Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially…

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a…

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a…

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to…

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES

Memory corruption in thread creation

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user

Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the…

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory

A clipboard "paste" button could persist across tabs which allowed a spoofing attack

Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser

Video frames could have been leaked between origins in some situations

Truncation of a long URL could have allowed origin spoofing in a permission prompt

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor

The date picker could partially obscure security prompts

ANGLE failed to initialize parameters which lead to reading from uninitialized memory

Select options could obscure the fullscreen notification dialog

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an…

NSS was susceptible to a timing side-channel attack when performing RSA decryption

Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown)

In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain

When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy

A Linux user opening the print preview dialog could have caused the browser to crash

An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash

`EncryptingOutputStream` was susceptible to exposing uninitialized data

The `VideoBridge` allowed any content process to use textures produced by remote decoders

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

Address bar spoofing via bidirectional characters

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable…

A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Push notifications saved to disk unencrypted

Error reporting methods in SpiderMonkey could have triggered an Out of Memory Exception

Memory corruption in JIT UpdateRegExpStatics

Memory corruption in IPC FilePickerShownCallback

Memory corruption in IPC ColorPickerShownCallback

Memory corruption in IPC CanvasTranslator

Full screen notification obscured by external program

The Firefox updater created a directory writable by non-privileged users

A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL

Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the…

A type checking bug would have led to invalid code being compiled

An out-of-bound read could have led to a crash in the RLBox Expat driver