Certain network request objects were freed too early when releasing a network request handle

Applying a CSS filter effect could have accessed out of bounds memory

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code…

An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately…

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash

A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2

The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only…

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially…

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0

Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent…

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to…

When Responsive Design Mode was enabled, it used references to objects that were previously freed

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the…

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4

If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable…

During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable…

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2

Mozilla developers reported memory safety bugs present in Firefox for Android 79

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0

JIT optimizations involving the Javascript arguments object could confuse later optimizations

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash