If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin…

When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font

An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification

A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only affects Firefox for…

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these…

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled

A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server

An out-of-bounds read can occur when decoding H264 video

When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system.<br>This…

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile)

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible

The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification

A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack

The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential…

Due to a layout change, iframe contents could have been rendered outside of its border

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`

By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is…

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary

When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type…

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process

Images from a different domain can be read using a canvas object in some circumstances

Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems

Race condition in permission assignment

By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new…

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys

An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system

If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed

A website could have obscured the fullscreen notification by using a dropdown select input element

A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page…

A website could have obscured the full screen notification by using the file open dialog