Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2

When using nested workers, a use-after-free could occur during worker destruction

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory…

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site

A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the…

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash

An integer overflow can occur in the SwizzleData code while calculating buffer sizes

A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the…

By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash

Integer Overflow in RecordedSourceSurfaceCreation

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects…

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process

`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output…

A race condition is present in the crash generation server used to generate data for the crash reporter

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised…

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site

If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9

If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution

Return registers were overwritten which could have allowed an attacker to execute arbitrary code

Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the…

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially…

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the…

The JIT created incorrect code for arguments in certain cases

When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code