If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution

Return registers were overwritten which could have allowed an attacker to execute arbitrary code

Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the…

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially…

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the…

The JIT created incorrect code for arguments in certain cases

When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code

Firefox could be made to load attacker-supplied DLL files from the installation directory

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in…

The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivileged users or malware

By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements

A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin

An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events

Type Confusion in Async Generators in Javascript Engine

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support

Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13

Memory corruption in the networking stack could have led to a potentially exploitable crash

GetBoundName could return the wrong version of an object when JIT optimizations were applied

Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices

When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read

An unchecked return value in TLS handshake code could have caused a potentially exploitable crash

During garbage collection extra operations were performed on a object that should not be

Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not…

Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service

A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability

When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been…

When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode

Constructing audio sinks could have lead to a race condition when playing audio files and closing windows

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile…

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially…

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a…

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a…

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to…

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES