A clipboard "paste" button could persist across tabs which allowed a spoofing attack

Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser

Video frames could have been leaked between origins in some situations

Truncation of a long URL could have allowed origin spoofing in a permission prompt

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor

The date picker could partially obscure security prompts

ANGLE failed to initialize parameters which lead to reading from uninitialized memory

Select options could obscure the fullscreen notification dialog

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an…

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain

When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy

A Linux user opening the print preview dialog could have caused the browser to crash

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash

`EncryptingOutputStream` was susceptible to exposing uninitialized data

The `VideoBridge` allowed any content process to use textures produced by remote decoders

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable…

A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`

When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to…

When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed…

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed…

When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

The Firefox updater created a directory writable by non-privileged users

A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the…

A type checking bug would have led to invalid code being compiled

An out-of-bound read could have led to a crash in the RLBox Expat driver

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result

When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced

Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks

When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of…

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly

When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash

Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the…

The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect

Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox <…

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read…

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash

A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we…