All Products Community Forum

I would like to know how the Firefox CVEs are affected on its version which are mentioned in NVD.

Let take mfsa2025-59, for example CVE-2025-8040, as per the NVD its says Firefox ESR < 140.1 is affected so does that mean it affect all the version which are lower than 140.1 which included the ESR 128 and ESR 115 versions or just the ESR 140 version series? then it raise on more question check this cve-2025-8029 in NVD it has specifically mentioned it only affect "Firefox ESR < 128.13, Firefox ESR < 140.1" and not the ESR 115 versions. Could anyone confirm it does not affect the ESR 115 versions or it affect all the versions? Now check this one cve-2025-8027, NVD clearly mentioned "Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1" are affected so what I understand is that if the Firefox ESR 115 is vulnerable to any CVE it would be mentioned in the NVD specifically.

My point is that if any Firefox CVEs are listed in NVD and it specify only one version like “Firefox ESR < 140.1” what does that mean? Does it affect all the versions which include ESR 128 and ESR 115 or just the ESR 140 series version only affected? If any CVEs are affected on the ESR 115 and ESR 128 does Mozilla specifically mentioned those versions are affected right? Just like its mentioned in the cve-2025-8027

Any help would be appreciated to clarify this.

Today, using Firefox--or at least what i think is Firefox--i checed session history while logged into my mega.nz account. It lists 2 instances, one of which is for 3 days prior when I originally set up the Mega account using the Mega app, and the other is for yesterday when I entered the account using the FF browser--or, again, what i think is the FF browser. What's curious is that it shows i was using the Chrome browser, and that I'm apparently still using this browser as it's listed as the "Current" session. How can this be? While I have the Chrome app on my phone, I disabled it long ago and have never used it, and most certainly did not use it during the time and activities in question. I have long speculated that I have been hacked and that my phone is sometimes (always?) controlled by this hacker, though no solid proof. Assuming the hacker uses Chrome, could this be reflecting their using the Chrome browser, as opposed to the FF browser, which I'm currently using (or think im using)? In other words, is this the proof of a hack? Or is this a glitch within Mega, mistakingly listing Chrome as my browser?

Firefox had been a safe haven for anti-AI, and used to be my go-to search engine. If this AI bullshit continues, no one will respect or use the browser. Stop implementing AI garbage that steals data

GNU nano 8.6 /etc/firefox/policies.json {

 "policies": {
   "DisableFirefoxStudies": true,
   "DisableTelemetry": true,
   "DisableSystemAddonUpdate": true

   "Preferences": {
     "app.normandy.enabled": false,
     "app.shield.optoutstudies.enabled": false,
     "extensions.autoDisableScopes": 15
    }
  }
} Hidden modifications to settings and extensions is absolutely not OK!!!!!!

This is a security environment.

I am constantly getting messages in quick messages to clear my search history! This is supposed to happen automatically when i close the site and in fact sais it has been cleared. I cant ever find the last sites i visited but it is rather disturbing to think that someone is seeing my search history without my authorization! So tell me squarely ,why do i keep getting that disturbing message?

When I attempt to add a Gmail account, I get this error - "Unable to login at server. Probably wrong configuration, username, or password"

Below are the steps with screenshots: - checked for no cookies to prevent Google from asking for an actual login - no stored google passwords - didn't put in my password on setup - TB finds the available configuration - prompted to login at google - add google password - allow access - error message

I have restarted Thunderbird. I have checked for updates (even though I have it on auto-update).

Are there settings on my Google or Gmail account that could prevent this from working?

I am working on a stig for Mozilla Firefox and I'm trying to do a scap compliance scan but or some reason I am getting a score of zero on all systems. We do patch regularly and at some point one of the version upgrades caused our compliance scans stopped working. I need a fix and cannot find anything when searching for this issue.

I received an email from breach-alerts@mozilla.com informing me that Mozilla Monitor discovered a data breach that includes my personal information: Unfortunately, I don't know if this is a legitimate email from Mozilla. Can anyone confirm if it is or is not?

Thanks

Hello,

I process phishing URL's,

I have recently come across URL's that make use of a BLOB: syntax on the URL:

blob:https://bolig.botik.dk/16c8c011-0fa5-4ba0-a10f-ed7675055cc6

You can see an example of the Phishing URL in this PhishTank entry:

https://phishtank.com/phish_detail.php?phish_id=9118779

That URL then re-directs to the above "BLOB" URL.

My understanding is that it is "locally" generating the phishing website, similar to an old fashioned about: syntax, however it's not clear what the significance of bolig.botik.dk URL is - loading that URL without the BLOB: prefix causes an error

Can someone explain:

1) What is the BLOB: syntax, and 2) what would be reported to have the phishing URL removed in the above example?

My account is hacked this is supposed to be a secure site that's why I downloaded it. They got extensions linked in here . They have a family account I'm not a parent I'm not a kid I'm a grown woman with a hacked phone they I can't get any help with insane . They make things to easy for hackers nothing is protect damn shame .

Hello. I know how to define a server certificate exception to avoid browser warnings in case of certificate issue with a website (see attachment). However, I'd like to apply that exception for all users with access to my machine using a GPO (for user or local machine). This is also a requirement in my work where many users run Firefox from a server and the face browser warnings all the time (related to self-signed certificates) so it would be great to apply an exception for all users through a GPO specifying the self-signed certificate warning we want Firefox to ignore. Thanks.

Hi, I'm installing Thunderbird, and it displays "Mozilla Thunderbird Email wants to access your Google Account", and then "This will allow Mozilla Thunderbird Email to:" and "... permanently delete all your email from Gmail" and "See, edit, share and permanently delete all the calendars that you can access using Google Calendar", DOES THIS MEAN that Thunderbird WILL "DELETE ALL my email from Gmail" as soon as I click ALLOW ??? Silly question, I'm sure, but I don't like the wording, and the possible implication. Thanks, AK

I just installed thunderbird on a new install of windows 11 25h2 and added my email account. When I click on a message a yellow banner appears at the top of the message. Previously there was a options button I could click that would allow showing the remote content. There is no longer a options button and I cannot get thunderbird to show remote content.

I am logged on to my Credit Union and attempt to download my statements. When using Firefox I get the message: {"Errors":["Authorization has been denied for this request."]}

When I contacted my CU, they said to add an URL to the Manage Exceptions. This worked, but I want to know why Firefox needs this but Chrome doesn't.

Firefox detected a potential security threat and did not continue to divar.ir because this website requires a secure connection.

So I keep getting this pop-up message from Norton, "Not seeing new emails in your email app?" Everything seems to work appropriately in Thunderbird. I'm getting new emails as I always have. The problem is as long as Thunderbird is open Norton keeps popping this stupid thing up every 10 or so minutes. Has anyone had this? Have you found a way to get Norton to realize everything is fine and stop popping up? It's like playing a game of wack a mole all day.

Context: Windows 11 23H2, Thunderbird Portable (102.15.1, stubbornly declining updates until the Supernova IU starts looking tolerable), Avast Antivirus. Multiple email accounts on various servers, all POP3.

For the last several months (not sure when it started, but I first took a screenshot in October 2024, so perhaps that was the first time), after each time I reboot my PC, the first time I send an email using one particular account will trigger a complaint about a bad certificate, which is probably caused by Avast getting in the middle of the process. Clicking "View..." opens a tab with certificate information. I'm attaching screenshots.

I assume my other accounts also had a similar complaint when they were first used, but it has been a long time since I added a new account and they are all quiet now. But on this account, I get it the first time I send mail (normally a reply to someone else - this is not my default account for new messages) after each reboot. When I click "Confirm Security Exception" with the "Permanently store this exception" checkbox checked, the next thing I get is "Send Message Error" (see the third screenshot), then I click OK, and then I can hit "Send" again and the message is sent with no complaints. Then I can also send future messages with no complaints until the next time I reboot. (I don't reboot often - normally just when Windows needs to do an update.) This is the only account on Dreamhost (others are InMotion or Google), but other than that, there is nothing special about it, as far as I know. Why is it forgetting my "permanent" exception? Is there a setting somewhere that I should look for?

I just now tried following the instructions on this page: https://support.avast.com/en-us/article/troubleshoot-invalid-antivirus-email-certificate But it says, "This certificate is already installed as a certificate authority." Perhaps that is because I have already gone through the process for this reboot cycle, but if TB needs a new Avast certificate or exception each time I reboot (due to something changing in Avast, perhaps), I'd think the first email I send through any server would ask for the exception, but it's never any other account - just this one Dreamhost one. Fortunately it's just an inconvenience, not a showstopping problem, but it would be nice to solve it eventually.

I have a problem with thunderbird. I can't fetch the certificate in my account settings, it seems it's not security approved. Normally when I type "fetch certificate" a window pops up asking me to confirm a security exception, but this function no longer works on thunderbird. Is there another way I can confirm the security exception?