A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of…

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest

Insufficient checks when processing graphics shared memory could have led to memory corruption

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g

Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4

When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog

Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in Apple's GPU driver

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation

It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free

Unexpected marking work at the start of sweeping could have led to a use-after-free

Editor code failed to check an attribute value

Incomplete WebAssembly exception handing could have led to a use-after-free

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution

Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6

A malicious devtools extension could have been used to escalate privileges

A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions

Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor

A use-after-free was identified in the `nsDNSService::Init`

The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode

A use-after-free condition affected TLS socket creation when under memory pressure

Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling

The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5

Memory safety bugs present in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1

Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash

Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12

Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free

An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS

Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety…