Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not…

Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service

A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been…

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile…

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially…

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a…

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a…

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to…

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the…

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory