Mozilla Firefox — свободный браузер на движке Gecko
Релизный цикл, информация об уязвимостях
График релизов
Релизные элементы
| KB | Версия | Билд | Дата доступности |
|---|---|---|---|
| 138.0.4 | 138.0.4 | ||
| 138.0.3 | 138.0.3 | ||
| 138.0.1 | 138.0.1 | ||
| 138.0 | 138.0 |
Показывать по
Количество 17 304
CVE-2025-6432
When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140.
CVE-2025-6432
When Multi-Account Containers was enabled, DNS requests could have byp ...
CVE-2025-6431
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVE-2025-6431
When a link can be opened in an external application, Firefox for Andr ...
CVE-2025-6430
When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVE-2025-6430
When a file download is specified via the `Content-Disposition` header ...
CVE-2025-6429
Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVE-2025-6429
Firefox could have incorrectly parsed a URL and rewritten it to the yo ...
CVE-2025-6428
When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVE-2025-6428
When a URL was provided in a link querystring parameter, Firefox for A ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2025-6432 When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140. | CVSS3: 8.6 | 0% Низкий | около 1 года назад |
| CVE-2025-6432 When Multi-Account Containers was enabled, DNS requests could have byp ... | CVSS3: 8.6 | 0% Низкий | около 1 года назад |
| CVE-2025-6431 When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140. | CVSS3: 6.5 | 0% Низкий | около 1 года назад |
| CVE-2025-6431 When a link can be opened in an external application, Firefox for Andr ... | CVSS3: 6.5 | 0% Низкий | около 1 года назад |
| CVE-2025-6430 When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | CVSS3: 6.1 | 0% Низкий | около 1 года назад |
| CVE-2025-6430 When a file download is specified via the `Content-Disposition` header ... | CVSS3: 6.1 | 0% Низкий | около 1 года назад |
| CVE-2025-6429 Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | CVSS3: 6.5 | 0% Низкий | около 1 года назад |
| CVE-2025-6429 Firefox could have incorrectly parsed a URL and rewritten it to the yo ... | CVSS3: 6.5 | 0% Низкий | около 1 года назад |
| CVE-2025-6428 When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140. | CVSS3: 4.3 | 0% Низкий | около 1 года назад |
| CVE-2025-6428 When a URL was provided in a link querystring parameter, Firefox for A ... | CVSS3: 4.3 | 0% Низкий | около 1 года назад |
Уязвимостей на страницу