2023-29540 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load requCVE-2023-29538 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 2, 2023Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code.CVE-2023-29537 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
Product
Firefox for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org bugzilla.mozilla.org
Jun 2, 2023The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks.CVE-2023-28159 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 111.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings. *Note: This issue only affected Firefox for ACVE-2022-29910 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 100.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 22, 2022When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content. *This bug only affects Firefox for ACVE-2022-22749 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 8, 2021A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code.CVE-2021-43530 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Nov 2, 2021Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs.CVE-2021-29993 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 17, 2021Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit.CVE-2021-29983 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Aug 5, 2021Password autofill was enabled without user interaction on insecure websites on Firefox for Android.CVE-2021-29973 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected to require user interaction with the page before a user's password would be entered by the browser's autofill functionality *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 90.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 24, 2021Firefox for Android would become unstable and hard-to-recover when a website opened too many popups.CVE-2021-29962 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Jun 24, 2021A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a CVE-2021-29953 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Feb 25, 2021Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directoCVE-2021-23977 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories. Note: This issue is only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Feb 25, 2021When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifCVE-2021-23976 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. Note: This issue is a different issue from CVE-2020-26954 and only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 86.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org security.gentoo.org
Jan 7, 2021When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to CVE-2020-26975 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been specified, leading to attacks such as abusing ambient authority or session fixation. This was resolved by only allowing certain safe-listed headers. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 84.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 8, 2020If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to thCVE-2020-26964 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.8
If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could have connected to the feature and operated with the privileges of the browser to read and interact with web content. The feature was implemented as a unix domain socket, protected by the Android SELinux policy; however, SELinux was not enforced for versions prior to 6.0. This was fixed by removing the Remote Debugging via USB feature from affected devices. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 8, 2020OneCRL was non-functional in the new Firefox for Android due to a missing service initialization.CVE-2020-26957 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org
Dec 8, 2020When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domCVE-2020-26955 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.
Product
Firefox
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.mozilla.org mozilla.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.