Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0

JIT optimizations involving the Javascript arguments object could confuse later optimizations

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a…

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash

During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially exploitable crash in the parent process

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2

When using nested workers, a use-after-free could occur during worker destruction

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory…

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application

A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site

A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the…

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash

An integer overflow can occur in the SwizzleData code while calculating buffer sizes

A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element

A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the…

By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash

On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a…

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects…

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process

`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows, causing underallocation of an output…

A race condition is present in the crash generation server used to generate data for the crash reporter

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised…

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site

If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9