When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest

Insufficient checks when processing graphics shared memory could have led to memory corruption

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when…

If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g